Skip to content

Harden standalone runner server host default#5628

Open
dfgvaetyj3456356-hash wants to merge 2 commits into
bentoml:mainfrom
dfgvaetyj3456356-hash:security/runner-server-localhost-default
Open

Harden standalone runner server host default#5628
dfgvaetyj3456356-hash wants to merge 2 commits into
bentoml:mainfrom
dfgvaetyj3456356-hash:security/runner-server-localhost-default

Conversation

@dfgvaetyj3456356-hash

Copy link
Copy Markdown

What changed

This changes the deprecated standalone start-runner-server CLI host default from the global HTTP server host configuration to the runner implementation's existing localhost fallback. Explicit --host values and BENTOML_HOST are still preserved.

Why

Managed runner servers are already started on 127.0.0.1, but the standalone CLI option could inherit the global HTTP host default. In v2 config that value is 0.0.0.0, which is a surprising default for a runner endpoint that is meant to be internal to BentoML serving.

Keeping the CLI value unset unless the user explicitly configures it lets bentoml.start.start_runner_server() continue applying its existing 127.0.0.1 fallback, while users who intentionally expose the runner server can still pass --host 0.0.0.0.

Validation

  • python -m py_compile src\bentoml_cli\_internal\start.py tests\test_cli_regression.py
  • git diff --check
  • python -m pytest -o addopts= tests\test_cli_regression.py -k "start_runner_server" -q (2 passed)

I also ran python -m pytest -o addopts= tests\test_cli_regression.py -q; the two new tests passed, but the pre-existing timing assertion in test_regression failed locally on this machine. That timing test is already xfailed on GitHub Actions.

@dfgvaetyj3456356-hash dfgvaetyj3456356-hash requested a review from a team as a code owner June 2, 2026 06:33
@dfgvaetyj3456356-hash dfgvaetyj3456356-hash requested review from ssheng and removed request for a team June 2, 2026 06:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant