Port forwarding
Forward TCP ports from your machine into a sandbox, brokered through the platform.
tektona sandbox port-forward tunnels one or more local TCP ports into a
sandbox, using the same brokered connection as tektona ssh: no public IP,
no key management, no firewall changes required.
The command runs in the foreground. Press Ctrl-C to stop all tunnels.
pf is a shorthand alias, so tektona sandbox pf <sandbox-id> 3000 is
equivalent to the full port-forward form everywhere in this page.
Forward a single port
tektona sandbox port-forward <sandbox-id> 3000Binds localhost:3000 on your machine and forwards it to port 3000 inside
the sandbox. The CLI prints a confirmation for each active tunnel:
Forwarding from localhost:3000 -> 3000Specify a different local port
Use LOCAL_PORT:REMOTE_PORT to separate the local and remote sides:
tektona sandbox port-forward <sandbox-id> 8080:3000Forwarding from localhost:8080 -> 3000Let the OS pick a local port
Omit the local port (:REMOTE_PORT) to let the OS assign an ephemeral port:
tektona sandbox port-forward <sandbox-id> :3000Forwarding from localhost:54321 -> 3000The assigned port is printed so you know where to connect.
Forward multiple ports at once
Pass several port specs in a single invocation:
tektona sandbox port-forward <sandbox-id> 8080:3000 5432:5432 9090:9090Each spec opens an independent tunnel. All tunnels stay open until you press
Ctrl-C.
Bind to a different local address
By default the tunnels bind to localhost. Pass --address to bind to a
different interface, for example to share a tunnel with others on the same
network:
tektona sandbox port-forward <sandbox-id> 3000 --address 0.0.0.0Binding to 0.0.0.0 exposes the tunnel on all network interfaces. Only do
this on networks you trust.
Print the SSH command without connecting
--print emits the resolved ssh invocation and exits without opening any
tunnels. Useful for scripting or inspection:
tektona sandbox port-forward <sandbox-id> 8080:3000 --printPass -o json to get the raw SSH access credentials as JSON (the token and
host details used to build the command):
tektona sandbox port-forward <sandbox-id> 8080:3000 -o jsonFlags
| Flag | Default | Purpose |
|---|---|---|
--address | localhost | Local address to bind tunnels on |
--print | false | Print connection details and exit without forwarding |
-o | (none) | Output format (json) |
Local-to-remote only
Port forwarding is local→remote only (matching kubectl port-forward
semantics). The gateway does not support remote→local (-R) forwarding.
For HTTP-only ports, a shareable preview URL is simpler than a tunnel. See
tektona sandbox preview.