Skip to content

Endpoints: direct access without a public IP

How endpoints expose a specific TCP/UDP port on a container through the Shared Load Balancer on Stack Harbor PaaS — managing endpoints, the standard port templates, and common use cases.

Endpoints are how you expose a specific port on a container without attaching a public IP to it. The platform performs the TCP or UDP port mapping for you and routes external traffic to that port through the Shared Load Balancer.

This is the right tool when you need direct access to a service — a database client, a remote IDE, an admin panel — but do not want the operational cost of a dedicated public IP.

Managing endpoints

Endpoints live on the environment, under Settings → Endpoints. The tab shows every endpoint defined on every node in the environment.

Adding an endpoint

Click Add on the toolbar and fill the form:

FieldWhat it does
NodeThe environment node the endpoint exposes
NameA label, or one of the pre-configured templates
Private PortThe port on the node that should be reachable
ProtocolTCP or UDP

The Public Port and Access URL are assigned by the platform and appear in the list once the endpoint is created.

Pre-configured port templates

For convenience, common service ports have a named template — pick the template and the private port is filled in for you.

TemplatePrivate port
FTP21
SSH22
SMTP25
DNS-UDP / DNS-TCP53
HTTP80
POP3110
IMAP143
LDAP389
HTTPS443
SMTPS587
IMAPS993
POP3S995
Docker Swarm2377
MySQL3306
Remote Desktop3389
Docker Swarm Overlay4789
PostgreSQL5432
RabbitMQ5672
CouchDB5984
PowerShell5986
Redis6379
Cassandra-JMX7199
Neo4J7474
Riak8093
Cassandra9042
Memcached11211
MongoDB27017

Editing and removing

Double-click an endpoint to edit its name, private port, or protocol. Use the Remove action in the toolbar to delete it.

Operational notes

  • VPS and custom Docker containers — the listed private port must be opened on the container manually. Endpoints handle the public-side mapping only.
  • Nodes that also have a public IP — drop the node{nodeId}- prefix from the endpoint’s Access URL; otherwise the URL resolves to the public IP instead of the SLB-routed endpoint.

Common use cases

Remote database access

The most common reason to add an endpoint. Once the MySQL or PostgreSQL endpoint is live, connect from your local shell:

mysql -h {host} -P {port} -u {user} -p

Where:

  • {host} is the endpoint’s Access URL without the port suffix
  • {port} is the endpoint’s public port
  • {user} is your database user (the platform emails the default credentials after environment creation)

The same pattern works with a graphical client (MySQL Workbench, DBeaver, TablePlus, pgAdmin). Configure a new connection with the endpoint host and port, and store the password in your keychain if your client supports it.

Running multiple project copies on a single application server

You can use one application server to host both production and a dev branch by exposing extra ports through endpoints.

  1. Create an endpoint on the application server with an unused private port (avoid 80 — Apache uses it for default HTTP traffic).
  2. Deploy the application twice, to different contexts (e.g. prod and dev).
  3. Edit the Apache configuration (/etc/httpd/conf/httpd.conf) to listen on the extra port:
    Listen [::]:{port}
  4. Duplicate the default VirtualHost block, change its port, and point its document root at the second context.

External traffic to the endpoint reaches the second VirtualHost; the default URL still serves production.

See also