Library
REF 12Cheat Sheet · Reference

Common ports

Conventional ports for in-track services. Match these to ports: in config.yml, the port: field in service tabs, and the sandbox-public URL pattern.

ReferenceGrouped by purpose

Web UI / IDE

PortService
8443code-server, noVNC
7681ttyd
8080Common web app
5000Flask / FastAPI
3000Node / Next.js

Databases

PortService
5432PostgreSQL
3306MySQL / MariaDB
27017MongoDB
6379Redis
9000ClickHouse native
8123ClickHouse HTTP

Observability

PortService
9200Elasticsearch
5601Kibana
8220Fleet Server
3000Grafana
9090Prometheus
4317/4318OTel collector
16686Jaeger UI

Secrets & service mesh

PortService
8200Vault HTTP/HTTPS
443Vault dual listener
8500Consul HTTP
8501Consul HTTPS
4646Nomad
9200Boundary

Kubernetes

PortService
6443API server
8001kubectl proxy
10248kubelet healthz
30001-32767NodePort range

Streaming & AI

PortService
11434Ollama
4222NATS client
9092Kafka
5672RabbitMQ AMQP

Remote desktop

PortService
3389RDP (Guacamole target)
5901VNC server
5985WinRM (HTTP)

IAP tunnel locals

PortService
2222SSH (→ remote 22)
8888HTTP (→ remote 80)

Coordination

PortService
8081JSON broker sidecar
15779Instruqt agent (host)
Sandbox-public URLReachable from learner browser

Host’s port reachable as a public URL. The traffic proxy resolves the hostname to the named host in config.yml.

https://<host>-<port>-${_SANDBOX_ID} .env.play.instruqt.com
Convention: 8080 / 5000 / 8443 land here. Some long-running tracks use port 80 or 443 directly via <host>.${_SANDBOX_ID}.instruqt.io (no port suffix).
Internal-only portsCross-host, not public

Ports declared in ports: are reachable from other declared hosts on the sandbox network — but not from the learner’s browser unless surfaced via a service tab or sandbox-public URL.

Pattern: JSON broker sidecar on port 8081 lets one host expose structured state to others without surfacing it to the learner. Useful for cluster join tokens, provisioned tenant credentials.
Choosing a port