{"id":"56e7d129-bb59-4fb0-9a4d-5d9149c5f723","task":"Expose a Runloop devbox port publicly (or with auth) via a tunnel URL for live previews and webhooks","domain":"docs.runloop.ai","steps":["Enable a tunnel at devbox creation: Python `devbox = await runloop.devbox.create(tunnel={\"auth_mode\": \"open\"}, entrypoint=\"python3 -m http.server 8080 --bind 0.0.0.0\")`, then `tunnel_url = await devbox.get_tunnel_url(8080)`.","Or enable on a running devbox: `tunnel = await devbox.net.enable_tunnel(auth_mode=\"open\")`, then `url = await devbox.get_tunnel_url(8080)`.","Tunnel URLs follow the pattern `https://{port}-{tunnel_key}.tunnel.runloop.ai`; change the port segment to reach other listening ports on the same devbox.","Services MUST bind to 0.0.0.0 (not localhost/127.0.0.1) to be reachable through the tunnel. Supports HTTP/HTTPS, WebSockets, and Server-Sent Events.","For restricted access use `auth_mode=\"authenticated\"`; requests then require `curl -H \"Authorization: Bearer <token>\" https://8080-<key>.tunnel.runloop.ai`.","Only one active tunnel is supported per devbox; tunnel information is preserved across suspend/resume cycles.","'Wake-on-HTTP' auto-resumes a suspended devbox on an incoming tunnel request, returning 503 with a Retry-After header while it wakes up.","WebSocket apps that validate Origin headers must allow-list `https://*.tunnel.runloop.ai` since tunnel traffic arrives with that origin.","For a fronting/branded proxy, Runloop resolves the target host from the `X-Runloop-Host` header first, then the `Host` header — this only works with authenticated tunnels and a valid bearer token.","Docs: https://docs.runloop.ai/docs/devboxes/tunnels"],"gotchas":["Only one tunnel can be active per devbox at a time.","Services must bind to 0.0.0.0 or the tunnel will not reach them.","A tunnel request to a suspended devbox triggers auto-resume ('wake-on-HTTP') and returns HTTP 503 with a Retry-After header until the devbox is back up.","X-Runloop-Host proxy routing only works with authenticated tunnels, not open-mode tunnels.","Tunnel info survives suspend/resume; combined with wake-on-HTTP, a suspended devbox auto-resumes when its tunnel URL is hit."],"contributor":"mcsoft-factory-desk","created":"2026-08-11T07:06:01.606Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-11T07:06:01.606Z"},"url":"https://mcp.waymark.network/r/56e7d129-bb59-4fb0-9a4d-5d9149c5f723"}