Repository navigation
feat: add forward subcommand to reach guest ports from the host - #6
Merged
Merged
Conversation
Lima's automatic port forwarding is switched off so nothing in the guest reaches the host on its own, which also left no way to open a dev server or mockup running in the VM in a host browser. `code-vm forward PORT|HOST_PORT:GUEST_PORT...` opens an SSH tunnel over the instance's Lima ssh config for as long as it runs. The host side always binds 127.0.0.1, so the guest is never exposed to the host's network, and nothing is persisted: the default stays closed. The VM must already be running; forward does not boot it. ExitOnForwardFailure turns a busy host port into an error. Interrupt and terminate signals are relayed to ssh, since a signal sent to code-vm alone (a script stopping a background forward) would otherwise leave the tunnel open.
There was a problem hiding this comment.
🟡 Changes recommended
Binding and cleanup assertions can silently pass when socket inspection fails, including on default macOS installations.
1 open issue
What changed in this PR
Adds explicit, temporary SSH forwarding so host applications can reach guest servers while automatic forwarding remains disabled.
Changes:
- Adds loopback-only forwarding with port validation and signal handling.
- Retrieves Lima SSH connection details without starting the VM.
- Documents usage and adds unit and integration tests.
| File | Description |
|---|---|
| test-vm-sandbox.sh | Tests reachability, binding, and cleanup. |
| README.md | Documents explicit port forwarding. |
| internal/lima/limactl.go | Exposes SSH configuration and host alias. |
| internal/cli/root.go | Registers the forward command. |
| internal/cli/forward.go | Implements validation and tunnel lifecycle. |
| internal/cli/forward_test.go | Tests arguments, VM state, and termination. |
Review effort: Balanced
The listener checks piped `ss` straight into grep, so a missing `ss` (macOS has no iproute2) read as "nothing is listening" and the loopback and cleanup guarantees passed without being verified. A helper now lists listeners with `ss` on Linux or `lsof` on macOS and fails the check when neither runs.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Lima's automatic port forwarding is switched off so nothing in the guest reaches the host on its own, which also left no way to open a dev server or mockup running in the VM in a host browser.
code-vm forward PORT|HOST_PORT:GUEST_PORT...opens an SSH tunnel over the instance's Lima ssh config for as long as it runs. The host side always binds 127.0.0.1, so the guest is never exposed to the host's network, and nothing is persisted: the default stays closed. The VM must already be running; forward does not boot it.ExitOnForwardFailure turns a busy host port into an error. Interrupt and terminate signals are relayed to ssh, since a signal sent to code-vm alone (a script stopping a background forward) would otherwise leave the tunnel open.