A way to make a service port only be reachable via balena device tunnel

Feature Requests
,
1

We have a service running a HTTP server that is only used for internal debugging. It should not be reachable from LAN or internet, only by creating a tunnel with balena-cli to the port. I think this is a common scenario, and should be supported.

My idea was to create a port mapping like this in docker-compose.yml:

  • "127.0.0.1:8080:8080”
    This would limit the port to be opened from localhost.
    Unfortunately this does not work with “balena device tunnel” command. I guess the tunnel command does not use the loopback interface.

Is there a way to accomplish this? Or are there plans to support creating tunnels into services?

Thank you!