SeaweedFS: S3 gateway on the compose network only

PocketBase reaches the gateway over the compose network (or inside the
AIO container), so publishing 8333 on the host only made a second
SeaweedFS stack fail with "port is already allocated". Drop the binding
and SEAWEED_S3_BIND/SEAWEED_S3_PORT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker/.env.prod.seaweedfs.example

@@ -120,11 +120,8 @@ PB_S3_REGION=us-east-1
 SEAWEED_DATA=seaweed_data
 # The gateway image, pinned so a redeploy months from now brings up the same one.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# The S3 port is published on loopback only — the stack reaches the gateway over
-# the compose network, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
+# The S3 gateway publishes no host port: the stack reaches it over the compose
+# network.
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file

Docker/.env.prod.seaweedfs.split.example

@@ -129,13 +129,7 @@ SEAWEED_DATA=seaweed_data
 # The SeaweedFS image, pinned so a redeploy months from now brings up the same
 # one. All five SeaweedFS containers run it.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# The S3 port is published on loopback only — the stack reaches the gateway over
-# the compose network, and this is for tools like aws-cli. Set
-# SEAWEED_S3_BIND=0.0.0.0 to expose it to other hosts, and mean it.
-# SEAWEED_S3_BIND=127.0.0.1
-# SEAWEED_S3_PORT=8333
-#
-# The master, volume and filer publish no host port at all. The admin UI below
+# The S3 gateway, master, volume and filer publish no host port at all. The admin UI below
 # shows what they would: the volume server in particular serves file content by
 # id with no authentication, so it stays on the compose network. Reach the
 # others with `docker compose exec`.

Docker/.env.seaweedfs.example

@@ -92,8 +92,6 @@ PB_S3_BUCKET=drivervault
 PB_S3_REGION=us-east-1
 # The gateway image, pinned so a rebuild months from now brings up the same one.
 # SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
-# Host port for the S3 API, so aws-cli and friends can reach it while developing.
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file

Docker/.env.seaweedfs.split.example

@@ -112,14 +112,14 @@ SEAWEED_ADMIN_PASSWORD=
 
 # --- SeaweedFS host ports (optional; defaults shown) -------------------------
 # Published for aws-cli, `weed shell` and poking around while developing. The
-# stack itself reaches every one of these over the compose network.
+# stack itself reaches every one of these over the compose network, and the S3
+# gateway too, which is not published so a second stack cannot clash on it.
 # Note SEAWEED_VOLUME_PORT: the volume server serves file content by id with NO
 # authentication, so do not carry this mapping over to a shared machine. It
 # lands on 8081 because API_PORT already has 8080.
 # SEAWEED_MASTER_PORT=9333
 # SEAWEED_VOLUME_PORT=8081
 # SEAWEED_FILER_PORT=8888
-# SEAWEED_S3_PORT=8333
 
 # Existing uploads are NOT migrated when this is switched on: PocketBase copies
 # nothing, so attachments made before the switch stop resolving. Read the file

Docker/docker-compose.prod.seaweedfs.split.yml

@@ -30,7 +30,7 @@ name: drivervault
 # filename overlap). So the two files are interchangeable on the same SEAWEED_DATA,
 # with no migration either way. A *second* volume server would need its own.
 #
-# Only the S3 gateway and the admin UI publish a host port. Master, volume and
+# Only the admin UI publishes a host port. The S3 gateway, master, volume and
 # filer are reachable over the compose network, through the admin UI, or with
 # `docker compose exec` — the volume server in particular serves file content by
 # id with no authentication at all, so it has no business on a public interface.
@@ -187,11 +187,7 @@ services:
       # Never serve before an identity exists — see seaweedfs-init above.
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # Loopback only: the stack reaches the gateway over the compose network,
-      # so this is here for `aws s3 ls --endpoint-url http://127.0.0.1:8333` and
-      # nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz || exit 1"]
       interval: 10s

Docker/docker-compose.prod.seaweedfs.yml

@@ -46,11 +46,7 @@ services:
       # bind mount, exactly as PB_DATA works. Back it up alongside PB_DATA —
       # from here on the attachments live here, not in the database volume.
       - "${SEAWEED_DATA:-seaweed_data}:/data"
-    ports:
-      # Loopback only: the stack reaches the gateway over the compose network,
-      # so this is here for `aws s3 ls --endpoint-url http://127.0.0.1:8333` and
-      # nothing else. Set SEAWEED_S3_BIND=0.0.0.0 to expose it, and mean it.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:9333/cluster/status || exit 1"]
       interval: 10s

Docker/docker-compose.seaweedfs.split.yml

@@ -175,10 +175,7 @@ services:
       # Never serve before an identity exists — see seaweedfs-init above.
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz || exit 1"]
       interval: 10s

Docker/docker-compose.seaweedfs.yml

@@ -37,10 +37,7 @@ services:
     volumes:
       # From here on the attachments live here, not on pb_data.
       - seaweed_data:/data
-    ports:
-      # The stack reaches the gateway over the compose network; this is here so
-      # `aws s3 ls --endpoint-url http://localhost:8333` works while developing.
-      - "${SEAWEED_S3_PORT:-8333}:8333"
+    # No published port: the stack reaches the gateway over the compose network.
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:9333/cluster/status || exit 1"]
       interval: 10s