Every machine has a URL.
Each boxd machine comes up on its own hostname with HTTPS already working. Publishing what's running inside it is one command — no ingress to configure, no load balancer to point at it, no certificate to renew.
The port stays inside the machine. Nothing in the address says 3000, so it survives you moving the app.
Four ways to be reachable.
Each one is more specific than the last, and the address changes to match. Read the four and the naming scheme explains itself.
Every machine starts reachable. Everything below is about being reachable more specifically.
Every machine answers on its own hostname the moment it exists, certificate already in place. Left on auto it routes to whatever is listening inside.
Publish a specific port under a name you choose. As many as you like on one machine — app, api, admin — each with its own subdomain.
A raw TCP or UDP forward on a public port the platform allocates. No subdomain and no TLS termination, for Postgres or anything else that was never going behind a hostname.
Point your domain at the machine with an A record and a wildcard CNAME. boxd watches for them and issues certificates for the apex and the wildcard.
Binding your own domain to a machine is still something we do for you rather than a command you run — tell us the domain and it is set up the same day.
From localhost to a link, in one command.
The usual distance between those two things is an afternoon of ingress rules and DNS. Here the machine is already on the internet; the only question is which port you want to show.
- 01
Run something on a port
Whatever you were going to run anyway. Nothing about it has to know it is going to be published.
boxd machine exec alice npm run dev - 02
Publish it
One command, one subdomain. The certificate is issued for you and the DNS already points at the proxy.
boxd machine proxy add api --vm alice --port 3000 - 03
Send someone the link
That is the whole deployment. No build step, no staging queue, and the thing they see is the thing running on the machine.
boxd machine proxy list --vm alice
None of the usual apparatus.
Certificates handled
TLS terminates at the proxy for the whole zone. Nothing to install in the machine, nothing to renew in ninety days.
It finds your port
Left on auto, a machine's own hostname routes to whatever is listening inside it — no second command after starting a dev server.
Forks arrive published
A fork inherits what its parent published, so the copy is live at its own address immediately. That is what turns a fork into a preview.
Forking & snapshotsRaw TCP and UDP
Pass --raw for a plain forward on an allocated public port, for a database or a game server rather than a web app.
A machine listed as suspended, then a browser hitting its URL cold and the page rendering. Show the status flipping to running in the same frame — the point is that nobody pressed start. Don't trim the wait; it is under a second and that only lands if it is real.
The URL wakes the machine.
A request for a sleeping machine doesn't fail and doesn't queue behind a warm pool. The proxy resumes it first and then forwards the connection, so the only thing anyone notices is a page that loaded:
- Suspended — resumed in under a millisecond
- Hibernated — restored from disk, typically under a second
- Asleep in between — costing nothing while it waits
A URL is not a deployment.
Nothing is built, packaged or shipped when you publish a port. The proxy routes to a process already running on a machine you already have, which is why there is no deploy step to wait for and no artifact to keep in sync with the branch.
It also means what someone opens is the machine as it is right now, including the change you made thirty seconds ago.
Who ends up using it.
- Developers
- The distance between localhost and a link somebody else can open is one command, so showing work in progress stops being a deployment.
- Teams
- Every branch can have a URL because every branch can have a machine, and nobody is waiting behind a single staging environment.
- Agents
- An agent can publish what it built and hand you the address, then take it down again — all with --json, and without a console.
About domains and URLs
No. Every machine already has a hostname pointing at the proxy, and TLS terminates there for the whole zone, so certificates are issued and renewed by the platform. There is nothing to install inside the machine.
The proxy wakes it and then forwards the request. A suspended machine resumes in under a millisecond; a hibernated one is restored from disk in about a second. The visitor sees a page that loaded, and the machine costs nothing while it waits.
Yes — that is what named proxies are for. Your app, your API and an admin panel can each have their own subdomain on the same machine, and each maps to its own port inside.
Pass --raw and the port is forwarded as plain TCP or UDP on a public port the platform allocates, with no subdomain and no TLS termination. It is the right choice for a database you want to reach from your laptop.
Yes. You add an A record for the apex and a wildcard CNAME at the machine's boxd hostname; the platform verifies them and issues certificates for both the apex and the wildcard. Binding the domain to a machine is something we still do for you rather than a command you run — tell us the domain and it is set up the same day.
A URL per machine is what turns a fork into a preview, how a dev workspace gets shared, and how a background agent shows you what it built.