How to set ALLOWED_HOSTS Django setting in production when using Docker?

Question

I always set my ALLOWED_HOSTS from an environment variable in Django. In my development .env I always set ALLOWED_HOSTS=.localhost,.127.0.0.1 and in production ALLOWED_HOSTS=mydomain.dom,my_ip_address

Now I am currently getting acquainted with Docker, and the question is what is the value of the ALLOWED_HOSTS in production. Should it remain as localhost, since I understand localhost will refer to the host container or should I set it as my domain. I am using Nginx for reverse proxy to forward requests.

Answer 1

You should set it to your domain. ALLOWED_HOSTS is used to determine whether the request originated from the correct domain name.

If you look at the docs for ALLOWED_HOSTS, you'll see that it is compared to the request's Host header, which is set by the User agent of the person visiting your site.

So although the Docker container is serving to it's own localhost, the request is originating from example.com

Check out this part of the docs to see exactly why host header validation is necessary, and you will probably better understand the purpose of ALLOWED_HOSTS

Answer 2

You can just use your regular domain/IP address. ALLOWED_HOSTS has to do with the headers of the user matching the IP of the server. The internal mechanics on the server are not the concern of it.

ALLOWED_HOSTS=mydomain.dom,my_ip_address

Is what you should go with.