@@ -1,12 +1,5 @@
 import { spawnSync } from 'node:child_process'
-import {
-  DB_CONTAINER,
-  type Detection,
-  LOOPBACK_HOST,
-  type PortBinding,
-  publishedBinding,
-  targetsLocalPort,
-} from './detect'
+import { DB_CONTAINER, type Detection, LOOPBACK_HOST } from './detect'
 import { ensureDocker } from './docker'
 import { generateSecret } from './env-files'
 import { SetupError } from './errors'
@@ -43,8 +36,6 @@ function dockerOutput(args: string[]): string | null {
 interface ManagedContainer {
   running: boolean
   dsn: string
-  password: string
-  binding: PortBinding
 }
 
 /**
@@ -72,16 +63,21 @@ function inspectManagedContainer(): ManagedContainer | null {
     ?.slice('POSTGRES_PASSWORD='.length)
   if (!password) return null
 
-  const binding = publishedBinding(DB_CONTAINER, '5432/tcp')
-  if (!binding) return null
+  // `docker port` only reports a published port while the container runs; the
+  // static config carries it either way.
+  const hostPort = dockerOutput([
+    'inspect',
+    DB_CONTAINER,
+    '--format',
+    '{{(index .HostConfig.PortBindings "5432/tcp" 0).HostPort}}',
+  ])
+  if (!hostPort) return null
 
   return {
     running: running === 'true',
     // Read back from the container env verbatim, so it may be a password the
     // user supplied for an existing volume — encode it like any other.
-    dsn: buildDsn(password, binding.hostPort),
-    password,
-    binding,
+    dsn: buildDsn(password, hostPort),
   }
 }
 
@@ -253,14 +249,6 @@ async function startManagedContainer(detection: Detection): Promise<string> {
   const password = volumeInitialized()
     ? await resolveExistingVolume()
     : generateSecret().slice(0, 24)
-  return launchManagedContainer(password, hostPort)
-}
-
-/** Runs the managed container on `LOOPBACK_HOST` and waits until it accepts the password. */
-async function launchManagedContainer(
-  password: string,
-  hostPort: string | number
-): Promise<string> {
   // A user-supplied password can contain @ : / # — raw interpolation would
   // re-parse the DSN into a different host and fail a password that is correct.
   const dsn = buildDsn(password, hostPort)
@@ -321,41 +309,13 @@ async function launchManagedContainer(
   return dsn
 }
 
-/**
- * Offers to re-publish a managed container that an earlier release bound to
- * every interface, keeping its password, port, and data volume. Returns the new
- * DSN when `existingDsn` pointed at that container (or nothing was configured),
- * so the env files move to the loopback address with it.
- */
-async function rebindExposedContainer(existingDsn?: string): Promise<string | null> {
-  const container = inspectManagedContainer()
-  if (!container || container.binding.hostIp === LOOPBACK_HOST) return null
-  const { hostPort } = container.binding
-  const rebind = await p.confirm({
-    message: `${DB_CONTAINER} publishes Postgres on every network interface (set up by an earlier sim-setup). Recreate it on ${LOOPBACK_HOST} only? Its data and password are kept.`,
-    initialValue: true,
-  })
-  if (!rebind) {
-    p.log.warn(`${DB_CONTAINER} stays reachable from your network on :${hostPort}.`)
-    return null
-  }
-  docker(['rm', '-f', DB_CONTAINER])
-  const dsn = await launchManagedContainer(container.password, hostPort)
-  return !existingDsn || targetsLocalPort(existingDsn, hostPort) ? dsn : null
-}
-
 /**
  * The mode-B database ladder: reuse a working DSN, offer (never silently adopt)
  * a Postgres already on 5432, start/reuse the wizard-managed pgvector
  * container, or take an external DSN. Adopting an existing database is always
  * an explicit choice — migrations run against whatever is chosen here.
  */
 export async function resolveDatabase(detection: Detection, existingDsn?: string): Promise<string> {
-  if (detection.dbContainer?.managed) {
-    const rebound = await rebindExposedContainer(existingDsn)
-    if (rebound) return rebound
-  }
-
   if (existingDsn && (await probeWithSpinner(existingDsn, 'Testing existing DATABASE_URL…'))) {
     return existingDsn
   }
 
@@ -16,41 +16,41 @@ export const REDIS_CONTAINER = 'sim-redis'
  */
 export const LOOPBACK_HOST = '127.0.0.1'
 
-export interface PortBinding {
-  /** Empty when Docker publishes on every interface. */
-  hostIp: string
-  hostPort: string
-}
-
 /**
- * The host side of a container's published port, read from its static config so
- * a stopped container answers too. Containers from releases before
- * `LOOPBACK_HOST` was enforced report an empty or wildcard `hostIp`.
+ * Whether a container publishes `containerPort` beyond `LOOPBACK_HOST`, read from
+ * its static config so a stopped container answers too. Containers created
+ * before managed ports were bound to loopback report an empty `HostIp`.
  */
-export function publishedBinding(container: string, containerPort: string): PortBinding | null {
+function publishedBeyondLoopback(container: string, containerPort: string): boolean {
   const out = commandOutput('docker', [
     'inspect',
     container,
     '--format',
     `{{json (index .HostConfig.PortBindings "${containerPort}")}}`,
   ])
-  if (!out) return null
+  if (!out) return false
   try {
-    const [first] = JSON.parse(out) as { HostIp?: string; HostPort?: string }[]
-    return first?.HostPort ? { hostIp: first.HostIp ?? '', hostPort: first.HostPort } : null
+    const bindings = JSON.parse(out) as { HostIp?: string }[] | null
+    return (bindings ?? []).some((binding) => binding.HostIp !== LOOPBACK_HOST)
   } catch {
-    return null
+    return false
   }
 }
 
-/** Whether `url` addresses this machine on `port`, so it reaches a container published there. */
-export function targetsLocalPort(url: string, port: string): boolean {
-  try {
-    const { hostname, port: urlPort } = new URL(url)
-    return ['localhost', LOOPBACK_HOST, '[::1]'].includes(hostname) && urlPort === port
-  } catch {
-    return false
+/**
+ * Managed containers that an earlier sim-setup published on every interface.
+ * They are reported, not recreated: Redis holds live realtime sessions and the
+ * Postgres URL may name its own database, so replacing either is the user's call.
+ */
+export function exposedManagedContainers(detection: Detection): string[] {
+  const exposed: string[] = []
+  if (detection.dbContainer?.managed && publishedBeyondLoopback(DB_CONTAINER, '5432/tcp')) {
+    exposed.push(DB_CONTAINER)
+  }
+  if (detection.redisContainer?.managed && publishedBeyondLoopback(REDIS_CONTAINER, '6379/tcp')) {
+    exposed.push(REDIS_CONTAINER)
   }
+  return exposed
 }
 
 const SHELL_LLM_KEYS = [
 
@@ -4,7 +4,7 @@ import { truncate } from '@sim/utils/string'
 import { EMAIL_SETUP, JOBS_SETUP, STORAGE_SETUP } from '../capability-config'
 import { promptCapabilitySetup, stageCapabilitySetupTransition } from '../capability-setup'
 import { resolveDatabase } from '../db'
-import type { Detection } from '../detect'
+import { type Detection, exposedManagedContainers, LOOPBACK_HOST } from '../detect'
 import { ROOT, readEnvFile, reconcileEnvValues, writeEnvValues } from '../env-files'
 import { SetupError } from '../errors'
 import { pgProbe } from '../probes'
@@ -75,6 +75,12 @@ export async function runDevMode(
   detection: Detection,
   quick: boolean
 ): Promise<{ startNow: boolean; script: string }> {
+  const exposed = exposedManagedContainers(detection)
+  if (exposed.length > 0) {
+    p.log.warn(
+      `${exposed.join(' and ')} ${exposed.length > 1 ? 'publish their ports' : 'publishes its port'} on every network interface (created by an earlier sim-setup). To keep ${exposed.length > 1 ? 'them' : 'it'} on ${LOOPBACK_HOST}, stop the app, run ${theme.command('npx sim-setup down')} (data is kept), then re-run ${theme.command('npx sim-setup')}.`
+    )
+  }
   const sim = readEnvFile('sim')
   const dsn = await resolveDatabase(detection, sim.vars.get('DATABASE_URL'))
   const secrets = collectSecrets(sim)
 
@@ -1,12 +1,6 @@
 import { spawnSync } from 'node:child_process'
 import { docker } from './db'
-import {
-  type Detection,
-  LOOPBACK_HOST,
-  publishedBinding,
-  REDIS_CONTAINER,
-  targetsLocalPort,
-} from './detect'
+import { type Detection, LOOPBACK_HOST, REDIS_CONTAINER } from './detect'
 import { ensureDocker } from './docker'
 import { SetupError } from './errors'
 import { redisPing, waitFor } from './probes'
@@ -35,27 +29,8 @@ async function pingWithSpinner(url: string, label: string): Promise<boolean> {
   return ping.ok
 }
 
-function defaultRedisPort(detection: Detection): number {
-  return detection.redisPortOpen ? 6380 : 6379
-}
-
-/**
- * Recreates a managed container that an earlier release published on every
- * interface, on the same port. It holds no data, so this needs no prompt.
- * Returns the new URL when `existing` pointed at it (or nothing was configured).
- */
-async function rebindExposedRedis(detection: Detection, existing?: string): Promise<string | null> {
-  if (!detection.redisContainer?.managed) return null
-  const binding = publishedBinding(REDIS_CONTAINER, '6379/tcp')
-  if (!binding || binding.hostIp === LOOPBACK_HOST) return null
-  p.log.step(
-    `Recreating ${REDIS_CONTAINER} on ${LOOPBACK_HOST}: an earlier sim-setup published it on every network interface`
-  )
-  const url = await startManagedRedis(binding.hostPort)
-  return !existing || targetsLocalPort(existing, binding.hostPort) ? url : null
-}
-
-async function startManagedRedis(hostPort: number | string): Promise<string> {
+async function startManagedRedis(detection: Detection): Promise<string> {
+  const hostPort = detection.redisPortOpen ? 6380 : 6379
   const url = `redis://${LOOPBACK_HOST}:${hostPort}`
   // A prior sim-redis (unhealthy, or bound to a stale port) would collide on the
   // name. Unlike Postgres this container has no data volume, so removing it
@@ -113,8 +88,6 @@ async function promptRedisUrl(existing?: string): Promise<string> {
  * failing the whole setup.
  */
 export async function ensureRedis(detection: Detection, existing?: string): Promise<string | null> {
-  const rebound = await rebindExposedRedis(detection, existing)
-  if (rebound) return rebound
   if (existing && (await redisPing(existing)).ok) return existing
   if (detection.redisPortOpen && (await redisPing(LOCAL_URL)).ok) {
     p.log.step(`Using the Redis already on :6379`)
@@ -134,17 +107,14 @@ export async function ensureRedis(detection: Detection, existing?: string): Prom
     )
     return null
   }
-  return startManagedRedis(defaultRedisPort(detection))
+  return startManagedRedis(detection)
 }
 
 /**
  * Redis ladder, mirroring the Postgres one: reuse what's running (with
  * consent), restart/start a wizard-managed container, or take a URL.
  */
 export async function resolveRedis(detection: Detection, existing?: string): Promise<string> {
-  const rebound = await rebindExposedRedis(detection, existing)
-  if (rebound) return rebound
-
   // A configured REDIS_URL wins over the port scan: it may point at a non-default
   // port, or at a host that isn't this machine at all.
   if (
@@ -196,7 +166,5 @@ export async function resolveRedis(detection: Detection, existing?: string): Pro
     p.log.warn('Docker is not available, so the wizard cannot manage a Redis container for you.')
   }
   const choice = await p.select({ message: 'Where should Redis live?', options })
-  return choice === 'container'
-    ? startManagedRedis(defaultRedisPort(detection))
-    : promptRedisUrl(existing)
+  return choice === 'container' ? startManagedRedis(detection) : promptRedisUrl(existing)
 }