# Send Localhost Bridge to your agent Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually. ## Fast path - Download the package from Yavira. - Extract it into a folder your agent can access. - Paste one of the prompts below and point your agent at the extracted folder. ## Suggested prompts ### New install ```text I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete. ``` ### Upgrade existing ```text I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run. ``` ## Machine-readable fields ```json { "schemaVersion": "1.0", "item": { "slug": "localhost-bridge", "name": "Localhost Bridge", "source": "tencent", "type": "skill", "category": "开发工具", "sourceUrl": "https://clawhub.ai/superWorldSavior/localhost-bridge", "canonicalUrl": "https://clawhub.ai/superWorldSavior/localhost-bridge", "targetPlatform": "OpenClaw" }, "install": { "downloadUrl": "/downloads/localhost-bridge", "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=localhost-bridge", "sourcePlatform": "tencent", "targetPlatform": "OpenClaw", "packageFormat": "ZIP package", "primaryDoc": "SKILL.md", "includedAssets": [ "SKILL.md" ], "downloadMode": "redirect", "sourceHealth": { "source": "tencent", "slug": "localhost-bridge", "status": "healthy", "reason": "direct_download_ok", "recommendedAction": "download", "checkedAt": "2026-05-05T03:18:10.083Z", "expiresAt": "2026-05-12T03:18:10.083Z", "httpStatus": 200, "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=localhost-bridge", "contentType": "application/zip", "probeMethod": "head", "details": { "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=localhost-bridge", "contentDisposition": "attachment; filename=\"localhost-bridge-2.0.0.zip\"", "redirectLocation": null, "bodySnippet": null, "slug": "localhost-bridge" }, "scope": "item", "summary": "Item download looks usable.", "detail": "Yavira can redirect you to the upstream package for this item.", "primaryActionLabel": "Download for OpenClaw", "primaryActionHref": "/downloads/localhost-bridge" }, "validation": { "installChecklist": [ "Use the Yavira download entry.", "Review SKILL.md after the package is downloaded.", "Confirm the extracted package contains the expected setup assets." ], "postInstallChecks": [ "Confirm the extracted package includes the expected docs or setup files.", "Validate the skill or prompts are available in your target agent workspace.", "Capture any manual follow-up steps the agent could not complete." ] } }, "links": { "detailUrl": "https://openagent3.xyz/skills/localhost-bridge", "downloadUrl": "https://openagent3.xyz/downloads/localhost-bridge", "agentUrl": "https://openagent3.xyz/skills/localhost-bridge/agent", "manifestUrl": "https://openagent3.xyz/skills/localhost-bridge/agent.json", "briefUrl": "https://openagent3.xyz/skills/localhost-bridge/agent.md" } } ``` ## Documentation ### ⚠️ Security & Privileges This skill requires host-level privileges. It must be reviewed and executed manually by an administrator — never autonomously by an agent. What it does on the host: Creates a systemd service (persistent across reboots) that forwards traffic from a Docker bridge IP to localhost Adds a UFW firewall rule scoped to a specific Docker bridge interface Requires sudo, Docker daemon access, and socat from your distro's official package repository Before running any command: Review the generated /etc/systemd/system/socat---.service file — confirm ExecStart binds only to the intended Docker bridge IP (172.x.x.1), never 0.0.0.0 Review the UFW rule — confirm it targets the correct br- interface and port After setup, verify the port is NOT reachable from the public network: curl --connect-timeout 2 http://:/ must fail Test from inside a container before deploying widely Do not grant an automated agent permissions to run these commands without human approval. ### The Problem A service on the host listens on 127.0.0.1 (AI gateway, MCP server, Ollama, database...). A Docker container needs to reach it. localhost inside the container points to the container itself, not the host. Requests either timeout silently (firewall drops packets) or get connection refused. ### The Solution socat listens on the Docker bridge gateway IP and forwards to host loopback. Combined with a scoped firewall rule, this gives containers access without exposing the service externally. ### 1. Find the Docker bridge gateway IP # For a specific container docker inspect --format '{{json .NetworkSettings.Networks}}' \\ | python3 -c " import json,sys d = json.load(sys.stdin) for net, info in d.items(): print(f'{net}: gateway={info[\\"Gateway\\"]}')" ### 2. Create a systemd service Replace , , , and with your values. Naming convention: socat--- — source network is the Docker network (consumer), target service is the host service. Self-documenting. Examples: socat-bridge-gateway-18789, socat-windmill_default-gateway-18789, socat-bridge-ollama-11434 Review the ExecStart line before enabling — confirm it binds to the Docker bridge IP only. sudo tee /etc/systemd/system/socat---.service > /dev/null << 'EOF' [Unit] Description=Socat bridge: -> : After=network.target docker.service [Service] Type=simple ExecStart=/usr/bin/socat TCP-LISTEN:,bind=,fork,reuseaddr TCP:127.0.0.1: Restart=always RestartSec=5 [Install] WantedBy=multi-user.target EOF # Review the file before enabling: cat /etc/systemd/system/socat---.service sudo systemctl daemon-reload sudo systemctl enable --now socat--- ### 3. Add firewall rule (MANDATORY) Without this, socat listens but packets from the container are silently dropped — causing 30-second timeouts with no error. Review the bridge ID before applying — a wrong ID can expose services. # Find the Linux bridge interface for the Docker network BRIDGE_ID=$(docker network inspect --format '{{.Id}}' | cut -c1-12) # Verify this is the right bridge ip link show br-${BRIDGE_ID} # Allow traffic only on that bridge interface sudo ufw allow in on br-${BRIDGE_ID} to any port proto tcp comment "--" ### 4. Verify security # MUST succeed (from inside a container) docker exec curl -s --connect-timeout 5 http://:/ # MUST fail (from the public network) curl --connect-timeout 2 http://:/ ### Multi-Network Workers A container can be on multiple Docker networks. Each has its own bridge IP. You need a socat instance + firewall rule for each network the container uses. In practice, one network is usually enough. Check all networks: docker inspect --format '{{json .NetworkSettings.Networks}}' ### Common Use Cases Host serviceContainer clientDefault portAI gateway (OpenClaw, LiteLLM)Workflow orchestrator (Windmill, n8n)18789MCP serverDockerized agentvariesOllamaRAG pipeline, agent11434PostgreSQLAPI server5432RedisAny containerized app6379 ### Troubleshooting SymptomCauseFix30s timeout, no errorFirewall dropping packetsAdd UFW rule on the bridge interfaceConnection refusedsocat not runningsystemctl status socat---Works then stops after Docker restartBridge IP changedCheck new gateway IP, update socat bindsocat won't start after rebootDocker not readyEnsure After=docker.service in unit file ### Alternatives Depending on your security posture, consider: Docker host networking (network_mode: host) — simpler but removes all container network isolation Running socat inside a minimal privileged container — avoids host-level systemd changes Configuring the host service to bind to the Docker bridge IP directly — no socat needed, but the service must support custom bind addresses host.docker.internal (Docker Desktop) — works on Mac/Windows, not reliably on Linux ### Prerequisites Install socat from your distro's official package repository: sudo apt-get install -y socat # Debian/Ubuntu sudo dnf install -y socat # Fedora/RHEL ### References Blog post: The Localhost Trap — why this problem exists and why it matters for AI infrastructure Source: Casys-AI/casys-pml-cloud Docker docs: Packet filtering and firewalls ## Trust - Source: tencent - Verification: Indexed source record - Publisher: superWorldSavior - Version: 2.0.0 ## Source health - Status: healthy - Item download looks usable. - Yavira can redirect you to the upstream package for this item. - Health scope: item - Reason: direct_download_ok - Checked at: 2026-05-05T03:18:10.083Z - Expires at: 2026-05-12T03:18:10.083Z - Recommended action: Download for OpenClaw ## Links - [Detail page](https://openagent3.xyz/skills/localhost-bridge) - [Send to Agent page](https://openagent3.xyz/skills/localhost-bridge/agent) - [JSON manifest](https://openagent3.xyz/skills/localhost-bridge/agent.json) - [Markdown brief](https://openagent3.xyz/skills/localhost-bridge/agent.md) - [Download page](https://openagent3.xyz/downloads/localhost-bridge)