https://github.com/bitcoin/bitcoin/blob/d72758c3f6c34cd835f5de3efc230964f3b1ea56/src/torcontrol.cpp#L539

If a user is running Tor proxy outside localhost (perhaps on other host inside LAN or in containerised environment) , the automatic creation of onion services ends up creating an onion service listening to hardcored 127.0.0.1 address on the Tor proxy's host instead of the private address of the bitcoind – effectively running an empty onion service listening the Tor proxy's localhost.
bool Command(const std::string &cmd, const ReplyHandlerCB& reply_handler);
    
    boost::signals2::signal<void(TorControlConnection &,const TorControlReply &)> async_handler;
private:
    
    std::function<void(TorControlConnection&)> connected;
    
    std::function<void(TorControlConnection&)> disconnected;
    
    struct event_base *base;
    
    struct bufferevent *b_conn;
    
    TorControlReply message;
    
    std::deque<ReplyHandlerCB> reply_handlers;
    
    static void readcb(struct bufferevent *bev, void *ctx);
    static void eventcb(struct bufferevent *bev, short what, void *ctx);
};
TorControlConnection::TorControlConnection(struct event_base *_base):
    base(_base), b_conn(nullptr)
{
}
TorControlConnection::~TorControlConnection()
{
    if (b_conn)
        bufferevent_free(b_conn);
}
void TorControlConnection::readcb(struct bufferevent *bev, void *ctx)