SSH tunnel + Docker localhost FAQ

Short answers for the questions that show up after “connection refused” and “why not just open the port.”

Why bind Docker to 127.0.0.1?

Public CDP/API ports get scanned. Loopback + SSH keeps the attack surface on your SSH key/password instead of an unauthenticated browser debug port.

When do I use ssh -L?

When the service already listens on the VPS loopback and you need to call it from your Mac. See -L vs -R vs -D.

Tunnel works on VPS curl but not on Mac?

Check local port collision, dead SSH session after sleep, and that -L targets the same host:port that works on the VPS. Checklist: connection refused.

Can I generate the command?

Yes — command builder.