HTTP access

To reach an HTTP server running inside a sandbox (a dev server, a Jupyter kernel, an agent webhook), mint a preview URL for the port. The platform routes the public URL through its gateway into the sandbox.

List listening ports

Not sure which port your service bound to? List the ports the sandbox is currently listening on, each with the process that owns it:

tektona sandbox ports <sandbox-id>

The sandbox must be running. Pass --json for machine-readable output. Use this to find the port, then mint a preview URL for it.

Mint a preview URL

tektona sandbox preview <sandbox-id> <port>

For a sandbox created with --public and no TTL, the CLI returns the durable canonical URL. Otherwise it issues a bearer-token URL that expires. When no TTL is provided for a token URL, the server default is 12 hours.

Time-bounded preview

tektona sandbox preview <sandbox-id> 3000 --ttl 1h

--ttl accepts Go-style durations: 15m, 1h, 1h30m, 24h. The minimum is 1 minute and the maximum is 24 hours. Token URLs expire when the TTL runs out, so the URL stops working without a separate revoke.

Open in a browser

tektona sandbox preview <sandbox-id> 3000 --open

Or -b for short. The CLI also copies the URL to your clipboard by default, so pass --copy=false to skip.

Revoke a preview URL early

tektona sandbox revoke-preview <sandbox-id> <token>

Alias: tektona sandbox rp. Revocation is idempotent. Calling it on an already-expired or revoked token still succeeds.

Public sandboxes

Make a sandbox publicly reachable on canonical preview URLs from the start:

tektona sandbox create --image ghcr.io/tektona-ai/desktop-x11:0.4.3 --egress-policy tektona/open --public

Subsequent preview calls without --ttl return canonical URLs that stay valid for the lifetime of the sandbox.

Flags