Run the tunn client in Docker

The client image candidate supports Linux Intel/AMD and ARM. Publication and anonymous pulling must be verified before using a registry tag. For a locally built image, set TUNN_IMAGE=tunn-client:local.

Sign in once

docker run --rm -it -v tunn-client-home:/home/tunn "$TUNN_IMAGE" login

Follow the printed browser link. Keep the named volume private; it stores the container's login credentials.

Expose host port 8080 on Linux

docker run --rm --init --network host -v tunn-client-home:/home/tunn "$TUNN_IMAGE" http 8080

The application must be running. The tunnel is private by default. Add --allow=friend@example.com for selected browser access. Add --public only when public access is intended.

On Docker Desktop, omit --network host and use http://host.docker.internal:8080 as the target. Container localhost is separate from your laptop. No inbound port publishing is needed.

See the Docker build, publication and network guide for immutable registry tags and details. The image has no shell or Node/Python runtime for stdio MCP subprocesses.