Guide

Expose ports

Run an HTTP server inside a sandbox, publish its port, and get an HTTPS URL.

Publish an anonymous port

Anonymous ports are public HTTPS routes to a process that listens inside the sandbox. Bind the server to 0.0.0.0, not 127.0.0.1.

1. Open the sandbox from Sandbox groups > your group > Sandboxes.
2. Start your server from the Interactive shell. Listen on port 8080.
3. Select Details.
4. In Ports, select Add port.
5. Enter 8080 for Port and choose Anonymous for access.
6. Select Add. Copy the generated URL after the port appears.

Bash

aca sandbox create --disk ubuntu --label name=demo-port
aca sandbox exec -l name=demo-port -c \
  "nohup python3 -c \"import http.server,socketserver; h=http.server.BaseHTTPRequestHandler; h.do_GET=lambda s:(s.send_response(200),s.end_headers(),s.wfile.write(b'hello from sandbox\\n')); socketserver.TCPServer(('0.0.0.0',8080), h).serve_forever()\" > /tmp/srv.log 2>&1 &"

URL=$(aca sandbox port add -l name=demo-port --port 8080 --anonymous -o json | jq -r '.[].url')

echo "Live at: $URL"
curl -s --max-time 15 "$URL"

PowerShell

aca sandbox create --disk ubuntu --label name=demo-port
$Server = 'nohup python3 -c "import http.server,socketserver; h=http.server.BaseHTTPRequestHandler; h.do_GET=lambda s:(s.send_response(200),s.end_headers(),s.wfile.write(b''hello from sandbox\n'')); socketserver.TCPServer((''0.0.0.0'',8080), h).serve_forever()" > /tmp/srv.log 2>&1 &'
aca sandbox exec -l name=demo-port -c $Server

$Url = (aca sandbox port add -l name=demo-port --port 8080 --anonymous -o json | ConvertFrom-Json).url

Write-Host "Live at: $Url"
Invoke-RestMethod -Uri $Url -TimeoutSec 15

SDK

import os
import time
import urllib.request

from azure.identity import DefaultAzureCredential
from azure.containerapps.sandbox import SandboxGroupClient, endpoint_for_region

credential = DefaultAzureCredential()
client = SandboxGroupClient(
    endpoint_for_region(os.environ["ACA_SANDBOXGROUP_REGION"]),
    credential,
    subscription_id=os.environ["AZURE_SUBSCRIPTION_ID"],
    resource_group=os.environ["ACA_RESOURCE_GROUP"],
    sandbox_group=os.environ["ACA_SANDBOX_GROUP"],
)

sandbox = client.get_sandbox_client(os.environ["SANDBOX_ID"])
sandbox.exec(
    "nohup python3 -c \""
    "import http.server, socketserver;"
    "h=http.server.BaseHTTPRequestHandler;"
    "h.do_GET=lambda s: (s.send_response(200), s.end_headers(),"
    " s.wfile.write(b'hello from sandbox\\n'));"
    "socketserver.TCPServer(('0.0.0.0',8080), h).serve_forever()"
    "\" > /tmp/srv.log 2>&1 &"
)

time.sleep(2)
port = sandbox.add_port(8080, anonymous=True)
time.sleep(6)

print(f"Live at: {port.url}")
with urllib.request.urlopen(port.url, timeout=15) as resp:
    print(resp.read().decode().strip())

Remove a port

Remove a port when the server is no longer needed. The URL stops working immediately.

1. Open the sandbox, then select Details.
2. Find the port in Ports.
3. Select Remove from the row actions.
4. Confirm the removal.

Bash

aca sandbox port remove -l name=demo-port --port 8080

PowerShell

aca sandbox port remove -l name=demo-port --port 8080

SDK

sandbox.remove_port(8080)

Related

Control egress

Limit the hosts a sandbox can call.

Learn more →

Use managed identities

Use Azure RBAC for sandbox to Azure calls.

Learn more →

Transfer files

Move files into or out of a sandbox.

Learn more →