Reach a port in a sandbox
This guide forwards a TCP port in a running sandbox to a port on your
workstation. The tunnel goes through the Cloud API with your own credential,
so the sandbox's network can stay closed. You need tritonctl signed in to
your cloud and a running sandbox, here named dev.
Step 1: Start the service in the guest
The service can listen on the guest's loopback address. Keep the exec running in the background:
tritonctl sandbox exec dev -- python3 -m http.server 8000 --bind 127.0.0.1 &
Step 2: Open the tunnel
tritonctl sandbox port-forward dev 8000
The command listens on local port 8000 and stays in the foreground until you
press Ctrl-C. To listen on another local port, add --local:
tritonctl sandbox port-forward dev 8000 --local 18000
Step 3: Connect
In another terminal:
curl http://127.0.0.1:8000/
Any TCP client works through the tunnel: a database client, a debugger, or a browser.
Use the tunnel as an SSH proxy
--stdio connects the tunnel to standard input and output instead of a local
port. SSH uses this as its ProxyCommand. You do not need to write that
entry yourself: tritonctl sandbox ssh-config does it. See
Work on a GitHub repository in a sandbox.
If the tunnel fails
| Symptom | Cause | Fix |
|---|---|---|
curl connects, then the connection closes | Nothing listens on that port in the guest. | Check the service from inside the guest with tritonctl sandbox exec dev -- curl http://127.0.0.1:8000/. The base template has no ss. |
403 FeatureDisabled naming ports | An operator turned off port tunnels for your tenant. | Ask your operator. |
409 SandboxNotRunning | The sandbox is stopped or paused. | Start or resume it. |
Preview URLs
Browser preview URLs are not enabled on Triton Cloud yet. Use
port-forward to reach a port.
While previews are off, tritonctl sandbox url and
tritonctl sandbox ports open stop with this message:
previews are not enabled on this cloud; use port-forward (the `preview` sandbox feature is off)
For ports open, tritonctl adds this hint line:
`tritonctl sandbox port-forward <sandbox> <port>` reaches the port from this machine instead