Raw ports vs HTTPS proxies
Proxies terminate TLS and route HTTP by domain — perfect for web apps and APIs. But a Postgres database, an SSH daemon, a game server, or any other protocol that isn’t HTTP needs a raw transport-layer port instead.expose opens a raw TCP or UDP port on the machine’s public proxy and forwards it straight to a port inside the VM. No TLS termination, no HTTP parsing — just packets.
name.boxd.sh, which resolves to the proxy IP) on that allocated port.
Expose a port
5432 inside the VM is now reachable at myapp.boxd.sh:48211. For example, a Postgres client:
Protocols
A forward is TCP by default. Use--udp for UDP, or pass both flags to serve TCP and UDP on the same allocated public port:
expose for a port you’ve already exposed keeps the same public port and just updates the protocol set.
List and remove
Limits
- Up to 3 forwarded ports per VM. Each allocated public port serves one inside-VM port (in one or both protocols). Remove one before exposing a fourth.
- Owner-only. Only the machine’s owner can expose, list, or remove its forwards.
- Forwards persist across reboots and are removed automatically when the VM is destroyed.
expose is for non-HTTP traffic. If you’re serving a website or HTTP API, use an HTTPS proxy instead — you get TLS and a clean https://name.boxd.sh URL for free.Surfaces
expose works the same from every surface: