Skip to main content
Every environment has a firewall. Its rules decide which inbound ports the environment’s instances accept, and from which addresses. Everything else is closed. The rules belong to the environment, so every instance in it follows the same rules, including ones you start later.

​
The default

A new environment has one rule: SSH (TCP port 22) from anywhere. Nothing else is open until you add a rule. Runcrate keeps the ports its own features use reachable from Runcrate only: the web terminal, the code editor, volume sync, and SSH for running commands from the dashboard. You do not need rules for them, and removing your SSH rule does not break them.

​
A rule

An environment holds up to 50 rules. Rules only open ports: anything no rule covers is closed. Ports published by programs in Docker containers follow the same rules.
Prefer your own addresses over anywhere for anything that is not meant to be public. Find your address with curl -s https://ifconfig.me.

​
How fast a change applies

A change reaches running instances within about a minute. Each instance checks for changes every 30 seconds. If an instance can’t reach Runcrate for a while, it keeps the rules it last had: it never opens up on its own. A change applies to new connections. Connections that are already open stay open until they end, the same as with cloud security groups. To cut one off, stop the program serving it or restart the instance. Each instance shows whether its rules are in place: enforced, pending while a change is on its way, or not enforced if the instance could not apply them (the reason is shown with it). To serve a web app or API on an instance at an HTTPS address, add an HTTPS link on the instance. Links belong to each instance, not to the firewall: a link needs no rule, and its port stays closed to everyone but Runcrate’s proxy unless a rule opens it.

​
Older instances

Instances started before the firewall existed keep their ports exactly as they were, and show that the firewall does not manage them (firewall.status is unmanaged in the API). Start a new instance in the environment to bring it under the rules.

​
Manage rules

Connect the Runcrate MCP server, then ask in plain words:
The agent calls add_firewall_rule with ports: "8080" and sources: ["203.0.113.7"]. Agents can only change the rules of the environment they are connected to. See MCP tools.