Skip to main content
Expose an exported port on a running container. expose container opens a public ingress to an exported port on a running container. The provided container needs to be up and running. For example, it can be started in advance using docker run within an ephemeral instance. The exposed endpoint is encrypted with TLS and secured with Namespace authentication, so whoever has access to the workspace where the ephemeral environment was created in, will also have access to the endpoint. Note: Only HTTP services can currently be exposed.

​
Usage

​
Example

In the example below we first create an ephemeral instance, then SSH into the instance, start the nginx container with docker run and then expose it using nsc expose container.
1

Create an ephemeral instance

Create an ephemeral instance and note its ID in the output:
Output
2

SSH into the instance

Connect to the instance using its ID:
3

Start nginx container within the created instance

Start an nginx container that publishes port 80:
4

Expose the nginx container

Expose the container’s port 80 through a public ingress:
Output
5

Visit the exposed endpoint

Open https://nginx-foobar-j239700-oiepencpc41im.fra1.namespaced.app in your browser and authenticate with your Namespace credentials.

​
Options

​
—container <name>

To specify a name of a container to expose. This option is required.

​
—container_port <port[,port]>

Exports the specified ports (separated by commas) as public ingresses. If the option is not provided, all the exported ports would be exposed.

​
—ingress <rules>

Specify additional ingress rules per exported port. The value is a mapping from port (or * to apply to any port) to a semicolon-separated list of rules, e.g. 80=rule1;rule2,443=rule3. Each rule follows the same effect syntax used elsewhere by nsc expose:
  • <effect>: Applies effect to any method or path.
  • <path_regex>:<effect>: Applies effect to paths that match path_regex (the full path without the query is used for matching).
  • <method>[,<method>,...]:<path_regex>:<effect>: In addition to matching path, also matches against the HTTP method used.
Currently supported effect: noauth, which disables authentication on the route.

​
—name <name>

Set the name of the exposed ingress. Setting a name is only permitted when exposing a single port. By default, ingress names will be generated by Namespace.

​
—source <source>

To specify the container runtime which was used to run the container. Supported options are docker and containerd. By default docker is used to lookup running containers.

​
—output, -o <plain|json>

Specifies the output format. Supported options are json and plain. By default, plain output format is used.

​
—all

Export one ingress for each exported port of each running container.

​
—wildcard

If set, generate a wildcard ingress for the exposed container port. Can only be used when exposing a single port.
Last modified on August 20, 2026