fix: skip pollPorts retries for containers without published ports, skip redundant forwarders when host==container port

Author: alysnnix

internal/daemon/daemon.go

@@ -163,25 +163,33 @@ func (d *Daemon) OnContainerStart(ctx context.Context, info watcher.ContainerInf
 			continue
 		}
 
+		newPortMappings = append(newPortMappings, state.PortMapping{
+			ContainerPort: e.containerPort,
+			HostPort:      e.hostPort,
+			Service:       e.service,
+		})
+
+		// When host port == container port, Docker's 0.0.0.0 binding already
+		// covers the project loopback IP. No forwarder needed — DNS alone is enough.
+		if e.hostPort == e.containerPort {
+			slog.Info("direct access via Docker binding (host==container port)",
+				"project", project, "service", e.service, "port", e.containerPort)
+			continue
+		}
+
 		targetAddr := fmt.Sprintf("127.0.0.1:%d", e.hostPort)
 
 		fwdCtx, fwdCancel := context.WithCancel(ctx)
 		fwd := forwarder.New(listenAddr, targetAddr)
 		go func() {
 			if err := fwd.Start(fwdCtx); err != nil {
-				slog.Error("forwarder error", "listen", listenAddr, "error", err)
+				slog.Warn("forwarder bind failed", "listen", listenAddr, "error", err)
 			}
 		}()
 
 		d.forwarders[project] = append(d.forwarders[project], fwd)
 		d.cancelFns[cancelKey] = fwdCancel
 
-		newPortMappings = append(newPortMappings, state.PortMapping{
-			ContainerPort: e.containerPort,
-			HostPort:      e.hostPort,
-			Service:       e.service,
-		})
-
 		slog.Info("forwarding", "project", project, "listen", listenAddr, "target", targetAddr)
 	}
 

internal/watcher/watcher.go

@@ -143,12 +143,18 @@ func (w *Watcher) handleEvent(ctx context.Context, event events.Message) {
 }
 
 func (w *Watcher) pollPorts(ctx context.Context, containerID string) (map[int]int, error) {
-	for _, delay := range backoffSequence() {
+	for i, delay := range backoffSequence() {
 		inspect, err := w.docker.ContainerInspect(ctx, containerID)
 		if err != nil {
 			return nil, fmt.Errorf("inspect failed: %w", err)
 		}
 
+		// On first inspect, check if the container even has port bindings configured.
+		// Containers with only EXPOSE (no -p) will never have host port mappings.
+		if i == 0 && (inspect.HostConfig == nil || len(inspect.HostConfig.PortBindings) == 0) {
+			return nil, nil // no published ports, skip without error
+		}
+
 		ports := extractPorts(inspect.NetworkSettings)
 		if len(ports) > 0 {
 			return ports, nil

internal/watcher/watcher_integration_test.go

@@ -86,6 +86,11 @@ func (h *mockEventHandler) getCalls() []handlerCall {
 // inspectWithPorts returns an InspectResponse with the given port mapping.
 func inspectWithPorts(ports nat.PortMap) container.InspectResponse {
 	return container.InspectResponse{
+		ContainerJSONBase: &container.ContainerJSONBase{
+			HostConfig: &container.HostConfig{
+				PortBindings: ports,
+			},
+		},
 		NetworkSettings: &container.NetworkSettings{
 			NetworkSettingsBase: container.NetworkSettingsBase{
 				Ports: ports,