Expose an HTTP Service

Step-by-step guide to expose HTTP services with automatic HTTPS

This guide shows you how to expose HTTP services from your Docker containers to the public internet with automatic HTTPS.

Prerequisites

• A Phala Cloud account
• A Docker image that runs an HTTP service

Step 1: Define Your Service

Create a docker-compose.yml file with port mapping:

services:
  api:
    image: your-image:latest
    ports:
      - "8080:3000"  # Maps container port 3000 to public port 8080

The format is "HOST_PORT:CONTAINER_PORT", following standard Docker behavior:

• HOST_PORT: The port number that appears in your public URL
• CONTAINER_PORT: The port your application listens on inside the container

Step 2: Deploy Your Service

1. Open the Phala Cloud Dashboard
2. Click “Create CVM”
3. Select “docker-compose.yml” deployment method
4. Paste your configuration
5. Add any secure environment variables if needed
6. Click “Deploy”

Step 3: Access Your Endpoint

After deployment completes, find your endpoint in the Network tab:

https://<app-id>-8080.dstack-prod5.phala.network

Click the link to test your service. The connection is automatically secured with TLS.

Multiple Ports Per Service

A single service can expose any number of ports, just like in Docker:

services:
  app:
    image: my-app:latest
    ports:
      - "3000:3000"  # Web interface
      - "8080:8080"  # API endpoint
      - "9090:9090"  # Metrics endpoint
      - "4000:4000"  # WebSocket server

This creates four public endpoints for the same service:

• https://<app-id>-3000.dstack-prod5.phala.network
• https://<app-id>-8080.dstack-prod5.phala.network
• https://<app-id>-9090.dstack-prod5.phala.network
• https://<app-id>-4000.dstack-prod5.phala.network

Multiple Services Example

You can also deploy multiple services, each with their own ports:

services:
  frontend:
    image: my-frontend:latest
    ports:
      - "3000:3000"  # Frontend on port 3000
  
  api:
    image: my-api:latest
    ports:
      - "8080:8080"  # API on port 8080
      - "8081:8081"  # API admin on port 8081
    environment:
      DATABASE_URL: ${DATABASE_URL}
  
  admin:
    image: my-admin:latest
    ports:
      - "9000:9000"  # Admin panel on port 9000

Health Checks

Add health checks to ensure your service is ready before receiving traffic:

services:
  api:
    image: your-image:latest
    ports:
      - "8080:3000"
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:3000/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

Internal Communication

Services within the same deployment can communicate using service names:

services:
  frontend:
    image: my-frontend:latest
    ports:
      - "3000:3000"
    environment:
      API_URL: http://api:8080  # Internal communication
  
  api:
    image: my-api:latest
    ports:
      - "8080:8080"

The frontend can reach the API at http://api:8080 internally, while external users access it at https://<app-id>-8080.dstack-prod5.phala.network.

Zero-Trust Security

All traffic follows zero-trust principles:

• External traffic arrives encrypted via TLS at the gateway
• The gateway forwards it through WireGuard tunnels to your CVM
• Only your code inside the TEE can decrypt and see the traffic
• Not even Phala Cloud operators or you as the developer can inspect the traffic
• The hardware-based isolation ensures complete privacy

This means your application handles sensitive data with true confidentiality. Credit cards, API keys, personal information - all remain private to your code alone.

Security Notes

• All external traffic is encrypted with TLS
• Internal service-to-service communication uses the Docker network
• Don’t expose ports you don’t need public access to
• Use secure environment variables for sensitive data

Next Steps

• Set up a custom domain
• Add gRPC support
• Learn about security features