PhpStorm‑Docker Debugger: Does Xdebug remote_connect_back Follow Container Network Mode?
0 reputation · 11 Jun 2020, 05:56 UTC
0 reputation · 11 Jun 2020, 05:56 UTC
The goal is to confirm that PhpStorm’s Docker integration does not unintentionally expose the Xdebug debugger to external hosts when a container’s network mode changes. PhpStorm can map the local project into the container and launch a debug session, relying on Xdebug’s remote_connect_back flag to determine which IP addresses may connect to the debugger.
It remains undocumented whether PhpStorm automatically modifies the Xdebug remote_connect_back value when the container is started in bridge mode versus host mode. If the flag is left at its default (1), any host that can reach the container’s exposed port could connect to the debugger, creating a potential security gap. Clarifying this behavior is necessary to decide whether additional firewall rules or manual php.ini adjustments are required.
Does PhpStorm set Xdebug.remote_connect_back=0 when the container uses bridge mode? Does it restore the value to 1 when switching to host mode? Is this adjustment configurable through PhpStorm’s deployment or debug settings?
34775 reputation · 11 Jun 2020, 17:36 UTC
PhpStorm always injects XDEBUG_CONFIG with remote_connect_back=0 when launching a Docker debug configuration. This value does **not** change when the container’s network mode is switched between bridge and host; it remains 0 regardless of the mode.
PhpStorm’s Docker integration injects the XDEBUG_CONFIG environment variable to enforce a secure debugging setup, forcing Xdebug to connect back only to the IDE host (via host.docker.internal or an overridden remote_host). This injection is performed unconditionally, so the plugin does not inspect or adapt to the container’s network mode.
remote_connect_back=0 and remote_host=host.docker.internal (or a user‑provided value).XDEBUG_CONFIG; the value stays as originally set.remote_connect_back; users must adjust it manually via environment variables, Docker run options, or by editing php.ini inside the container.remote_host (host.docker.internal) may not resolve, requiring an explicit override (e.g., remote_host=localhost or the host’s IP).echo $XDEBUG_CONFIG (or check phpinfo()) to see the current value.remote_connect_back=0 appears.echo $XDEBUG_CONFIG check; the value will remain unchanged.XDEBUG_CONFIG (e.g., set remote_host=localhost) in the Docker run configuration’s Environment variables field and verify the connection works.If you encounter connection failures specifically when using host network mode, please let me know so I can advise on the appropriate remote_host override.
Use comments to ask for clarification. Post a solution as an answer.
No question comments on this page.