> For the complete documentation index, see [llms.txt](https://docs.roboflow.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.roboflow.com/reference/changelog/changelog/september-2026/inference-server-binds-to-localhost-by-default.md).

# Inference Server binds to localhost by default

`inference server start` now publishes the server port on `127.0.0.1` instead of on every network interface. A server started with the CLI answers only the machine it is running on.

{% hint style="warning" %}
**This breaks access over your LAN.** If you reach an Inference Server from a different machine - a laptop calling a Jetson or a Raspberry Pi, a camera host calling a shared GPU box, a CI runner, a container on another host, a phone on the same Wi-Fi - those requests are now refused until you opt back in with `--bind-address 0.0.0.0`.
{% endhint %}

```bash
# new default: reachable only from this machine
inference server start

# previous behaviour: reachable from every machine that can route to this host
inference server start --bind-address 0.0.0.0
```

{% hint style="info" %}
**NVIDIA Jetson keeps the old behaviour.** Jetson images are headless edge devices that are almost always driven from another machine, so they are still published on `0.0.0.0` and nothing breaks for them. That also means a Jetson is reachable by anything on its network by default - apply the controls below, or pin it down with `--bind-address 127.0.0.1`.
{% endhint %}

## Why

A self-hosted Inference Server requires no authentication by default, and it executes Workflows Custom Python blocks. Together that is arbitrary code execution on your host for anyone who can reach port `9001`. Publishing on every interface handed that to everything on the local network, including untrusted Wi-Fi. Loopback is now the default so the safe configuration is the one you get without thinking about it.

## Before you bind to `0.0.0.0`

Exposing the port is opting into a deployment that needs its own controls:

* Set `WORKSPACES_WHITELISTED_FOR_LOCAL_DEPLOYMENT`, or put your own authentication in front of the server.
* Set `ALLOW_CUSTOM_PYTHON_EXECUTION_IN_WORKFLOWS=false` unless your Workflows genuinely need custom Python.
* Terminate TLS at the server or an upstream proxy if requests leave the host.

## If you start containers yourself

Nothing changed, and nothing can: `HOST` selects the interface *inside* the container, which is a separate network namespace, so the image cannot restrict what the host publishes. `docker run -p 9001:9001` still publishes on every interface. To get the new behaviour, bind the host side of the mapping explicitly:

```bash
docker run --rm -p 127.0.0.1:9001:9001 roboflow/roboflow-inference-server-cpu:latest
```

Under `--network host` there is no port mapping, so set `-e HOST=127.0.0.1` instead. In Kubernetes, keep `HOST=0.0.0.0` and control exposure with the Service type and NetworkPolicy.

## Also in this change

* Raspberry Pi and other CPU/GPU targets get the new `127.0.0.1` default; only Jetson images are exempt.
* `inference server start --tunnel` still publishes on `0.0.0.0`, because the tunnel runs in a separate container and reaches the server through the host gateway. The CLI prints a notice when it does this.
* The macOS and Windows desktop app bundles bind `127.0.0.1` as well. Set `HOST=0.0.0.0` to restore the previous behaviour.