- BIND_ADDR (default 0.0.0.0) on every published port; 127.0.0.1 keeps the stack reachable from the host only (Docker bypasses ufw, so this is the actual control the kiosk addon's 'this kiosk only' choice uses) - Koha serves its web-installer page with HTTP 200 before the database exists, so 'port answers' was not 'ready': the entrypoint now writes /run/koha-ready, the healthcheck requires it, and install.sh waits for healthy + the quick-add health endpoint Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013wi3ZSot4XbUViwRFgLpRf