Common ports — REF 12

Reference Grouped by purpose

Web UI / IDE

Port	Service
`8443`	code-server, noVNC
`7681`	ttyd
`8080`	Common web app
`5000`	Flask / FastAPI
`3000`	Node / Next.js

Databases

Port	Service
`5432`	PostgreSQL
`3306`	MySQL / MariaDB
`27017`	MongoDB
`6379`	Redis
`9000`	ClickHouse native
`8123`	ClickHouse HTTP

Observability

Port	Service
`9200`	Elasticsearch
`5601`	Kibana
`8220`	Fleet Server
`3000`	Grafana
`9090`	Prometheus
`4317/4318`	OTel collector
`16686`	Jaeger UI

Secrets & service mesh

Port	Service
`8200`	Vault HTTP/HTTPS
`443`	Vault dual listener
`8500`	Consul HTTP
`8501`	Consul HTTPS
`4646`	Nomad
`9200`	Boundary

Kubernetes

Port	Service
`6443`	API server
`8001`	kubectl proxy
`10248`	kubelet healthz
`30001-32767`	NodePort range

Streaming & AI

Port	Service
`11434`	Ollama
`4222`	NATS client
`9092`	Kafka
`5672`	RabbitMQ AMQP

Remote desktop

Port	Service
`3389`	RDP (Guacamole target)
`5901`	VNC server
`5985`	WinRM (HTTP)

IAP tunnel locals

Port	Service
`2222`	SSH (→ remote 22)
`8888`	HTTP (→ remote 80)

Coordination

Port	Service
`8081`	JSON broker sidecar
`15779`	Instruqt agent (host)

Sandbox-public URL Reachable from learner browser

Host's port reachable as a public URL. The traffic proxy resolves the hostname to the named host in config.yml.

https://<host>-<port>-${_SANDBOX_ID} .env.play.instruqt.com

Convention: 8080 / 5000 / 8443 land here. Some long-running tracks use port 80 or 443 directly via <host>.${_SANDBOX_ID}.instruqt.io (no port suffix).

Internal-only ports Cross-host, not public

Ports declared in ports: are reachable from other declared hosts on the sandbox network — but not from the learner's browser unless surfaced via a service tab or sandbox-public URL.

Pattern: JSON broker sidecar on port 8081 lets one host expose structured state to others without surfacing it to the learner. Useful for cluster join tokens, provisioned tenant credentials.