I’ve got it running in an alpine VM. I’m going to try bind it to the local lan interface but it’s basically only to access the getting started portion, the rest will be bound to other docker containers as the network for those containers.

Thanks I’ll tinker around with this.

From what I’ve read on various Graphene posts, if the phone has just been rebooted and you haven’t unlocked it yet, it’s considered at an at rest state which means everything is fully encrypted until you unlock your phone. If you have the feature turned on where the phone auto restarts after a certain amount of time of idle use this would help somewhat mitigate the situation you’ve described.