HubTunnels & Private Access

HubTunnels provide temporary private access to containers inside a Hubfly space project without exposing those services to the public internet. A tunnel maps a local port on your laptop to a target container port through an authenticated SSH forwarding path.

Private Access vs Public Ingress

HubTunnels are designed for administrative access (PostgreSQL maintenance, Redis debugging, internal API inspection) rather than public customer traffic. Keep databases private and use HubTunnels when developers need access.

CLI Command Reference

Create a tunnel to a private PostgreSQL database container:

terminal

$ hubfly tunnel create --project proj_123 --container cont_postgres --port 5432 --local 15432

Tunnel established · localhost:15432 -> cont_postgres:5432

Then connect using any local database client against localhost:15432:

terminal

$ psql -h localhost -p 15432 -U postgres postgres

Tunnel Lifetime & Security

Default TTL: Tunnels automatically expire after 1 hour (3600s) to prevent permanent background access paths.
Project Scope: Requires active project membership permissions to create or sync a tunnel.
Cleanup: Use hubfly tunnel stop <tunnel_id> to close the tunnel and delete the temporary server SSH bridge.