Open any "deploy this app" tutorial and you will see HOST=0.0.0.0 in the example. The author isn't malicious; they're solving a different problem.
| Audience | Their setup | Why 0.0.0.0 makes sense for them |
|---|---|---|
| Docker tutorial author | Container behind a host firewall | Container needs to listen on 0.0.0.0 internally for the host to forward to it |
| Cloud deployment guide | VM behind a load balancer / security group | VM listens on all interfaces; SG controls the actual exposure |
| "Run on your phone" demo | Throwaway demo; not asking you to keep it running | Convenience; no one is actually exposed for a 10-minute demo |
Why it misfires for you
You're not running in those contexts. You're running on:
- A Mac on your home Wi-Fi (no security group; UPnP might forward).
- A small VPS with no separate firewall layer (only the OS's firewall, which is probably off).
- A Raspberry Pi sitting on your network indefinitely.
In all three, 0.0.0.0 is the literal command "expose me everywhere I can possibly be reached." That includes the parts you forgot the machine could be reached on.
The two-question self-check
- "What devices need to reach this service?" If only this machine:
127.0.0.1. If your phone too: a Tailscale IP. If a specific other LAN device: that LAN IP. - "What is the smallest binding that satisfies #1?" Use that.
0.0.0.0is almost never the smallest answer.