In Short

  • Problem: expose a small local service quickly enough to verify it from elsewhere, without turning a test into durable infrastructure.
  • What I tested: Cloudflare Quick Tunnel, Tailscale Funnel, and Cloudflare Named Tunnel against the same disposable HTTP app, then a phone retest on Quick Tunnel.
  • Result: Quick Tunnel and Funnel returned 200. The Named Tunnel returned HTTPS 200 only after moving to a hostname covered by the Cloudflare certificate. A later Quick Tunnel run also received a positive phone check.
  • Lesson: the test proves limited HTTP/HTTPS routing, not a general recommendation for Project Pezzos.
  • Linked repo: pezzos/container-exposure-lab.

Why I Keep This Test

The case that interests me is not just “put a service online”. It is more specific: an agent or a Codex session produces a small local service, often in a container, and I need to verify it from a phone, another network, or temporarily share it with someone.

That is a common lab situation. It is also exactly the kind of situation where it is easy to over-generalize from a quick success.

There is already a known home setup with a Freebox route toward a NAS, Docker, and Traefik. The problem is less clean when the service runs on a Mac, on a client network, or while traveling. The local IP changes, the public IP changes, and the need stays the same: get a testable URL without turning a trial into durable infrastructure.

So I kept the test small. One disposable app. A few exposure paths. Clear start and stop conditions. No claim that the result should become production hosting.

What Worked

Cloudflare Quick Tunnel was fast to launch and useful for a short human validation. It gave me an HTTPS URL without building a permanent deployment path.

Tailscale Funnel also proved useful in the limited case I tested. It made the local app reachable and returned the expected HTTP status.

Cloudflare Named Tunnel required a bit more care. The interesting part was the hostname: the route only became clean once it used a name covered by the Cloudflare certificate.

That was the most useful detail. The deeper hostname container-exposure-lab.labs.projectpezzos.com routed over HTTP, but HTTPS failed at the TLS handshake. Moving to container-exposure-lab.projectpezzos.com made the same kind of test return HTTPS 200 with a valid TLS check.

What This Does Not Prove

This test does not choose the best long-term architecture. It does not compare cost, security posture, rate limits, operational ownership, or resilience.

It also does not mean every local service should be exposed. A lab needs a teardown plan, explicit data boundaries, and a reason to be reachable from outside the machine.

It does not prove behavior after Mac sleep, Wi-Fi changes, long runs, colleague access, Cloudflare Access, or a final choice between Funnel, Cloudflare Tunnel, and managed hosting. The phone check was positive, but the article does not preserve enough detail to turn it into a broad mobile validation claim.

What I Would Reuse

I would reuse the method:

  • validate locally first;
  • expose with the smallest temporary surface;
  • verify from the target device or network;
  • record the URL, status code, and limitation;
  • close the exposure path when the test is done.

That is the useful part. The result is less a recommendation for a specific tunnel than a reminder to keep exposure tests bounded.

The linked repo contains the disposable Node HTTP app, Docker files, validation scripts, and RESULTATS.md with commands, URLs, validation results, failures, and teardown. It is there to reproduce the lab base and keep factual evidence separate from this note. It is not a template for exposing real services with sensitive data, choosing durable hosting, or proving network behavior outside the tested session.

The rule I keep is to separate three uses that look too similar on paper: private access from my own devices, temporary public preview, and colleague review with some form of authentication. They do not have the same DNS, auth, logging, teardown, or risk profile.