diff --git a/CHANGELOG_PENDING.md b/CHANGELOG_PENDING.md
index 5e9a222d1..26fb14d1f 100644
--- a/CHANGELOG_PENDING.md
+++ b/CHANGELOG_PENDING.md
@@ -36,6 +36,7 @@
 - [p2p] \#3666 Add per channel telemetry to improve reactor observability
 - [rpc] [\#3686](https://github.com/tendermint/tendermint/pull/3686) `HTTPClient#Call` returns wrapped errors, so a caller could use `errors.Cause` to retrieve an error code. (@wooparadog)
 - [abci/examples] \#3659 Change validator update tx format (incl. expected pubkey format, which is base64 now) (@needkane)
+- [rpc] \#3724 RPC now binds to `127.0.0.1` by default instead of `0.0.0.0`
 
 ### BUG FIXES:
 - [libs/db] \#3717 Fixed the BoltDB backend's Batch.Delete implementation (@Yawning)
diff --git a/Makefile b/Makefile
index 3dff35b9c..35baf7d3a 100644
--- a/Makefile
+++ b/Makefile
@@ -275,8 +275,8 @@ build-docker-localnode:
 	@cd networks/local && make
 
 # Run a 4-node testnet locally
-localnet-start: localnet-stop
-	@if ! [ -f build/node0/config/genesis.json ]; then docker run --rm -v $(CURDIR)/build:/tendermint:Z tendermint/localnode testnet --v 4 --o . --populate-persistent-peers --starting-ip-address 192.167.10.2 ; fi
+localnet-start: localnet-stop build-docker-localnode
+	@if ! [ -f build/node0/config/genesis.json ]; then docker run --rm -v $(CURDIR)/build:/tendermint:Z tendermint/localnode testnet --config /etc/tendermint/config-template.toml --v 4 --o . --populate-persistent-peers --starting-ip-address 192.167.10.2; fi
 	docker-compose up
 
 # Stop testnet
diff --git a/config/config.go b/config/config.go
index 6c4654fed..aa25cff6b 100644
--- a/config/config.go
+++ b/config/config.go
@@ -369,7 +369,7 @@ type RPCConfig struct {
 // DefaultRPCConfig returns a default configuration for the RPC server
 func DefaultRPCConfig() *RPCConfig {
 	return &RPCConfig{
-		ListenAddress:          "tcp://0.0.0.0:26657",
+		ListenAddress:          "tcp://127.0.0.1:26657",
 		CORSAllowedOrigins:     []string{},
 		CORSAllowedMethods:     []string{"HEAD", "GET", "POST"},
 		CORSAllowedHeaders:     []string{"Origin", "Accept", "Content-Type", "X-Requested-With", "X-Server-Time"},
diff --git a/networks/local/localnode/Dockerfile b/networks/local/localnode/Dockerfile
index 3942cecd6..03af5aa3c 100644
--- a/networks/local/localnode/Dockerfile
+++ b/networks/local/localnode/Dockerfile
@@ -13,4 +13,4 @@ CMD ["node", "--proxy_app", "kvstore"]
 STOPSIGNAL SIGTERM
 
 COPY wrapper.sh /usr/bin/wrapper.sh
-
+COPY config-template.toml /etc/tendermint/config-template.toml
diff --git a/networks/local/localnode/config-template.toml b/networks/local/localnode/config-template.toml
new file mode 100644
index 000000000..a90eb7bd5
--- /dev/null
+++ b/networks/local/localnode/config-template.toml
@@ -0,0 +1,2 @@
+[rpc]
+laddr = "tcp://0.0.0.0:26657"
diff --git a/test/docker/Dockerfile b/test/docker/Dockerfile
index 77cc515e5..b39277bd9 100644
--- a/test/docker/Dockerfile
+++ b/test/docker/Dockerfile
@@ -27,7 +27,12 @@ RUN make install_abci
 # install Tendermint
 RUN make install
 
-RUN tendermint testnet --node-dir-prefix="mach" --v=4 --populate-persistent-peers=false --o=$REPO/test/p2p/data
+RUN tendermint testnet \
+        --config $REPO/test/docker/config-template.toml \
+        --node-dir-prefix="mach" \
+        --v=4 \
+        --populate-persistent-peers=false \
+        --o=$REPO/test/p2p/data
 
 # Now copy in the code
 # NOTE: this will overwrite whatever is in vendor/
diff --git a/test/docker/config-template.toml b/test/docker/config-template.toml
new file mode 100644
index 000000000..a90eb7bd5
--- /dev/null
+++ b/test/docker/config-template.toml
@@ -0,0 +1,2 @@
+[rpc]
+laddr = "tcp://0.0.0.0:26657"