From e1dd727521c10848ad61cd060d7e8a51dda8fb53 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Wed, 25 Feb 2026 14:04:02 +0000
Subject: [PATCH] Fix coturn "Unknown argument:" error and noisy interface
 binding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the coturn image's fragile eval-based entrypoint with a robust
wrapper that handles external IP detection without word-splitting issues.
The image's `exec $(eval "echo $@")` produces empty tokens when
DETECT_EXTERNAL_IP's DNS lookup fails → "ERROR: CONFIG: Unknown argument:"

Also add --listening-ip=0.0.0.0 so coturn binds a single wildcard address
instead of enumerating every host interface (reduces log noise).

https://claude.ai/code/session_01KWVtEt9MmZdywcu7WmgchX
---
 docker-compose.yml          | 11 +++++++++--
 docker/coturn-entrypoint.sh | 26 ++++++++++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)
 create mode 100755 docker/coturn-entrypoint.sh

diff --git a/docker-compose.yml b/docker-compose.yml
index f09a53c..39f0ce3 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -85,12 +85,19 @@ services:
     # The coturn image runs as nobody:nogroup by default, which cannot
     # create /var/run/turnserver.pid. Run as root to avoid this.
     user: root
+    # Custom entrypoint bypasses the coturn image's fragile eval-based
+    # entrypoint which causes "Unknown argument:" errors when IP detection
+    # returns empty. Our wrapper handles detection robustly.
+    entrypoint: ["/coturn-entrypoint.sh"]
+    volumes:
+      - ./docker/coturn-entrypoint.sh:/coturn-entrypoint.sh:ro
     environment:
-      # Image-native external IP detection (adds --external-ip automatically)
-      - DETECT_EXTERNAL_IP=${DETECT_EXTERNAL_IP:-yes}
+      # Passed to our entrypoint for --external-ip. Auto-detected if empty.
+      - PUBLIC_IP=${PUBLIC_IP:-}
     command:
       - -n
       - --listening-port=${TURN_PORT:-3478}
+      - --listening-ip=0.0.0.0
       - --fingerprint
       - --lt-cred-mech
       - --user=${TURN_USERNAME:-easyasterisk}:${TURN_PASSWORD:-changeme}
diff --git a/docker/coturn-entrypoint.sh b/docker/coturn-entrypoint.sh
new file mode 100755
index 0000000..e9aee8e
--- /dev/null
+++ b/docker/coturn-entrypoint.sh
@@ -0,0 +1,26 @@
+#!/bin/sh
+# ================================================================
+# Robust coturn entrypoint
+#
+# The coturn/coturn Docker image's native entrypoint uses:
+#   exec $(eval "echo $@")
+# which is fragile — if DETECT_EXTERNAL_IP's DNS lookup returns empty,
+# the eval produces an empty token → "ERROR: CONFIG: Unknown argument:"
+#
+# This wrapper reuses the image's detect-external-ip script but avoids
+# the eval word-splitting issue. If detection fails, we simply omit
+# --external-ip rather than passing a blank argument.
+# ================================================================
+
+# Use explicit PUBLIC_IP if provided, otherwise auto-detect
+if [ -z "$PUBLIC_IP" ]; then
+    PUBLIC_IP=$(detect-external-ip 2>/dev/null || true)
+fi
+
+# Only add --external-ip if we actually have an IP
+EXTERNAL_IP_ARG=""
+if [ -n "$PUBLIC_IP" ]; then
+    EXTERNAL_IP_ARG="--external-ip=$PUBLIC_IP"
+fi
+
+exec turnserver "$@" $EXTERNAL_IP_ARG