Mix release supports the environment variable RELEASE_DISTRIBUTION=none so using that when generating the release should disable distribution features. I don’t know if it avoids starting epmd but at least you shouldn’t be able to connect to the release.

I’m not a 100 % sure on these details so test before going into prod. Hoping someone wiser can chime in too.

Source: https://hexdocs.pm/mix/Mix.Tasks.Release.html#module-environment-variables

First, you can have epmd and the node itself bind to 127.0.0.1 so it is inaccessible outside of the host.

Next, there is https://github.com/tsloughter/epmdless which can be used to simplify running a node that you can get a remote connection to still locally but does not have epmd running.

Finally, OTP 23.1 will make this even simpler, removing the need for epmdless entirely in the case that you are fine with a static port being used for the Erlang node.

https://www.erlang-solutions.com/blog/erlang-and-elixir-distribution-without-epmd.html

The article is a bit old but perhaps still valid?

Look into blocking the EPMD port at the interface (with iptables or equivalent new hotness); that way you can still SSH into the box and attach an IEx session like usual.

This looks great. Thanks for sharing!

And also thanks to all the others for chiming in. I’m planning on trying all solutions suggested here and to report back when that happened. Thanks for all the contributions!