You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@airflow.apache.org by "ananich (via GitHub)" <gi...@apache.org> on 2026/01/05 11:35:33 UTC
[PR] Support explicit bind address for worker log server [airflow]
ananich opened a new pull request, #60117:
URL: https://github.com/apache/airflow/pull/60117
# Problem
Currently, the Airflow worker log server (serve_logs.py) is hardcoded to bind to all available interfaces (0.0.0.0 or [::]) via socket.has_dualstack_ipv6(). This exposes port 8793 to the entire network by default, creating a potential security risk where task logs could be intercepted or scanned by unauthorized entities.
# Proposed Change
This PR modifies the log server initialization to respect the WORKER_LOG_SERVER_HOST configuration variable. If this variable is set (e.g., to 127.0.0.1), the server will bind specifically to that address. If not set, it falls back to the existing dual-stack wildcard logic to maintain backward compatibility.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on code in PR #60117:
URL: https://github.com/apache/airflow/pull/60117#discussion_r2725005650
##########
airflow-core/src/airflow/config_templates/config.yml:
##########
@@ -977,6 +977,14 @@ logging:
type: string
example: "fastapi,sqlalchemy"
default: ""
+ worker_log_server_host:
+ description: |
+ The interface address on which the worker should start the log server.
+ If not set, it will default to 0.0.0.0 (or [::] for IPv6).
+ version_added: ~
Review Comment:
```suggestion
version_added: 3.2.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3775567559
Can you please add a unit test for this?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4017029822
I'm not sure if fixing this is possible right now; the linter is requiring me to remove import socket, which I believe is too restrictive. Currently, there should only be one failed check for the 'unused' import, but without it, the tests will likely fail.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "boring-cyborg[bot] (via GitHub)" <gi...@apache.org>.
boring-cyborg[bot] commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3710070524
Congratulations on your first Pull Request and welcome to the Apache Airflow community! If you have any issues or are unsure about any anything please check our Contributors' Guide (https://github.com/apache/airflow/blob/main/contributing-docs/README.rst)
Here are some useful points:
- Pay attention to the quality of your code (ruff, mypy and type annotations). Our [prek-hooks]( https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst#prerequisites-for-prek-hooks) will help you with that.
- In case of a new feature add useful documentation (in docstrings or in `docs/` directory). Adding a new operator? Check this short [guide](https://github.com/apache/airflow/blob/main/airflow-core/docs/howto/custom-operator.rst) Consider adding an example DAG that shows how users should use it.
- Consider using [Breeze environment](https://github.com/apache/airflow/blob/main/dev/breeze/doc/README.rst) for testing locally, it's a heavy docker but it ships with a working Airflow and a lot of integrations.
- Be patient and persistent. It might take some time to get a review or get the final approval from Committers.
- Please follow [ASF Code of Conduct](https://www.apache.org/foundation/policies/conduct) for all communication including (but not limited to) comments on Pull Requests, Mailing list and Slack.
- Be sure to read the [Airflow Coding style]( https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#coding-style-and-best-practices).
- Always keep your Pull Requests rebased, otherwise your build might fail due to changes not related to your commits.
Apache Airflow is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: dev@airflow.apache.org
Slack: https://s.apache.org/airflow-slack
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on code in PR #60117:
URL: https://github.com/apache/airflow/pull/60117#discussion_r2662501573
##########
airflow-core/src/airflow/utils/serve_logs/core.py:
##########
@@ -41,11 +41,16 @@ def serve_logs(port=None):
setproctitle("airflow serve-logs")
port = port or conf.getint("logging", "WORKER_LOG_SERVER_PORT")
+ host = conf.get("logging", "WORKER_LOG_SERVER_HOST", fallback=host)
Review Comment:
https://github.com/apache/airflow/blob/main/airflow-core/src/airflow/config_templates/config.yml updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3796137070
@ananich static checks are failing. can you fix it?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3795893224
> Can you please add a unit test for this?
Done @potiuk
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3841790935
> @eladkal, one more fix is ready for testing 🙂
NO - not ready until all the tests pass.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4016797117
Let's try this new approach @potiuk @eladkal
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3805804989
> @ananich static checks are failing. can you fix it?
@eladkal, can you try one more time, please?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4033686774
Generally speaking just install `prek` and run it locally if the static checks fail. I am not sure about removing socket - but prek checks of ours (except mypy) are usually pretty predictable and stable (and make sense)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "kaxil (via GitHub)" <gi...@apache.org>.
kaxil commented on code in PR #60117:
URL: https://github.com/apache/airflow/pull/60117#discussion_r2662473510
##########
airflow-core/src/airflow/utils/serve_logs/core.py:
##########
@@ -41,11 +41,16 @@ def serve_logs(port=None):
setproctitle("airflow serve-logs")
port = port or conf.getint("logging", "WORKER_LOG_SERVER_PORT")
+ host = conf.get("logging", "WORKER_LOG_SERVER_HOST", fallback=host)
Review Comment:
new config should be added to https://github.com/apache/airflow/blob/main/airflow-core/src/airflow/config_templates/config.yml
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-3806689036
@eladkal, one more fix is ready for testing 🙂
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4296503570
@ananich This draft PR has been inactive for 20 days since the last triage comment and no response from the author. Closing to keep the queue clean.
You are welcome to reopen this PR when you resume work, or to open a new one addressing the issues previously raised. There is no rush — take your time.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4179452762
@ananich This PR has been converted to **draft** because it does not yet meet our [Pull Request quality criteria](https://github.com/apache/airflow/blob/main/contributing-docs/05_pull_requests.rst#pull-request-quality-criteria).
**Issues found:**
- :x: **Merge conflicts**: This PR has merge conflicts with the `main` branch. Your branch is 824 commits behind `main`. Please rebase your branch (`git fetch origin && git rebase origin/main`), resolve the conflicts, and push again. See [contributing quick start](https://github.com/apache/airflow/blob/main/contributing-docs/03a_contributors_quick_start_beginners.rst).
- :x: **Pre-commit / static checks**: Failing: CI image checks / Static checks. Run `prek run --from-ref main` locally to find and fix issues. See [Pre-commit / static checks docs](https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst).
- :x: **Build docs**: Failing: CI image checks / Build documentation (--docs-only). Run `breeze build-docs` locally to reproduce. See [Build docs docs](https://github.com/apache/airflow/blob/main/contributing-docs/16_documentation.rst).
- :x: **Other failing CI checks**: Failing: CI image checks / Build documentation (--spellcheck-only), Non-DB tests: core / Non-DB-core::3.10:API...Serialization, Special tests / Latest Boto test: core / All-core:LatestBoto-Postgres:14:3.10:API...Serialization, Special tests / Pendulum2 test: core / All-core:Pendulum2-Postgres:14:3.10:API...Serialization, Low dep tests:core / All-core:LowestDeps:14:3.10:API...Serialization. Run `prek run --from-ref main` locally to reproduce. See [static checks docs](https://github.com/apache/airflow/blob/main/contributing-docs/08_static_code_checks.rst).
> **Note:** Your branch is **824 commits behind `main`**. Some check failures may be caused by changes in the base branch rather than by your PR. Please rebase your branch and push again to get up-to-date CI results.
**What to do next:**
- The comment informs you what you need to do.
- Fix each issue, then mark the PR as "Ready for review" in the GitHub UI - but only after making sure that all the issues are fixed.
- There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates.
- Maintainers will then proceed with a normal review.
Converting a PR to draft is **not** a rejection — it is an invitation to bring the PR up to the project's standards so that maintainer review time is spent productively. There is no rush — take your time and work at your own pace. We appreciate your contribution and are happy to wait for updates. If you have questions, feel free to ask on the [Airflow Slack](https://s.apache.org/airflow-slack).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "ananich (via GitHub)" <gi...@apache.org>.
ananich commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4016691441
I can not reproduce, sorry. Would you mind to run tests one more time? @potiuk @eladkal
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "eladkal (via GitHub)" <gi...@apache.org>.
eladkal commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4055114703
tests are still failing
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #60117:
URL: https://github.com/apache/airflow/pull/60117#issuecomment-4033689602
I approved workflows again.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support explicit bind address for worker log server [airflow]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk closed pull request #60117: Support explicit bind address for worker log server
URL: https://github.com/apache/airflow/pull/60117
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org