Repository navigation
Tunnel Sandbox #3
Description
What is this?
Open this issue, tick your options, and the workflow will spin up a short-lived test server on a GitHub Actions runner and expose it via the tunnel you choose. Edit the issue to re-run with new options.
What happens next?
After you submit, the bot comments a status block that includes your access link or SSH command. If something fails, it automatically opens a private tmate shell for you.
Tunneling Access Overview
| Option | Public link? | Setup (Runner → User) | Typical perf | Reliability/NAT | Privacy / Exposure | Best for |
|---|---|---|---|---|---|---|
| Cloudflare Tunnel | Yes (*.trycloudflare.com) |
Auto-install client → you click URL | Good–very good | High | Public at edge; origin stays private | Quick public demos |
| localhost.run | Yes (http(s)://…lhr.life) |
SSH reverse tunnel → we scrape URL | OK–good | Medium (shared infra) | Public at edge | Fast, zero-config link |
| Inlets PRO | Yes (your controller) | Client connects to your inlets server | Very good | High (you control edge) | Public via your infra; TLS options | Prod-like, your domain |
| Tailscale | No public URL | Runner joins tailnet → you SSH port-forward | LAN-like, low-latency | Very high (P2P/NAT-punch) | Private to tailnet | Private evals / team-only |
| Tor | Yes (.onion) |
Local hidden service → onion URL | Variable (high latency) | High | Pseudonymous; Tor-only | Privacy-focused access |
Notes:
• Tailscale requires you (and testers) to be on the same tailnet; we comment a readyssh -L ...command.
• Inlets PRO needs secrets for your controller (see below).
• Tor requires Tor Browser to visit.onionURLs.
• Max runtime is capped at 80 minutes, even if you request longer.
🔧 Control Panel
Select a runner, a tunnel, then check "ON" to start!
1. Runner OS (pick ONE)
- [] Ubuntu (ubuntu-latest)
- macOS (macos-14)
- Windows (windows-latest)
2. Tunnel (pick ONE)
- Cloudflare Tunnel (ephemeral trycloudflare.com)
- localhost.run (free SSH reverse tunnel)
- Inlets PRO (requires secrets)
- Tailscale (VPN overlay; SSH port-forward from your device)
- Tor (hidden service onion URL)
3. Power
- ON (check this box to start the sandbox)
4. Config (Optional)
You can override defaults here. The parser will use the values below if this block is present.
If this block is removed or values are invalid, the workflow defaults (Port: 8080, Minutes: 40) will be used.
# Port the Hello World server will listen on
port: 8080
# Minutes to keep the runner alive (workflow hard-cap is 80)
minutes: 40Notes / Secrets (only if applicable)
Inlets PRO
INLETS_REMOTE(e.g.,wss://inlets.example.com/connect)INLETS_TOKENINLETS_LICENSE- (Optional)
INLETS_PUBLIC_URL
Tailscale
- Maintainer provides an ephemeral
TAILSCALE_AUTHKEY(repo secret). - Your device must be logged into the same tailnet. The workflow will comment a copy-paste SSH port-forward command.
Click options to change them — the action will re-run with the options you select.
Activity
github-actions commentedon Sep 9, 2025
Tunnel Sandbox · Status
⏹️ Switch is OFF — not starting any runner.
Check the ON box and edit this issue to start again.