Putting one of your own services on the public internet, deliberately
Everything about this platform, including SSH access above, is built so that nothing reaches into your container unless you asked for it. There is one deliberate, opt-in exception: you can put a single port of your own choosing on the real public internet, over HTTPS, with a real certificate, without ever needing a published Docker port.
Start a server inside your workspace the normal way, a dev server, a notebook, a webhook receiver, anything listening on a real port, and the platform notices within a couple of seconds, reserves a real, certificate-ready hostname for it, and, by default, makes it public immediately: no extra step, no waiting. You'll get a toast notification in your browser tab telling you the hostname the moment it goes live, and again every time that port comes back after being quiet for a while (your dev server restarting, for instance), so you never have to remember an old toast to know a port is currently live.
dpe-expose still exists, and you will still reach for
it often, because "public, no auth" is not always what you want:
dpe-expose 8080 --auth basic --user me --pass secretruns against a port that is already live, the same way it always
has, and changes only who can reach it. dpe-expose also
prints the real hostname directly in your terminal, so you never have
to go looking for it anywhere else, and it is still the only way to
add authentication to a port. (A deployment can choose to turn
auto-publish off entirely, in which case a freshly opened port goes
back to reserving a hostname without making it public until you run
dpe-expose yourself; from the outside, an unconfirmed
port behaves exactly like one that was never opened at all, the same
redirect, the same nothing-to-see.)
Choose who can reach it
| Command | Result |
|---|---|
| (nothing, the default) | Public, no authentication, live the moment the port is detected; anyone with the link can reach it. |
dpe-expose 8080 --auth basic --user me --pass secret | HTTP Basic Auth with a username and password you choose. |
dpe-expose 8080 --auth generated | HTTP Basic Auth with a random username and password, printed once. |
Only real passwords ever leave your container: what the platform stores is a salted, iterated hash, the same construction already used for your own cached login credentials, never the plaintext.
The honest limits
One real, pre-issued, pre-verified hostname per open port: you never choose your own hostname, which is what keeps this collision-free with everything else this host serves. A handful of ports at once per member, not unlimited. No remote port forwarding, no raw TCP, HTTP and WebSocket traffic only. And the moment your process stops listening, the hostname quietly returns to the pool; nothing lingers pointed at a service that is no longer there.