Desktop and private servicesCopy Anchor Link

Forward network ports and connect to an on-demand graphical desktop over authenticated host SSH tunnels bound to controller loopback.

Target workspace handleCopy Anchor Link

Commands in this guide target a running workspace. Select one from raft list (see First working box):

raft list
box="lab:rf-a1b2c3d4e5f60718"  # Replace with your actual workspace handle

Forwarding network portsCopy Anchor Link

Create a secure tunnel between your local controller and a workspace service:

raft forward "$box" --remote <REMOTE_PORT> --local <LOCAL_PORT>

End-to-end example: Running a web serviceCopy Anchor Link

Start a detached HTTP server inside the workspace:

job=$(raft exec "$box" --detach -- python3 -m http.server 8080 --bind 0.0.0.0)
echo "Started web service job: $job"

Open the forwarding tunnel:

raft forward "$box" --remote 8080 --local 8080

raft forward runs in the foreground. Open http://127.0.0.1:8080 in your browser or run curl http://127.0.0.1:8080 in another terminal.

When finished:

1. Press Ctrl+C to close the tunnel.
2. Cancel the background job:

   Copy Text

   raft cancel "$box" "$job"

Binding requirementCopy Anchor Link

The controller listener binds strictly to 127.0.0.1 on your local workstation, without exposing ports to your local network.

On-demand desktop environmentCopy Anchor Link

The development image includes a graphical desktop stack using Xvfb (display :99), Openbox, x11vnc, and noVNC.

Start the desktop and establish a private tunnel:

raft desktop "$box" --local 6080

raft desktop starts raft-desktop.service inside the container if needed, waits for Xvfb and VNC readiness, and opens a tunnel to local port 6080.

Open the client in your browser:

http://127.0.0.1:6080/vnc.html

Desktop characteristicsCopy Anchor Link

• Display environment: Virtual X display :99 at 1280x720 resolution with 24-bit color.
• User session: Openbox runs under the developer user account.
• Clipboard support: The noVNC sidebar provides a clipboard drawer for text exchange.
• Tunnel lifecycle: Pressing Ctrl+C closes the local tunnel. The desktop service keeps running until the workspace stops or expires.
• Reconnecting: Running raft desktop "$box" --local 6080 reconnects without interrupting open windows.