Services on localhost

Lease a Postgres or a running app and reach it on your own machine’s localhost, carried over the private tailnet.

When you lease an environment that exports a service, envd on your sandbox listens on 127.0.0.1 and carries each connection to the environment over the tailnet. Your tools connect as if the service ran locally.

Postgres

envctl env create postgres

postgres-9c13 is ready (ready in 22.7s)
  postgres     on this machine at 127.0.0.1:5432

Connect with the template’s credentials (user app, password app, database app):

psql postgres://app:app@127.0.0.1:5432/app

“Ready” means Postgres accepts connections. On a fresh database that takes about 20 seconds, while initdb runs.

Load data

It’s your localhost, so your usual tools work as they are:

psql postgres://app:app@127.0.0.1:5432/app -f db/schema.sql
pg_restore -d postgres://app:app@127.0.0.1:5432/app backup.dump

Several at once

A second Postgres on the same sandbox listens on the next free port, 127.0.0.1:5433, and so on. envctl env create prints the address.

A live app

app-runtime runs a FastAPI app from the src share and reloads it on every change you sync:

envctl env create app-runtime --share src=./api
curl http://127.0.0.1:8080/health

Edit a file and the app reloads within about a second.

What can reach a service

Only your organization’s machines, through envd. An environment’s services listen on its own loopback, its container is on a network nothing else shares, and envd carries a connection only from a machine on your organization’s tailnet. Other organizations can’t see the environment at all. See Isolation.