From 8b35d531f7b4ba08ed438d71c7fcaed655762aed Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:06:09 +0530
Subject: [PATCH 01/14] PCSM-345 Make HTTP server bind host configurable

---
 docs/install/parameters.md |  1 -
 docs/install/start-pcsm.md | 29 +++++++++++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletion(-)

diff --git a/docs/install/parameters.md b/docs/install/parameters.md
index af35f678..e1012c76 100644
--- a/docs/install/parameters.md
+++ b/docs/install/parameters.md
@@ -15,7 +15,6 @@ When [starting the `pcsm` process](start-pcsm.md), you can use the following opt
 - `--clone-segment-size`: Segment size for clone operations. Accepts plain bytes or a unit suffix (e.g. `500MB`, `1GiB`). When omitted, the tool automatically calculates segment size based on collection size and available read workers.
 - `--use-collection-bulk-write`: Forces collection-level bulk write instead of the newer client-level bulk write (MongoDB 8.0+).
 
-
 ??? example "Examples"
 
     ```{.bash data-prompt="$"}
diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index 99f6460f..9c2eb139 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -36,6 +36,35 @@ Start {{pcsm.full_name}}.
 
 See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for all available options.
 
+## Configure the HTTP listen address
+
+By default, the PCSM HTTP server listens on localhost. The `--port option `controls the HTTP port.
+
+This default keeps the PCSM control API and profiling endpoints accessible only from the local host.
+
+In Kubernetes, HTTP liveness and readiness probes connect to the pod IP. To make the PCSM HTTP server reachable through the pod IP, set the listen host to `0.0.0.0:`
+
+```text
+$ PCSM_LISTEN_HOST=0.0.0.0 pcsm
+```
+
+Alternatively, use the `--listen-host` option:
+
+$ pcsm --listen-host 0.0.0.0
+
+The default value is localhost. You can also specify an IP address or DNS name. For example, to listen on the IPv6 loopback address:
+
+```text
+$ pcsm --listen-host ::1
+```
+
+Specify only the host with `--listen-host`. Do not include a port. `Use --port` to configure the HTTP port.
+
+!!! warning
+
+    Setting `--listen-host` to `0.0.0.0` makes the PCSM control API and profiling endpoints reachable through the network interfaces of the host or pod. These endpoints don't require authentication.
+
+    In Kubernetes, use a `NetworkPolicy` or other network controls to restrict access. If you don't need to expose the HTTP endpoint on the pod network, you can use an exec-based health probe against `localhost` instead.
 
 ## How to see {{pcsm.full_name}} logs
 

From fd44005534eb42cfd73a455cb50af8b1873152f3 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:16:10 +0530
Subject: [PATCH 02/14] Update start-pcsm.md

---
 docs/install/start-pcsm.md | 39 +++++++++++++++++++++++++++++---------
 1 file changed, 30 insertions(+), 9 deletions(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index 9c2eb139..dac2e70b 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -38,33 +38,54 @@ See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for a
 
 ## Configure the HTTP listen address
 
-By default, the PCSM HTTP server listens on localhost. The `--port option `controls the HTTP port.
+By default, the PCSM HTTP server listens on `localhost`, which keeps the control API and the profiling endpoints reachable only from the local host. Most deployments don't need to change this.
 
-This default keeps the PCSM control API and profiling endpoints accessible only from the local host.
+Kubernetes is the exception. The kubelet runs liveness and readiness probes against the pod IP rather than the container loopback address. A probe against a loopback-only listener is refused, and the pod restarts.
 
-In Kubernetes, HTTP liveness and readiness probes connect to the pod IP. To make the PCSM HTTP server reachable through the pod IP, set the listen host to `0.0.0.0:`
+To make the server reachable through the pod IP, set the listen host to `0.0.0.0`:
 
-```text
+```{.bash data-prompt="$"}
 $ PCSM_LISTEN_HOST=0.0.0.0 pcsm
 ```
 
 Alternatively, use the `--listen-host` option:
 
+```{.bash data-prompt="$"}
 $ pcsm --listen-host 0.0.0.0
+```
 
-The default value is localhost. You can also specify an IP address or DNS name. For example, to listen on the IPv6 loopback address:
+You can also give an IP address or a DNS name. To listen on the IPv6 loopback address:
 
-```text
+```{.bash data-prompt="$"}
 $ pcsm --listen-host ::1
 ```
 
-Specify only the host with `--listen-host`. Do not include a port. `Use --port` to configure the HTTP port.
+PCSM adds the brackets itself, so this binds to `[::1]:2242`.
+
+### What to pass
+
+Give `--listen-host` a host and nothing else. The `--port` option sets the port, and defaults to `2242`.
+
+A value that already contains a port is rejected, so `localhost:2242`, `127.0.0.1:2242`, and `[::1]:2242` all fail at startup. A DNS name is accepted without being resolved first, which means a name that can't be resolved isn't caught by validation.
+
+Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status` always connect to `localhost`.
+
+### Check that it worked
+
+From inside the container, confirm the server answers on the pod IP rather than only on loopback:
+
+```{.bash data-prompt="$"}
+$ curl -s http://$(hostname -i):2242/status
+```
+
+A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.
 
 !!! warning
+    Binding to `0.0.0.0` exposes the control endpoints `/start`, `/pause`, `/resume`, and `/finalize`, along with the `pprof` profiling endpoints, on every network interface of the host or pod. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
 
-    Setting `--listen-host` to `0.0.0.0` makes the PCSM control API and profiling endpoints reachable through the network interfaces of the host or pod. These endpoints don't require authentication.
+    In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
 
-    In Kubernetes, use a `NetworkPolicy` or other network controls to restrict access. If you don't need to expose the HTTP endpoint on the pod network, you can use an exec-based health probe against `localhost` instead.
+See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for all available options, and [PCSM HTTP API](api.md) for the endpoints themselves.
 
 ## How to see {{pcsm.full_name}} logs
 

From 145c1e721b657ee2da389461b5fb137cbfacd6e3 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:25:03 +0530
Subject: [PATCH 03/14] Update parameters.md

---
 docs/install/parameters.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/docs/install/parameters.md b/docs/install/parameters.md
index e1012c76..9dc0aff0 100644
--- a/docs/install/parameters.md
+++ b/docs/install/parameters.md
@@ -14,6 +14,7 @@ When [starting the `pcsm` process](start-pcsm.md), you can use the following opt
 - `--clone-num-insert-workers`: Number of insert workers that write batches to the target. Shared for all collections.
 - `--clone-segment-size`: Segment size for clone operations. Accepts plain bytes or a unit suffix (e.g. `500MB`, `1GiB`). When omitted, the tool automatically calculates segment size based on collection size and available read workers.
 - `--use-collection-bulk-write`: Forces collection-level bulk write instead of the newer client-level bulk write (MongoDB 8.0+).
+- `--listen-host`: Host the HTTP server binds to. See [Configure the http listen address](../install/start-pcsm.md#configure-the-http-listen-address).
 
 ??? example "Examples"
 
@@ -45,4 +46,5 @@ Alternatively, you can define the following environment variables:
 | `PCSM_REPL_EVENT_QUEUE_SIZE` | Controls the size of the internal event queue used by the replication subsystem. | `5000` |
 | `PCSM_REPL_WORKER_QUEUE_SIZE` | Defines the maximum number of replication events that each replication worker thread can queue before processing. | `5000` |
 | `PCSM_REPL_BULK_OPS_SIZE` | Defines the maximum number of operations that can be grouped together into a single bulk apply batch during replication. | `5000` |
+| `PCSM_LISTEN_HOST` | Host the HTTP server binds to. See [Configure the http listen address](../install/start-pcsm.md#configure-the-http-listen-address) | Localhost |
 

From 5f75bb24d3a39dfb79869937ebfc6784436e45f2 Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:37:48 +0530
Subject: [PATCH 04/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 docs/install/start-pcsm.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index dac2e70b..770bce8e 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -40,7 +40,7 @@ See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for a
 
 By default, the PCSM HTTP server listens on `localhost`, which keeps the control API and the profiling endpoints reachable only from the local host. Most deployments don't need to change this.
 
-Kubernetes is the exception. The kubelet runs liveness and readiness probes against the pod IP rather than the container loopback address. A probe against a loopback-only listener is refused, and the pod restarts.
+Kubernetes is the exception. The kubelet runs HTTP liveness and readiness probes against the pod IP rather than the container loopback address. A loopback-only listener refuses these probes; failed readiness probes mark the pod unready, while repeated failed liveness probes can restart it.
 
 To make the server reachable through the pod IP, set the listen host to `0.0.0.0`:
 

From 5a22a28affa571929dc2e99b29c224441143416d Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:38:13 +0530
Subject: [PATCH 05/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 docs/install/start-pcsm.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index 770bce8e..fce19b7b 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -85,7 +85,7 @@ A response means the bind address took effect. Connection refused means the serv
 
     In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
 
-See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for all available options, and [PCSM HTTP API](api.md) for the endpoints themselves.
+See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for all available options, and [PCSM HTTP API](../api.md) for the endpoints themselves.
 
 ## How to see {{pcsm.full_name}} logs
 

From bb4ba6fd1d3e3eaae5eb41dc045c5528046727e8 Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Thu, 3 Sep 2026 15:38:39 +0530
Subject: [PATCH 06/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 docs/install/start-pcsm.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index fce19b7b..cd668310 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -75,7 +75,7 @@ Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status`
 From inside the container, confirm the server answers on the pod IP rather than only on loopback:
 
 ```{.bash data-prompt="$"}
-$ curl -s http://$(hostname -i):2242/status
+$ curl -s "http://$(hostname -i | awk '{print $1}'):2242/status"
 ```
 
 A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.

From 1117edf342885163f799d6ba1317c65fc5ca2115 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:18:07 +0000
Subject: [PATCH 07/14] Address Docker loopback listener guidance

Co-authored-by: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
---
 docs/install/docker.md     | 1 +
 docs/install/start-pcsm.md | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/install/docker.md b/docs/install/docker.md
index c0f202df..781af11c 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -165,6 +165,7 @@ Start the {{pcsm.short}} container. You can specify connection strings using env
     $ docker run --name pcsm1 --network mymongo -d \
         -e PCSM_SOURCE_URI="mongodb://source:password@psmdb-source:27017" \
         -e PCSM_TARGET_URI="mongodb://target:password@psmdb-target:27017" \
+        -e PCSM_LISTEN_HOST=0.0.0.0 \
         -p 2242:2242 \
         percona/percona-clustersync-mongodb:latest \
         --port 2242 \
diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index cd668310..a08d371b 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -40,7 +40,7 @@ See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for a
 
 By default, the PCSM HTTP server listens on `localhost`, which keeps the control API and the profiling endpoints reachable only from the local host. Most deployments don't need to change this.
 
-Kubernetes is the exception. The kubelet runs HTTP liveness and readiness probes against the pod IP rather than the container loopback address. A loopback-only listener refuses these probes; failed readiness probes mark the pod unready, while repeated failed liveness probes can restart it.
+Containerized deployments are the exception. Kubernetes runs HTTP liveness and readiness probes against the pod IP, and Docker forwards published ports to the container IP rather than the container loopback address. A loopback-only listener refuses these connections; failed readiness probes mark the pod unready, while repeated failed liveness probes can restart it.
 
 To make the server reachable through the pod IP, set the listen host to `0.0.0.0`:
 

From c61449436d83b921e44205b9274e5aaf4314f479 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Thu, 3 Sep 2026 10:18:10 +0000
Subject: [PATCH 08/14] Document IPv6 listen host guidance

Co-authored-by: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
---
 docs/install/start-pcsm.md | 26 ++++++++++++++++++++++----
 1 file changed, 22 insertions(+), 4 deletions(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index a08d371b..58183805 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -42,18 +42,30 @@ By default, the PCSM HTTP server listens on `localhost`, which keeps the control
 
 Containerized deployments are the exception. Kubernetes runs HTTP liveness and readiness probes against the pod IP, and Docker forwards published ports to the container IP rather than the container loopback address. A loopback-only listener refuses these connections; failed readiness probes mark the pod unready, while repeated failed liveness probes can restart it.
 
-To make the server reachable through the pod IP, set the listen host to `0.0.0.0`:
+To make the server reachable through the pod IP, set the listen host to `0.0.0.0` for an IPv4 pod or `::` for an IPv6 pod:
 
 ```{.bash data-prompt="$"}
 $ PCSM_LISTEN_HOST=0.0.0.0 pcsm
 ```
 
+For an IPv6 pod, use `::` instead:
+
+```{.bash data-prompt="$"}
+$ PCSM_LISTEN_HOST=:: pcsm
+```
+
 Alternatively, use the `--listen-host` option:
 
 ```{.bash data-prompt="$"}
 $ pcsm --listen-host 0.0.0.0
 ```
 
+For an IPv6 pod:
+
+```{.bash data-prompt="$"}
+$ pcsm --listen-host ::
+```
+
 You can also give an IP address or a DNS name. To listen on the IPv6 loopback address:
 
 ```{.bash data-prompt="$"}
@@ -72,16 +84,22 @@ Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status`
 
 ### Check that it worked
 
-From inside the container, confirm the server answers on the pod IP rather than only on loopback:
+From inside the container, confirm the server answers on the pod IP rather than only on loopback. For an IPv4 pod:
+
+```{.bash data-prompt="$"}
+$ curl -s "http://$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i !~ /:/) {print $i; exit}}'):2242/status"
+```
+
+For an IPv6 pod, enclose the address in brackets:
 
 ```{.bash data-prompt="$"}
-$ curl -s "http://$(hostname -i | awk '{print $1}'):2242/status"
+$ curl -g -s "http://[$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i ~ /:/) {print $i; exit}}')]:2242/status"
 ```
 
 A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.
 
 !!! warning
-    Binding to `0.0.0.0` exposes the control endpoints `/start`, `/pause`, `/resume`, and `/finalize`, along with the `pprof` profiling endpoints, on every network interface of the host or pod. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
+    Binding to `0.0.0.0` (IPv4) or `::` (IPv6) exposes the control endpoints `/start`, `/pause`, `/resume`, and `/finalize`, along with the `pprof` profiling endpoints, on every network interface of the host or pod. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
 
     In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
 

From 039827c7f80d4eadaa828162adc7600f57bf7e2c Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:55:31 +0530
Subject: [PATCH 09/14] Update docs/install/parameters.md

Co-authored-by: Adnan <chupe@chupe.ba>
---
 docs/install/parameters.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/parameters.md b/docs/install/parameters.md
index 9dc0aff0..af551c9b 100644
--- a/docs/install/parameters.md
+++ b/docs/install/parameters.md
@@ -46,5 +46,5 @@ Alternatively, you can define the following environment variables:
 | `PCSM_REPL_EVENT_QUEUE_SIZE` | Controls the size of the internal event queue used by the replication subsystem. | `5000` |
 | `PCSM_REPL_WORKER_QUEUE_SIZE` | Defines the maximum number of replication events that each replication worker thread can queue before processing. | `5000` |
 | `PCSM_REPL_BULK_OPS_SIZE` | Defines the maximum number of operations that can be grouped together into a single bulk apply batch during replication. | `5000` |
-| `PCSM_LISTEN_HOST` | Host the HTTP server binds to. See [Configure the http listen address](../install/start-pcsm.md#configure-the-http-listen-address) | Localhost |
+| `PCSM_LISTEN_HOST` | Host the HTTP server binds to. See [Configure the HTTP listen address](../install/start-pcsm.md#configure-the-http-listen-address) | `localhost` |
 

From c76db34a7749a24c42b462cbb80c99f902447898 Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 13:55:47 +0530
Subject: [PATCH 10/14] Update docs/install/parameters.md

Co-authored-by: Adnan <chupe@chupe.ba>
---
 docs/install/parameters.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/parameters.md b/docs/install/parameters.md
index af551c9b..185ba7f4 100644
--- a/docs/install/parameters.md
+++ b/docs/install/parameters.md
@@ -14,7 +14,7 @@ When [starting the `pcsm` process](start-pcsm.md), you can use the following opt
 - `--clone-num-insert-workers`: Number of insert workers that write batches to the target. Shared for all collections.
 - `--clone-segment-size`: Segment size for clone operations. Accepts plain bytes or a unit suffix (e.g. `500MB`, `1GiB`). When omitted, the tool automatically calculates segment size based on collection size and available read workers.
 - `--use-collection-bulk-write`: Forces collection-level bulk write instead of the newer client-level bulk write (MongoDB 8.0+).
-- `--listen-host`: Host the HTTP server binds to. See [Configure the http listen address](../install/start-pcsm.md#configure-the-http-listen-address).
+- `--listen-host`: Host the HTTP server binds to. See [Configure the HTTP listen address](../install/start-pcsm.md#configure-the-http-listen-address).
 
 ??? example "Examples"
 

From 2612d5e28b8a1f63f7f677a3a7def35f21056978 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:02:35 +0530
Subject: [PATCH 11/14] Update start-pcsm.md

---
 docs/install/start-pcsm.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index 58183805..e071cd23 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -87,13 +87,13 @@ Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status`
 From inside the container, confirm the server answers on the pod IP rather than only on loopback. For an IPv4 pod:
 
 ```{.bash data-prompt="$"}
-$ curl -s "http://$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i !~ /:/) {print $i; exit}}'):2242/status"
+$ curl -sS "http://$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i !~ /:/) {print $i; exit}}'):2242/status"
 ```
 
 For an IPv6 pod, enclose the address in brackets:
 
 ```{.bash data-prompt="$"}
-$ curl -g -s "http://[$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i ~ /:/) {print $i; exit}}')]:2242/status"
+$ curl -g -sS "http://[$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i ~ /:/) {print $i; exit}}')]:2242/status"
 ```
 
 A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.

From 87e197560c0d1dc6576c8b94ad2d147e25022a33 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 14:16:03 +0530
Subject: [PATCH 12/14] Update start-pcsm.md

---
 docs/install/start-pcsm.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index e071cd23..43c7cbf8 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -99,7 +99,7 @@ $ curl -g -sS "http://[$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i ~ /:/) {
 A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.
 
 !!! warning
-    Binding to `0.0.0.0` (IPv4) or `::` (IPv6) exposes the control endpoints `/start`, `/pause`, `/resume`, and `/finalize`, along with the `pprof` profiling endpoints, on every network interface of the host or pod. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
+    Binding to `0.0.0.0` (IPv4) or :: (IPv6) exposes all PCSM HTTP endpoints on every network interface of the host or pod. This includes `/start`, `/pause`, `/resume`, `/finalize`, `/status`, `/metrics`, and the `pprof` profiling endpoints. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
 
     In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
 

From 778e55b4767459e56d867da3bc9c1139e9373a6a Mon Sep 17 00:00:00 2001
From: Rasika Chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:07:30 +0530
Subject: [PATCH 13/14] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 docs/install/docker.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/install/docker.md b/docs/install/docker.md
index 781af11c..1a792eb2 100644
--- a/docs/install/docker.md
+++ b/docs/install/docker.md
@@ -166,7 +166,7 @@ Start the {{pcsm.short}} container. You can specify connection strings using env
         -e PCSM_SOURCE_URI="mongodb://source:password@psmdb-source:27017" \
         -e PCSM_TARGET_URI="mongodb://target:password@psmdb-target:27017" \
         -e PCSM_LISTEN_HOST=0.0.0.0 \
-        -p 2242:2242 \
+        -p 127.0.0.1:2242:2242 \
         percona/percona-clustersync-mongodb:latest \
         --port 2242 \
         --log-level debug

From 758cb0cb25a211883cc412a6b4d748fdd74f7765 Mon Sep 17 00:00:00 2001
From: rasika-chivate <95711051+rasika-chivate@users.noreply.github.com>
Date: Mon, 7 Sep 2026 17:08:50 +0530
Subject: [PATCH 14/14] Update start-pcsm.md

---
 docs/install/start-pcsm.md | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/docs/install/start-pcsm.md b/docs/install/start-pcsm.md
index 43c7cbf8..723c16e4 100644
--- a/docs/install/start-pcsm.md
+++ b/docs/install/start-pcsm.md
@@ -42,6 +42,8 @@ By default, the PCSM HTTP server listens on `localhost`, which keeps the control
 
 Containerized deployments are the exception. Kubernetes runs HTTP liveness and readiness probes against the pod IP, and Docker forwards published ports to the container IP rather than the container loopback address. A loopback-only listener refuses these connections; failed readiness probes mark the pod unready, while repeated failed liveness probes can restart it.
 
+## Set the bind host
+
 To make the server reachable through the pod IP, set the listen host to `0.0.0.0` for an IPv4 pod or `::` for an IPv6 pod:
 
 ```{.bash data-prompt="$"}
@@ -72,7 +74,24 @@ You can also give an IP address or a DNS name. To listen on the IPv6 loopback ad
 $ pcsm --listen-host ::1
 ```
 
-PCSM adds the brackets itself, so this binds to `[::1]:2242`.
+!!! warning
+    Binding to `0.0.0.0` (IPv4) or :: (IPv6) exposes all PCSM HTTP endpoints on every network interface of the host or pod. This includes `/start`, `/pause`, `/resume`, `/finalize`, `/status`, `/metrics`, and the `pprof` profiling endpoints. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
+
+    In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
+
+### Accepted values
+
+| **Value** | **Binds to** | **Use it for** |
+| --- | --- | --- |
+| `localhost` | `localhost:2242` | The default. Local host only. |
+| `0.0.0.0` | `0.0.0.0:2242` | All IPv4 interfaces, including an IPv4 pod IP. |
+| `::` | `[::]:2242` | All IPv6 interfaces, including an IPv6 pod IP. |
+| An IP literal, such as `10.0.2.15` | `10.0.2.15:2242` | A single interface. |
+| `::1` | `[::1]:2242` | The IPv6 loopback address. {{pcsm.short}} adds the brackets automatically. |
+| A DNS name | Resolved when the server binds | A named interface. The name is accepted without being resolved first, so validation doesn't catch an unresolvable name. |
+| Anything containing a port | Rejected at startup | Not supported. Values such as `localhost:2242`, `127.0.0.1:2242`, and `[::1]:2242` fail. Use `--port` to set the port. |
+
+Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status` always connect to `localhost`.
 
 ### What to pass
 
@@ -84,25 +103,14 @@ Changing the bind host doesn't affect the CLI. Subcommands such as `pcsm status`
 
 ### Check that it worked
 
-From inside the container, confirm the server answers on the pod IP rather than only on loopback. For an IPv4 pod:
+PCSM reports its bind address when the HTTP server starts. Read the startup log and confirm the address matches what you set:
 
-```{.bash data-prompt="$"}
-$ curl -sS "http://$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i !~ /:/) {print $i; exit}}'):2242/status"
-```
-
-For an IPv6 pod, enclose the address in brackets:
-
-```{.bash data-prompt="$"}
-$ curl -g -sS "http://[$(hostname -i | awk '{for (i=1;i<=NF;i++) if ($i ~ /:/) {print $i; exit}}')]:2242/status"
+```sh
+INF s=http Starting HTTP server at http://0.0.0.0:2242
 ```
 
 A response means the bind address took effect. Connection refused means the server is still on loopback, so check that the environment variable or option reached the process.
 
-!!! warning
-    Binding to `0.0.0.0` (IPv4) or :: (IPv6) exposes all PCSM HTTP endpoints on every network interface of the host or pod. This includes `/start`, `/pause`, `/resume`, `/finalize`, `/status`, `/metrics`, and the `pprof` profiling endpoints. None of them require authentication, so anything that can route to the pod can start, pause, or finalize replication.
-
-    In Kubernetes, restrict access with a `NetworkPolicy` or an equivalent network control. If all you need is a health check, an exec probe against `localhost` gives you the same result with no network exposure.
-
 See [Percona ClusterSync for MongoDB startup configuration](parameters.md) for all available options, and [PCSM HTTP API](../api.md) for the endpoints themselves.
 
 ## How to see {{pcsm.full_name}} logs