Skip to main content
When you lease an environment that exports a service, envd on your sandbox listens on 127.0.0.1 and carries each connection to the environment over the tailnet. Your tools connect as if the service ran locally.

​
Postgres

Connect with the template’s credentials (user app, password app, database app):
“Ready” means Postgres accepts connections. On a fresh database that takes about 20 seconds, while initdb runs.

​
Load data

It’s your localhost, so your usual tools work as they are:

​
Several at once

A second Postgres on the same sandbox listens on the next free port, 127.0.0.1:5433, and so on. envctl env create prints the address.

​
A live app

app-runtime runs a FastAPI app from the src share and reloads it on every change you sync:
Edit a file and the app reloads within about a second.

​
What can reach a service

Only your organization’s machines, through envd. An environment’s services listen on its own loopback, its container is on a network nothing else shares, and envd carries a connection only from a machine on your organization’s tailnet. Other organizations can’t see the environment at all. See Isolation.