> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelrail.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Private app tunnel

> Reach an admin port of an app from your laptop without publishing it. The CLI listens on 127.0.0.1 and relays each connection through the control plane.

Reach an admin port of an app from your laptop without publishing it. The CLI listens on `127.0.0.1` and relays each connection through the control plane to the container's port on the platform network.

```
levelrail-cli apps tunnel web --port 9000
levelrail-cli apps tunnel shop --service db --port 5432 --local-port 15432
```

The command prints the local address and runs until Ctrl-C. Open that address in a browser, psql or any TCP client.

## Flags

| Flag | Meaning |
| - | - |
| `--port` | Container port to reach. Defaults to the app's routed port. |
| `--service` | A service of a multi-service app, when the name is the app group. |
| `--local-port` | Local port to listen on. Defaults to a free port. |

## What is allowed

* Only a port the service declares: its routed port, a published container port, or a port the image EXPOSEs. Anything else is refused with the allowed list.
* Only that app's own container. Another app's service is never reachable, and a service name cannot be used to reach a sibling.
* Only apps on the control plane node, like the database tunnel.
* The same permission as exec and the terminal: operator (root ability) on the app. Viewers are refused.

## Limits and audit

Each open and close is written to the audit log (`app.tunnel.open`, `app.tunnel.close`) with the service, port and bytes in each direction.

| Variable | Default | Meaning |
| - | - | - |
| `APP_TUNNEL_ENABLED` | `true` | Set to `false` to refuse every tunnel. |
| `APP_TUNNEL_IDLE_TIMEOUT` | `15m` | Close a tunnel with no traffic for this long. |
| `APP_TUNNEL_MAX_PER_USER` | `5` | Open tunnels per account. |

The dashboard shows the exact command, with a Copy button, on the app Overview tab.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.