docs: Add --addr cmd argument in documentations

[ali-jalaal]

Short description

In OPA v1.0+, the server is exposed only on localhost network interface, while in OPA v0.x the server was exposed on all network interfaces (#6286). This change would cause OPA instances in Docker environment to only be exposed on localhost:8181 and not be accessible from host machine (unless --addr=0.0.0.0:8181 argument would be passed).

Steps To Reproduce

According to Running with Docker documentation, by executing the following command:

docker run -p 8181:8181 openpolicyagent/opa run --server --log-level debug

OPA server would not return the response in the host machine by running:

curl -i localhost:8181/

Example response:

curl: (52) Empty reply from server

(Tested with OPA v1.1.0 on Mac and Windows)

Expected behavior

It would be nice to update these 2 docs:

1. Adding a short note about exposed network interfaces and --addr:0.0.0.0:8181 in the example command in Running with Docker document
2. Adding a section in Upgrading to v1.0 document to explain this change, its reason, and how to expose OPA server to all network interfaces

Additional context

Related issue: #7264

[anderseknert]

Sounds good to me 👍 Some info from here could be lifted to the v1 upgrade guide, or linked https://www.openpolicyagent.org/docs/latest/security/#interface-binding

And the docs on Docker updated.

[anderseknert]

This is also covered in the v0 compatibility guide. I agree that it certainly won't hurt to include a note on that in the v1 documentation though, as this may impact even users not interested in v0 compatibility.

[anderseknert]

I haven't looked into the details, and very much just thinking out loud here. But if the default setting results in containerized OPA not being reachable, I wonder if we instead could try and detect when we run in a container and adjust the defaults in that case? 🤔

[ali-jalaal]

I wonder if we instead could try and detect when we run in a container and adjust the defaults in that case?

That would be nice! Currently OPA's behavior differs when running as a local process vs inside a container. Binding the containerized OPA to the localhost interface (of the host machine) would also make it compatible with the documents.