CapabilitiesReaching it
Non-web ports
Reach services that are not HTTP, such as a database or game server, over TCP.
Short answer: 4 of 16 providers offer it fully: Boat, Modal, Runtime and boxd. With a catch: InstaBox, Sandboxer, Sprites and Tensorlake. Checked 29 October 2026.
Who offers it
Part of Reaching it: links, ports and who can open them, which explains why it matters.
Fully: Boat, boxd, Modal and Runtime. With a catch: InstaBox, Sandboxer, Sprites and Tensorlake. Not at all: Agent 37, Cloudflare Sandbox, Lizard and Vercel Sandbox.
You open the port in the machine's own network rules and connect to its address; some machines have only the newer kind of internet address, so older clients cannot get in.
docs-confirmed “The public URL carries HTTPS and WebSockets only. For another protocol, open the port in the sandbox firewall and connect to the sandbox IP address.” Source
Up to three non-web ports per machine, each on a public port number.
docs-confirmed “The public port is allocated for you from the **40000 to 60000** range.” Source
A port can be exposed as raw traffic for protocols that are not web requests.
docs-confirmed “you can also expose raw TCP ports to the internet” Source
Up to five public non-web addresses per machine, for databases, game servers and similar.
docs-confirmed “TCP port: a public `address:port` for anything that is not HTTP, such as Postgres, Redis, MQTT or a game server.” Source
The catch: Raw non-web traffic is in a preview only administrators can use, and later will be paid-plan only with five ports per workspace.
docs-confirmed “In preview (admins only) until the server opens it to everyone; then paid plans only, up to 5 per workspace.” Source
The catch: There is no public non-web port; you reach one by opening a tunnel from your own computer.
docs-confirmed “Only the SSH port forward (`sshEndpoint`) and hosted ports; nothing else can address the VM” Source
The catch: You can map a database port onto your own computer, but there is no public address for non-web traffic.
docs-confirmed “it maps a remote port onto your machine” Source
The catch: The public address carries web traffic and SSH only; a database needs a tunnel from your own computer.
docs-confirmed “Anything else (VNC's RFB protocol, the Postgres wire protocol, MySQL, Redis's RESP, MongoDB, custom binary protocols) needs a tunnel” Source
- Agent 37No
Note: Only web traffic gets through; a database or game server cannot be reached directly.
inferred “Every port it listens on has its own HTTPS URL” Source
Note: Web traffic only: no other kind of connection can be made to the machine from outside.
docs-confirmed “Because all Container requests are passed through a Worker, end-users cannot make non-HTTP TCP or UDP requests to a Container instance.” Source
- LizardNo
Note: Preview links carry web traffic only, so a database or game port cannot be published.
inferred “A preview URL gives a port inside a sandbox on Lizard a private HTTPS address.” Source
Note: Only web ports can be exposed, so a database or game server cannot be reached from outside.
inferred “Exposed ports are accessible via a public URL” Source
- BlaxelNot published
No non-web port is documented; preview links carry web traffic.
inferred “You can have multiple preview URLs per sandbox.” Source
- DaytonaNot published
No public non-web port is documented; preview links carry web traffic.
inferred “Otherwise, authentication is required.” Source
- E2BNot published
No public non-web port is documented; the published addresses carry web traffic.
inferred “By default, a sandbox's public URLs are reachable by anyone who knows them.” Source
- MorphNot published
No public non-web port is documented.
inferred “Expose Http Service” Source
Related
Need several capabilities at once? Add more in the capability finder. Something wrong here? Use the report link at the bottom of the page.