Inference Server binds to localhost by default

inference server start now publishes the server port on 127.0.0.1 instead of on every network interface. A server started with the CLI answers only the machine it is running on.

This breaks access over your LAN. If you reach an Inference Server from a different machine - a laptop calling a Jetson or a Raspberry Pi, a camera host calling a shared GPU box, a CI runner, a container on another host, a phone on the same Wi-Fi - those requests are now refused until you opt back in with --bind-address 0.0.0.0.

# new default: reachable only from this machine
inference server start

# previous behaviour: reachable from every machine that can route to this host
inference server start --bind-address 0.0.0.0

NVIDIA Jetson keeps the old behaviour. Jetson images are headless edge devices that are almost always driven from another machine, so they are still published on 0.0.0.0 and nothing breaks for them. That also means a Jetson is reachable by anything on its network by default - apply the controls below, or pin it down with --bind-address 127.0.0.1.

Why

A self-hosted Inference Server requires no authentication by default, and it executes Workflows Custom Python blocks. Together that is arbitrary code execution on your host for anyone who can reach port 9001. Publishing on every interface handed that to everything on the local network, including untrusted Wi-Fi. Loopback is now the default so the safe configuration is the one you get without thinking about it.

Before you bind to 0.0.0.0

Exposing the port is opting into a deployment that needs its own controls:

• Set WORKSPACES_WHITELISTED_FOR_LOCAL_DEPLOYMENT, or put your own authentication in front of the server.

• Set ALLOW_CUSTOM_PYTHON_EXECUTION_IN_WORKFLOWS=false unless your Workflows genuinely need custom Python.

• Terminate TLS at the server or an upstream proxy if requests leave the host.

If you start containers yourself

Nothing changed, and nothing can: HOST selects the interface inside the container, which is a separate network namespace, so the image cannot restrict what the host publishes. docker run -p 9001:9001 still publishes on every interface. To get the new behaviour, bind the host side of the mapping explicitly:

docker run --rm -p 127.0.0.1:9001:9001 roboflow/roboflow-inference-server-cpu:latest

Under --network host there is no port mapping, so set -e HOST=127.0.0.1 instead. In Kubernetes, keep HOST=0.0.0.0 and control exposure with the Service type and NetworkPolicy.

Also in this change

• Raspberry Pi and other CPU/GPU targets get the new 127.0.0.1 default; only Jetson images are exempt.

• inference server start --tunnel still publishes on 0.0.0.0, because the tunnel runs in a separate container and reaches the server through the host gateway. The CLI prints a notice when it does this.

• The macOS and Windows desktop app bundles bind 127.0.0.1 as well. Set HOST=0.0.0.0 to restore the previous behaviour.