fix(deploy): 默认关闭沙箱公网访问

docker-compose.yml

@@ -55,7 +55,7 @@ services:
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     ports:
-      - "${SERVER_HTTP_PORT}:3001"    #http端口
+      - "${SERVER_HTTP_BIND_IP:-127.0.0.1}:${SERVER_HTTP_PORT}:3001"    # 域名/本机部署默认仅回环；IP/LAN 模式由启动脚本显式设为 0.0.0.0
 #    read_only: true
     networks:
       easyai:
@@ -341,10 +341,7 @@ services:
     container_name: sandbox
     networks:
       - easyai
-    #沙箱环境默认不对外暴露
-    ports:
-#      - "${SANDBOX_PORT}:8000"
-      - "${SANDBOX_JUPYTERLAB_PORT:-8888}:8888"
+    # 不映射宿主机端口，仅允许 Docker 内网中的 easyai-server 访问
     labels:
       - "com.centurylinklabs.watchtower.enable=true"
     volumes: