@@ -720,7 +720,8 @@ version = 2
     /// `load()` path that the gateway uses at runtime, catching:
     ///   - template corruption or unknown fields (`deny_unknown_fields`)
     ///   - schema drift (version bump or field renames)
-    ///   - accidental changes to the bind address or compute driver list
+    ///   - accidental addition of a wildcard bind-address override
+    ///   - accidental changes to the compute driver list
     #[test]
     fn rpm_default_config_parses_and_has_podman_defaults() {
         let path =
@@ -729,20 +730,12 @@ version = 2
             load(&path).expect("deploy/rpm/gateway.toml.default must parse against current schema");
         let gw = &config.openshell.gateway;
 
-        let addr = gw
-            .bind_address
-            .expect("bind_address must be explicitly set in the RPM default config");
-        assert!(
-            addr.ip().is_unspecified(),
-            "RPM default bind_address must be 0.0.0.0 so Podman sandbox containers \
-             can reach the gateway over the host network bridge, got {addr}"
-        );
-        assert_eq!(
-            addr.port(),
-            openshell_core::config::DEFAULT_SERVER_PORT,
-            "RPM default port must match DEFAULT_SERVER_PORT ({})",
-            openshell_core::config::DEFAULT_SERVER_PORT
-        );
+        if let Some(addr) = gw.bind_address {
+            assert!(
+                !addr.ip().is_unspecified(),
+                "RPM default config must not expose the primary listener on every interface"
+            );
+        }
 
         let drivers = gw
             .compute_drivers
 
@@ -20,14 +20,13 @@ The defaults are tuned for rootless Podman use:
 version = 1
 
 [openshell.gateway]
-bind_address = "0.0.0.0:17670"
 compute_drivers = ["podman"]
 ```
 
-`bind_address = "0.0.0.0:17670"` is required because Podman sandbox
-containers reach the gateway over the host network bridge and cannot
-connect to `127.0.0.1` inside the gateway's network namespace. mTLS is
-enabled by default and protects all connections.
+The RPM does not override `bind_address`. The primary listener uses the
+built-in `127.0.0.1:17670` default. The Podman driver reports the callback
+interface it needs, and the gateway adds a separate listener scoped to that
+interface. This keeps the general API off unrelated host interfaces.
 
 `compute_drivers = ["podman"]` pins the compute driver to Podman. Without
 this, the gateway auto-detects in order: Kubernetes, Podman, Docker. Pinning
@@ -43,8 +42,8 @@ To apply environment variable overrides that persist across upgrades without
 editing the TOML file, add them to `~/.config/openshell/gateway.env`:
 
 ```shell
-# Example: restrict to loopback only
-OPENSHELL_BIND_ADDRESS=127.0.0.1
+# Example: explicitly expose the primary listener on one host interface
+OPENSHELL_BIND_ADDRESS=192.168.1.10
 ```
 
 To override the path to the TOML config file entirely:
@@ -63,8 +62,9 @@ systemctl --user edit openshell-gateway
 ## TLS (mTLS)
 
 The RPM enables mutual TLS by default. The gateway requires a valid
-client certificate for all API connections and listens on
-`0.0.0.0:17670` by default (see "Default configuration" above).
+client certificate for all API connections. Its primary listener uses
+`127.0.0.1:17670`; Podman callback traffic uses the additional listener
+described in "Default configuration" above.
 
 ### Auto-generated certificates
 
@@ -214,7 +214,7 @@ overrides that persist across package upgrades.
 
 | TOML option | Default | Description |
 |-------------|---------|-------------|
-| `bind_address` | `0.0.0.0:17670` (RPM default) | Address for the gRPC/HTTP API. |
+| `bind_address` | `127.0.0.1:17670` (gateway default) | Address for the primary gRPC/HTTP API listener. |
 | `compute_drivers` | `["podman"]` (RPM default) | When unset, the gateway auto-detects Kubernetes, then Podman, then Docker. The RPM default pins to Podman. |
 | `default_image` | `ghcr.io/nvidia/openshell-community/sandboxes/base:latest` | Default sandbox image. |
 | `supervisor_image` | `ghcr.io/nvidia/openshell/supervisor:latest` | Supervisor image mounted into Podman sandboxes. |
@@ -235,7 +235,6 @@ settings:
 version = 1
 
 [openshell.gateway]
-bind_address = "0.0.0.0:17670"
 compute_drivers = ["podman"]
 default_image = "ghcr.io/nvidia/openshell-community/sandboxes/base:latest"
 
 
@@ -65,11 +65,11 @@ On first start, the gateway automatically generates:
 
 - A self-signed PKI bundle (CA, server cert, client cert) for mTLS
 
-> **Note:** The RPM default configuration binds to `0.0.0.0:17670` so
-> Podman sandbox containers can reach the gateway over the host network
-> bridge. Mutual TLS (mTLS) is enabled automatically on first start,
-> requiring a valid client certificate for every connection. See
-> CONFIGURATION.md for details.
+> **Note:** The primary gateway listener uses the loopback default,
+> `127.0.0.1:17670`. The Podman driver requests a separate callback listener
+> scoped to the interface its sandboxes can reach. Mutual TLS (mTLS) is
+> enabled automatically on first start, requiring a valid client certificate
+> for every connection. See CONFIGURATION.md for details.
 
 Verify the service is running:
 
 
@@ -85,7 +85,7 @@ Generate certificates that include the server's hostname or IP in the
 SANs. See "Using externally-managed certificates" in CONFIGURATION.md.
 Then change `bind_address` in
 `~/.config/openshell/gateway.toml` to the interface the remote CLI
-can reach, for example `0.0.0.0:17670`, and restart the gateway.
+can reach, for example `192.168.1.10:17670`, and restart the gateway.
 
 After placing the server and client certs, register from the remote
 CLI:
@@ -274,11 +274,12 @@ Other breaking changes in this release:
 
 - **Default bind address changed from `0.0.0.0` to `127.0.0.1`.** If
   you relied on network-accessible access without an explicit bind
-  address, add the following to `~/.config/openshell/gateway.toml`:
+  address, bind the specific reachable interface in
+  `~/.config/openshell/gateway.toml`:
 
   ```toml
   [openshell.gateway]
-  bind_address = "0.0.0.0:17670"
+  bind_address = "192.168.1.10:17670"
   ```
 
   Also update your firewall rule if applicable:
 
@@ -18,11 +18,9 @@
 version = 1
 
 [openshell.gateway]
-# Podman sandbox containers reach the gateway over the host network bridge,
-# which requires binding to all interfaces. Override to 127.0.0.1:17670 if
-# you don't use Podman or want loopback-only access (e.g. behind a reverse
-# proxy). mTLS is enabled by default and protects all connections.
-bind_address = "0.0.0.0:17670"
+# Keep the primary listener on the built-in 127.0.0.1:17670 default. The
+# Podman driver reports the callback interface it needs, and the gateway
+# adds a separate listener scoped to that interface.
 
 # Pin to the Podman compute driver. Without this, the gateway auto-detects
 # in order: Kubernetes, Podman, Docker. Pinning prevents unexpected driver
 
@@ -399,10 +399,10 @@ toml_string() {
 GATEWAY_CONFIG="${STATE_DIR}/gateway.toml"
 
 # Start from the RPM default template so this e2e test exercises the same
-# TOML config path that RPM users get on first start. The template sets
-# bind_address = "0.0.0.0:17670" and compute_drivers = ["podman"]; those
-# values must be correct for Podman e2e to pass, which means a regression
-# to the template (wrong bind address, wrong driver) will surface here.
+# TOML config path that RPM users get on first start. The template leaves
+# bind_address unset and sets compute_drivers = ["podman"], so this test
+# exercises the built-in loopback listener plus the callback listener
+# requested by the Podman driver.
 #
 # We append the driver-specific table and override the port via CLI flag
 # (CLI > TOML in the merge precedence) so the test can use an ephemeral port.
@@ -433,8 +433,8 @@ cp "${ROOT}/deploy/rpm/gateway.toml.default" "${GATEWAY_CONFIG}"
 
 GATEWAY_ARGS=(
   --config "${GATEWAY_CONFIG}"
-  # bind_address and compute_drivers come from the RPM template; no CLI flags
-  # needed. Port is overridden via CLI (CLI > TOML) for ephemeral port selection.
+  # compute_drivers comes from the RPM template, while bind_address uses the
+  # built-in loopback default. Override only the port for ephemeral selection.
   --port "${HOST_PORT}"
   --health-port "${HEALTH_PORT}"
   --tls-cert "${PKI_DIR}/server/tls.crt"