Raw TCP ports
Publish a database, game server, or MQTT broker on a platform-allocated public port, with the exposure and limits stated plainly.
When to publish a TCP port
The shared edge handles HTTP and HTTPS. If your service speaks raw TCP -- PostgreSQL, MySQL, Redis, a Minecraft or Valheim server, an MQTT broker, or a custom protocol -- publish a TCP port instead.
Do not publish a port for a website or API. Use a site instead: you get HTTPS, a hostname, and a certificate without exposing an extra port.
How publishing works
- Open the instance's Networking tab.
- Under Publish a TCP port, enter the port your service listens on inside the instance.
- Choose a purpose (database, game server, MQTT, or other) so the dashboard can show the right warning.
- Save. The platform allocates a public host port and shows the endpoint as tcp://<node-ip>:<public-port>.
The public port is chosen by the platform, starting at 23000. You never choose it yourself, so two tenants cannot collide and nobody can squat on a well-known port.
Limits
- 10 published ports per instance, including the SSH mapping. The dashboard shows the count before you add another.
- Denied origin ports: 22, 25, 53, 137, 138, 139, 445, 1900, and 5353.
- One public port maps to one container port. Releasing it stops forwarding immediately.
- Quotas are per instance, not per account. A second instance gets its own allocation.
Exposure warning
A published port is reachable from the internet. Anyone who finds it can connect to your service. Use authentication, strong passwords or keys, and TLS where the protocol supports it. A database published without TLS sends credentials and data in clear text. If you only need local access, use an SSH tunnel instead:
Examples
| Service | Container port | What to do |
|---|---|---|
| PostgreSQL | 5432 | Require TLS and a strong password; restrict who knows the endpoint. |
| Minecraft | 25565 | Enable whitelist and keep the server patched; game protocols are often amplified. |
| MQTT | 1883 or 8883 | Prefer 8883 with TLS, and require authentication. |
| Redis | 6379 | Never expose Redis without a password and a trusted network; prefer an SSH tunnel. |
Health and release
The dashboard shows the mapping and whether the public port is reachable. If the mapping exists but nothing listens on the container port, the service is down, not the allocation. Fix the listener, then re-check.
To release a port, use Remove next to the mapping. Traffic to the public port stops immediately; nothing else on the instance changes. Releasing a port does not stop your container.
Troubleshooting
| Symptom | Check |
|---|---|
| Connection refused | The service is not listening inside the instance, or it is bound to 127.0.0.1. Bind to 0.0.0.0. |
| Timeout | The service is listening but the host firewall or the protocol is not passing traffic. Check the container logs first. |
| Port limit reached | You have 10 mappings including SSH. Release an unused port before adding another. |
| Port denied | Choose a different origin port. SMTP, SMB, NetBIOS, mDNS, SSDP, and DNS are blocked. |