There probably isn't a viable MITM attack here. Assuming Ubuntu and Django, there are two big factors that conspire against an attacker:
Ubuntu's default hosts and dns configuration will resolve
localhost using a hardcoded setting. It won't even perform a DNS query. You can change this... But don't instead :)
Django binds to
127.0.0.1:8000 by default. To fully MitM you, the attacker would need to intercept the traffic being served by Django but they don't have access.
That said, web security is complicated. There might be things you're doing that an attacker could exploit to have some sort of an effect on you.
External resources have to be secure
Many of us embed third-party, CDN-hosted files. Jquery, Bootstrap, etc. If these are
// (remember the dev server doesn't use TLS), that could give an attacker an opportunity to MITM those files and inject live script into your pages.
For the sake of local development away from an internet connection, it may be best on all counts to just host all the stuff yourself.
Click-jacking and iframe techniques
Just because they can't access your local-running server, doesn't mean they couldn't tell your browser to access it. Cross origin security will (probably) stop them doing things with it directly but they could stick it in an iframe. This is sort of a reverse-clickjack.
To the user this would just look like your website. They could even capture all URLs at their end and feed them through to the frame. If it were a public website they could also work out what you were clicking.
But of course you're already using
django-secure, aren't you? I'd recommend it. One setting and you'll start sending out
X-Frame-Options: DENY headers with every Django request. Alternatively there is a Django-builtin option that does the same. I recommend
django-secure because it does a lot more.
Your security on a hostile network is more than a web server
You probably have other daemons running, well beside things like PostgreSQL that you're using for development. You might be running SSH servers, filesharing servers, etc and if you're used to a home environment, you may have
skipped leg day gone with weaker security for convenience.
The easiest single thing to do is block all incoming traffic. Assuming you have no existing UFW configuration, that's as simple as:
sudo ufw enable
sudo ufw default deny incoming
sudo ufw default allow outgoing
That will persist reboots. If you get home and want to access something, you can either turn it off with
sudo ufw disable or change the default and open certain ports explicitly.
If you are going to leave a SSH port exposed, I have written an article on hardening SSH configurations. Unless you're in the NSA canteen, that should keep most people out of your system.