Bun.serve default bind address: restricting a dev server to localhost only

Answer

To guarantee that a development server started with Bun.serve() is reachable only from the loopback interface, explicitly set the hostname option. For IPv4 loopback use hostname: "127.0.0.1"; for IPv6 loopback use hostname: "::1". The default behavior of binding to all interfaces (0.0.0.0 / ::) is documented as stable across Bun v1.x releases, so you can rely on it unless you override it.

Confirmed facts

• Passing hostname: "127.0.0.1" to Bun.serve() binds the server to the IPv4 loopback address only.
• Binding to "127.0.0.1" does not automatically include the IPv6 loopback (::1); a separate hostname value is required for IPv6.
• The Bun documentation states that when no hostname is provided, the server binds to 0.0.0.0 (IPv4) and :: (IPv6), i.e., all network interfaces, and this behavior has remained unchanged in the v1.x series.
• At runtime you can inspect the bound address via the server object returned by Bun.serve() (e.g., server.address()) or with OS tools such as ss -tulpn or netstat -an.

Likely explanation

The hostname option is forwarded directly to the underlying TCP listener. Supplying a literal loopback address tells the OS to accept connections only on that interface, preventing external LAN hosts from reaching the port even if the firewall allows it. Because the option is explicit, the behavior is identical for every developer regardless of their machine’s network configuration.

Verification steps

1. Start the server with the desired hostname value, e.g.:

   const server = Bun.serve({ hostname: '127.0.0.1', port: 3000, fetch(req) { return new Response('hello'); } });

2. After the server starts, log the bound address:

   console.log('Listening on', server.address());

   This will show an object containing address: '127.0.0.1' (or '::1' for IPv6).
3. Alternatively, run on Linux/macOS:

   ss -tulpn | grep 3000

   or

   netstat -an | grep 3000

   and verify that the local address column shows 127.0.0.1:3000 (or [::1]:3000).
4. Attempt to connect from another device on the same LAN using the machine’s LAN IP; the connection should be refused or timeout.

Missing diagnostic detail

Do you need the server to be reachable via IPv6 loopback (::1) as well as IPv4? If yes, you must either set hostname: '::1' (IPv6 only) or run two separate instances, one for each loopback address, because a single hostname value does not bind to both stacks simultaneously.