Docker, Docker-AIO: SeaweedFS S3 gateway on the compose network only

The homeserver reaches the gateway over the compose network (or inside
the AIO container), so publishing 8333 on the host only made a second
SeaweedFS stack fail with "port is already allocated". Drop the binding
and SEAWEED_S3_BIND/SEAWEED_S3_PORT.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Docker-AIO/.env.pocketbase.seaweedfs.example

@@ -62,12 +62,6 @@ WARP_PB_S3_SECRET=
 # SeaweedFS ignores the region; the client insists on one.
 WARP_PB_S3_REGION=us-east-1
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # Building only: the SeaweedFS release to bake in. Leave it commented out
 # to keep the Dockerfile's pin; an empty value breaks the build.
 # SEAWEED_VERSION=4.45

Docker-AIO/.env.pocketbase.seaweedfs.prod.example

@@ -67,12 +67,6 @@ WARP_PB_S3_SECRET=
 # SeaweedFS ignores the region; the client insists on one.
 WARP_PB_S3_REGION=us-east-1
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # ------------------------------------------------------------ homeserver
 
 # Part of every user and room ID: it cannot be changed later.

Docker-AIO/.env.pocketbase.seaweedfs.split.example

@@ -66,12 +66,6 @@ WARP_PB_S3_SECRET=
 # SeaweedFS ignores the region; the client insists on one.
 WARP_PB_S3_REGION=us-east-1
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # SeaweedFS's admin UI. It can mint credentials for the bucket, so the
 # password is required. Put it behind a reverse proxy before binding it
 # to 0.0.0.0. The read-only login is optional.

Docker-AIO/.env.pocketbase.seaweedfs.split.prod.example

@@ -71,12 +71,6 @@ WARP_PB_S3_SECRET=
 # SeaweedFS ignores the region; the client insists on one.
 WARP_PB_S3_REGION=us-east-1
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # SeaweedFS's admin UI. It can mint credentials for the bucket, so the
 # password is required. Put it behind a reverse proxy before binding it
 # to 0.0.0.0. The read-only login is optional.

Docker-AIO/README.md

@@ -106,8 +106,9 @@ docker compose -f docker-compose.pocketbase.seaweedfs.yml up -d --build
 
 Both refuse to start without the key pair, and the split one without
 `SEAWEED_ADMIN_PASSWORD`: either would otherwise serve an open gateway or
-an open panel that can mint credentials. The S3 gateway and the admin UI
-are published on 127.0.0.1 only; the volume server, which serves content
+an open panel that can mint credentials. The S3 gateway is not
+published: the homeserver reaches it inside the container. The admin UI
+is published on 127.0.0.1 only; the volume server, which serves content
 by id with no authentication, is never published. Inside, it is on 8081,
 since 8080 is the web client.
 

Docker-AIO/docker-compose.pocketbase.seaweedfs.prod.yml

@@ -14,8 +14,8 @@
 # into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) is published on
-# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it.
+# client http://localhost:8080. The S3 gateway (8333) is not published: the
+# homeserver reaches it over the compose network.
 #
 # This and docker-compose.pocketbase.seaweedfs.split.yml share their project
 # and volumes: SeaweedFS's data has the same layout either way, so switching
@@ -62,7 +62,6 @@ services:
       - "${WARP_ADMIN_PORT:-8009}:8009"
       - "${WARP_WEB_PORT:-8080}:8080"
       - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
 
 volumes:
   warp-data:

Docker-AIO/docker-compose.pocketbase.seaweedfs.split.prod.yml

@@ -15,9 +15,10 @@
 # not moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin
-# UI (23646) are published on loopback; SEAWEED_S3_BIND and
-# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy.
+# client http://localhost:8080. The SeaweedFS admin UI (23646) is published
+# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy.
+# The S3 gateway (8333) is not published: the homeserver reaches it over
+# the compose network.
 #
 # This and docker-compose.pocketbase.seaweedfs.yml share their project and
 # volumes: SeaweedFS's data has the same layout either way, so switching
@@ -70,7 +71,6 @@ services:
       - "${WARP_ADMIN_PORT:-8009}:8009"
       - "${WARP_WEB_PORT:-8080}:8080"
       - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
       - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646"
 
 volumes:

Docker-AIO/docker-compose.pocketbase.seaweedfs.split.yml

@@ -15,9 +15,10 @@
 # not moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin
-# UI (23646) are published on loopback; SEAWEED_S3_BIND and
-# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy.
+# client http://localhost:8080. The SeaweedFS admin UI (23646) is published
+# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy.
+# The S3 gateway (8333) is not published: the homeserver reaches it over
+# the compose network.
 #
 # This and docker-compose.pocketbase.seaweedfs.yml share their project and
 # volumes: SeaweedFS's data has the same layout either way, so switching
@@ -69,7 +70,6 @@ services:
       - "${WARP_ADMIN_PORT:-8009}:8009"
       - "${WARP_WEB_PORT:-8080}:8080"
       - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
       - "${SEAWEED_ADMIN_BIND:-127.0.0.1}:${SEAWEED_ADMIN_PORT:-23646}:23646"
 
 volumes:

Docker-AIO/docker-compose.pocketbase.seaweedfs.yml

@@ -13,8 +13,8 @@
 # into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) is published on
-# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it.
+# client http://localhost:8080. The S3 gateway (8333) is not published: the
+# homeserver reaches it over the compose network.
 #
 # This and docker-compose.pocketbase.seaweedfs.split.yml share their project
 # and volumes: SeaweedFS's data has the same layout either way, so switching
@@ -60,7 +60,6 @@ services:
       - "${WARP_ADMIN_PORT:-8009}:8009"
       - "${WARP_WEB_PORT:-8080}:8080"
       - "${WARP_PB_BIND:-127.0.0.1}:${WARP_PB_PORT:-8070}:8070"
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
 
 volumes:
   warp-data:

Docker/.env.pocketbase.seaweedfs.example

@@ -67,12 +67,6 @@ WARP_PB_S3_REGION=us-east-1
 # volume outlives the image.
 SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # ------------------------------------------------------------ homeserver
 
 # Part of every user and room ID: it cannot be changed later.

Docker/.env.pocketbase.seaweedfs.prod.example

@@ -73,12 +73,6 @@ WARP_PB_S3_REGION=us-east-1
 # volume outlives the image.
 SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # ------------------------------------------------------------ homeserver
 
 # Part of every user and room ID: it cannot be changed later.

Docker/.env.pocketbase.seaweedfs.split.example

@@ -71,12 +71,6 @@ WARP_PB_S3_REGION=us-east-1
 # volume outlives the image.
 SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # SeaweedFS's admin UI. It can mint credentials for the bucket, so the
 # password is required. Put it behind a reverse proxy before binding it
 # to 0.0.0.0. The read-only login is optional.

Docker/.env.pocketbase.seaweedfs.split.prod.example

@@ -77,12 +77,6 @@ WARP_PB_S3_REGION=us-east-1
 # volume outlives the image.
 SEAWEED_IMAGE=chrislusf/seaweedfs:4.45
 
-# The S3 gateway's host port, on loopback unless the bind address says
-# otherwise. The homeserver does not need it; it is for aws-cli and the
-# like.
-SEAWEED_S3_BIND=127.0.0.1
-SEAWEED_S3_PORT=8333
-
 # SeaweedFS's admin UI. It can mint credentials for the bucket, so the
 # password is required. Put it behind a reverse proxy before binding it
 # to 0.0.0.0. The read-only login is optional.

Docker/README.md

@@ -66,10 +66,12 @@ PocketBase container that talks to the bucket.
   under *Object Store → Users* never displace it; the gateway does not
   start until that identity is there. Set `SEAWEED_ADMIN_PASSWORD` as well.
 
-The S3 gateway and the admin UI are published on 127.0.0.1 only
-(`SEAWEED_S3_BIND`, `SEAWEED_ADMIN_BIND`); master, volume and filer are not
-published, since the volume server serves content by id with no
-authentication. Both SeaweedFS files share a project and the
+The S3 gateway is not published: the homeserver reaches it as
+`seaweedfs:8333` (`seaweedfs-s3:8333` in the split file) on the compose
+network, so a second stack never fights over the host port. The admin UI
+is published on 127.0.0.1 only (`SEAWEED_ADMIN_BIND`); master, volume and
+filer are not published, since the volume server serves content by id
+with no authentication. Both SeaweedFS files share a project and the
 `seaweed-data` layout, so switching between them needs no migration.
 `SEAWEED_IMAGE` pins the SeaweedFS release (4.45).
 

Docker/docker-compose.pocketbase.seaweedfs.prod.yml

@@ -14,8 +14,8 @@
 # Media stored before S3 was on is not moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) is published on
-# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it.
+# client http://localhost:8080. The S3 gateway (8333) is not published: the
+# homeserver reaches it over the compose network.
 #
 # This file shares its project and volumes with
 # docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the
@@ -50,9 +50,6 @@ services:
       AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
     volumes:
       - ${SEAWEED_DATA_VOLUME:-seaweed-data}:/data
-    ports:
-      # For aws-cli and the like; the homeserver uses the compose network.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
     healthcheck:
       # The gateway answering means master, volume and filer are up too.
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]

Docker/docker-compose.pocketbase.seaweedfs.split.prod.yml

@@ -16,9 +16,10 @@
 # moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin
-# UI (23646) are published on loopback; SEAWEED_S3_BIND and
-# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy.
+# client http://localhost:8080. The SeaweedFS admin UI (23646) is published
+# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy.
+# The S3 gateway (8333) is not published: the homeserver reaches it over
+# the compose network.
 # Master, volume and filer are not published: the volume server serves file
 # content by id with no authentication at all.
 #
@@ -143,9 +144,6 @@ services:
         condition: service_healthy
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # For aws-cli and the like; the homeserver uses the compose network.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]
       interval: 10s

Docker/docker-compose.pocketbase.seaweedfs.split.yml

@@ -16,9 +16,10 @@
 # moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) and the SeaweedFS admin
-# UI (23646) are published on loopback; SEAWEED_S3_BIND and
-# SEAWEED_ADMIN_BIND=0.0.0.0 expose them, the admin UI only behind a proxy.
+# client http://localhost:8080. The SeaweedFS admin UI (23646) is published
+# on loopback; SEAWEED_ADMIN_BIND=0.0.0.0 exposes it, only behind a proxy.
+# The S3 gateway (8333) is not published: the homeserver reaches it over
+# the compose network.
 # Master, volume and filer are not published: the volume server serves file
 # content by id with no authentication at all.
 #
@@ -136,9 +137,6 @@ services:
         condition: service_healthy
       seaweedfs-init:
         condition: service_completed_successfully
-    ports:
-      # For aws-cli and the like; the homeserver uses the compose network.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
     healthcheck:
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]
       interval: 10s

Docker/docker-compose.pocketbase.seaweedfs.yml

@@ -14,8 +14,8 @@
 # Media stored before S3 was on is not moved into the bucket.
 #
 # Homeserver http://localhost:8008, admin panel http://localhost:8009, web
-# client http://localhost:8080. The S3 gateway (8333) is published on
-# loopback, for aws-cli and the like; SEAWEED_S3_BIND=0.0.0.0 exposes it.
+# client http://localhost:8080. The S3 gateway (8333) is not published: the
+# homeserver reaches it over the compose network.
 #
 # This file shares its project and volumes with
 # docker-compose.pocketbase.seaweedfs.split.yml: SeaweedFS's data has the
@@ -43,9 +43,6 @@ services:
       AWS_SECRET_ACCESS_KEY: ${WARP_PB_S3_SECRET:?set WARP_PB_S3_SECRET in .env}
     volumes:
       - ${SEAWEED_DATA_VOLUME:-seaweed-data}:/data
-    ports:
-      # For aws-cli and the like; the homeserver uses the compose network.
-      - "${SEAWEED_S3_BIND:-127.0.0.1}:${SEAWEED_S3_PORT:-8333}:8333"
     healthcheck:
       # The gateway answering means master, volume and filer are up too.
       test: ["CMD-SHELL", "wget -qO- http://127.0.0.1:8333/healthz >/dev/null || exit 1"]