How do you give a sandbox port an HTTPS URL?

How do you publish a port?

Run the server on a known port, listening on 0.0.0.0, and host that port. The hostname is the sandbox's subdomain followed by the port number.

sbx exec <sandbox-id> --detach "python3 -m http.server 8000"
sbx host <sandbox-id> 8000 --title "Demo"

Hosting the same port again returns the same URL and token. Inside the sandbox itself, the shorter host 8000 does the same job. Sandboxer's HTTPS URL guide walks through each step with real output.

What is the difference between a private and a public URL?

A private URL carries a _token; a public URL does not need one. New ports are private.

After the first visit the cookie is enough, so links and assets load normally in a browser. Treat the full private URL and the cookie like a password. Add --public to open a port to anyone, or --private to lock it again. Switching between the two mints a new token, so old links stop working.

What if the app only listens on localhost?

Use --localhost. Many dev servers, Vite among them, bind to 127.0.0.1, which the proxy cannot reach, so a plain host returns 502 with "Nothing is answering". With --localhost the sandbox relays the connection to the loopback address. Some dev servers also reject unknown host names; for Vite, add .box.sandboxer.com to server.allowedHosts.

Do WebSockets and hot reload work?

Yes. On a public port they work as they are. On a private port the WebSocket handshake needs the auth cookie rather than the token in the address. A browser already has that cookie after opening the token link, so hot module reload just works. A script has to exchange the token for the cookie first, as shown in the guide.

What happens to the URL after stop, resume or fork?

• Stopped: the URL returns 404 while the sandbox is off.
• Resumed: routes, tokens and the subdomain all come back. If memory was restored, the same server processes answer at once. If the resume booted from disk, start your servers again or run them as enabled systemd services. See pause and resume.
• Forked: the fork gets a new subdomain with no hosted ports, so host the port again there.

An idle sandbox can pause itself and wake on the next request to one of its hosted URLs.

How do you list or remove hosted ports?

sbx host list <sandbox-id>        # ports, access and URLs (tokens hidden)
sbx host hide <sandbox-id> 8000    # take the URL down

After hide the URL returns 404, but the server keeps running inside the sandbox. Only hosted ports are reachable through the proxy.

When should you use a tunnel instead?

Use sbx host when the server already runs in a Sandboxer sandbox: there is no extra process to run and the hostname stays the same across stop and resume. A tunnel such as ngrok or Cloudflare Tunnel fits when the server runs somewhere else, like your laptop. Sandboxer does not offer first-class custom domains yet; its hosting docs describe pointing a CNAME at the hosted name and handling TLS yourself. For preview links on pull requests, see CI and testing.