CLI Tunnels, SSH & Logs

The CLI can reach private Hubfly space containers without exposing them publicly. Use tunnels for databases and internal services, ssh for a shell, exec for one command, and logs for runtime output.

Open A Tunnel

Forward a local port to a port inside a private container:

terminal

$ hubfly tunnel <containerIdOrName> <localPort> <targetPort>

# PostgreSQL example

$ hubfly tunnel postgres-db 5432 5432

Establishing tunnel...

Local: localhost:5432 -> Remote: postgres-db:5432

Keep the command running while your local app, database client, or browser uses the forwarded port. Stop it with Ctrl+C.

Use Case	Command	Connect Locally To
Postgres	`hubfly tunnel postgres-db 5432 5432`	`127.0.0.1:5432`
Redis	`hubfly tunnel redis 6379 6379`	`127.0.0.1:6379`
Private HTTP admin app	`hubfly tunnel admin 8080 80`	`http://127.0.0.1:8080`

Tunnel From The TUI

If you do not remember container names or ports, use the project UI:

terminal

$ hubfly projects

# Select project -> container -> Create New Tunnel or Connect One Tunnel

up/down or j/k: move.
enter: select or confirm.
space: select tunnels in multi-tunnel mode.
a: toggle all tunnels in multi-tunnel mode.
esc or q: go back or quit.

Shell And Exec

Use ssh when you want an interactive shell. Use exec when you want one command with a short timeout.

terminal

$ hubfly ssh web-app

root@web-app:/app#

$ hubfly ssh web-app -- ls -la /app

$ hubfly exec web-app -- printenv

$ hubfly exec web-app -- sh -lc "ls -la /app && pwd"

Exec timeout

hubfly exec and non-interactive hubfly ssh -- command use a 55-second command timeout. Use an interactive shell for long-running maintenance.

Logs

Stream logs from a container by ID or name:

terminal

$ hubfly logs web-app

$ hubfly logs web-app --follow

$ hubfly logs web-app -f

For Compose-style stacks, use hubfly stack logs:

terminal

$ hubfly stack logs api --follow

$ hubfly stack logs api worker -f

How Tunnels Work

The Dashboard creates a short-lived tunnel session for approved container targets. The CLI authenticates to the tunnel gateway over WebSocket, opens a Yamux session, then forwards each local connection to an approved target port.

The tunnel only reaches targets approved by Hubfly space for that session.
The CLI caches the local tunnel ticket under ~/.hubfly while it is usable.
SSH host keys are isolated in ~/.hubfly/known_hosts so Hubfly space sessions do not pollute your global SSH config.
When the tunnel process exits, local forwarding stops.

Tips

Need	Use
Local GUI database access	Open `hubfly tunnel postgres-db 5432 5432`, then connect TablePlus, DBeaver, or pgAdmin to `127.0.0.1:5432`.
Different local port	Change only the second argument, for example `hubfly tunnel postgres-db 15432 5432`.
Many private services	Use `hubfly projects` and choose multi-tunnel mode.
Debug a failed tunnel	Run with `HUBFLY_DEBUG=1` and check `~/.hubfly/logs/debug.log` for TUI sessions.