docs: add documentation for wrangler login in containers

src/content/docs/workers/wrangler/commands.mdx

@@ -498,7 +498,7 @@
 ✓ Select an account: › My account
 | Name                        | ID                                  | StoreID                             | Comment | Scopes  | Status  | Created                | Modified               |
 |-----------------------------|-------------------------------------|-------------------------------------|---------|---------|---------|------------------------|------------------------|
 | ServiceA_key-1          | 13bc7498c6374a4e9d13be091c3c65f1    | 8f7a1cdced6342c18d223ece462fd88d    |         | workers | active  | 4/9/2025, 10:06:01 PM  | 4/15/2025, 09:13:05 AM |
 ```
 
 <WranglerCommand command="secrets-store secret delete" headingLevel={3} />
@@ -552,7 +552,7 @@
 ┌─────────┬──────────────────────────────────┬──────────────────────────────────┬──────────────────────┬──────────────────────┐
 │ Name    │ ID                               │ AccountID                        │ Created              │ Modified             │
 ├─────────┼──────────────────────────────────┼──────────────────────────────────┼──────────────────────┼──────────────────────┤
 │ default │ 8876bad33f164462bf0743fe8adf98f4 │ REDACTED │ 4/9/2025, 1:11:48 PM  │ 4/9/2025, 1:11:48 PM │
 └─────────┴──────────────────────────────────┴──────────────────────────────────┴──────────────────────┴──────────────────────┘
 ```
 
@@ -669,6 +669,36 @@
 curl <LOCALHOST_URL>
 ```
 
+### Use `wrangler login` in a container
+
+The Cloudflare OAuth provider will always redirect to a callback server at `localhost:8976`. If you are running Wrangler inside a container, this server might not be accessible from your host machine's browser - even after authorizing the connection, your login command will hang.
+
+You must configure your container to map port `8976` on your host machine to the Wrangler OAuth callback server's port (`8976` by default).
+
+For example, if you are running Wrangler in a Docker container:
+
+```sh
+docker run -p 8976:8976 <your-image>
+```
+
+And when you run `npx wrangler login` inside your container, set the callback host to listen on all network interfaces:
+
+```sh
+npx wrangler login --callback-host=0.0.0.0
+```
+
+Now when the browser redirects to `localhost:8976`, the request will be forwarded to Wrangler running inside the container on `0.0.0.0:8976`.
+
+If you need to use a different port inside the container, use `--callback-port` as well and adjust your port mapping accordingly, for example:
+
+```sh
+# When starting your container
+docker run -p 8976:9000 <your-image>
+
+# Inside the container
+npx wrangler login --callback-host=0.0.0.0 --callback-port=9000
+```
+
 ---
 
 ## `logout`
@@ -820,7 +850,7 @@
 Success! Uploaded mTLS Certificate my-origin-cert
 ID: 99f5fef1-6cc1-46b8-bd79-44a0d5082b8d
 Issuer: CN=my-secured-origin.com,OU=my-team,O=my-org,L=San Francisco,ST=California,C=US
 Expires: 1/01/2025
 ```
 
 You can then add this certificate as a [binding](/workers/runtime-apis/bindings/) in your [Wrangler configuration file](/workers/wrangler/configuration/):
@@ -849,13 +879,13 @@
 ID: 99f5fef1-6cc1-46b8-bd79-44a0d5082b8d
 Name: my-origin-cert
 Issuer: CN=my-secured-origin.com,OU=my-team,O=my-org,L=San Francisco,ST=California,C=US
 Created on: 1/01/2023
 Expires: 1/01/2025
 
 ID: c5d004d1-8312-402c-b8ed-6194328d5cbe
 Issuer: CN=another-origin.com,OU=my-team,O=my-org,L=San Francisco,ST=California,C=US
 Created on: 1/01/2023
 Expires: 1/01/2025
 ```
 
 <WranglerCommand command="mtls-certificate delete" headingLevel={3} />
@@ -894,7 +924,7 @@
 Success! Uploaded mTLS Certificate my-origin-cert
 ID: 99f5fef1-6cc1-46b8-bd79-44a0d5082b8d
 Issuer: CN=my-secured-origin.com,OU=my-team,O=my-org,L=San Francisco,ST=California,C=US
 Expires: 1/01/2025
 ```
 
 Note that the certificate and private keys must be in separate (typically `.pem`) files when uploading.