Sandbox Reachability Checklist

Use this when something is running but you cannot reach it from your browser, another container, another laptop, or a hardware device.

1. Process The app is listening on the right port and bind address.

2. Sandbox The container, VM, or dev sandbox allows that port out.

3. Host The host has an interface and firewall rule that accepts the connection.

4. Network The client can route to the host or device IP.

5. Service The service accepts the request, credentials, and protocol.

Address Meanings

Address	What it means	Who can reach it
`127.0.0.1`	Loopback inside the current network namespace.	Only processes in that same namespace.
`0.0.0.0`	Bind on all IPv4 interfaces in the current namespace.	Anyone who can reach an interface where firewall and routing allow it.
`192.168.x.y`, `10.x.y.z`	Private LAN address on a host or hardware device.	Usually devices on the same LAN, VPN, or routed subnet.
Container IP	Address inside a Docker bridge or container network.	Usually the host and containers on that network, not arbitrary LAN devices.

Docker Port Patterns

Command shape	Result	Use when
`-p 127.0.0.1:8080:80`	Host-only access on port 8080.	You are testing locally and do not want LAN access.
`-p 8080:80`	Publishes on all host interfaces by default.	You deliberately want other reachable clients to try the service.
`EXPOSE 80`	Documents intended container port. It does not publish by itself.	You are writing Dockerfiles or Compose files.

Publishing a port broadly is a real exposure decision. For experiments, prefer loopback binding first, then widen deliberately.

Fast Diagnostics

# Is something listening locally?
lsof -nP -iTCP:8080 -sTCP:LISTEN

# Try the service from this machine.
curl -v http://127.0.0.1:8080/

# Find a macOS LAN IP.
ipconfig getifaddr en0

# Find common Linux LAN IPs.
hostname -I

# Try a LAN address from another device.
curl -v http://HOST_LAN_IP:8080/

Hardware Translation

For a Raspberry Pi or similar Linux device, first find the device address, then SSH in, then repeat the same listening and publishing checks on that device.

ping raspberrypi.local
ssh USER@raspberrypi.local
hostname -I
ss -ltnp

References

Docker port publishing, Linux network namespaces, Raspberry Pi remote access.