Remote access
AirCode Ø is built to be driven from anywhere while the application, projects, terminals and agents keep running on your own machine. Never expose it unauthenticated to the public internet.
Built-in Remote Access
The desktop app and server include an outbound-only tunnel. You do not need to open a router port or configure dynamic DNS:
- Open Remote access from the broadcast icon in the activity bar.
- Open Settings and select AirCode Ø relay.
- Return to Remote access and enable the tunnel.
- Open the generated HTTPS URL, or scan the QR code to add it on your phone.
Your AirCode Ø password still protects the server, and the application, projects and sessions remain on the host machine. The tunnel refuses to start if no password is configured.
Managed-relay trust boundary
The current managed relay terminates TLS before forwarding authenticated traffic to your AirCode Ø host. Relay operators can therefore technically access traffic while it passes through the relay, even though application and session data are not stored there as part of the normal service. End-to-end encryption that prevents relay inspection is not yet available.
Use Private network only with Tailscale or another VPN, or operate a custom relay, when that trust boundary does not meet your requirements.
Fast preview and Shared browser
The Browser screen offers two different transports:
- Fast preview is the default for a localhost development URL. The page, assets, live reload and HMR WebSockets render directly on the viewing device; Chromium does not run on the server. With Remote Access enabled, AirCode Ø creates a revocable preview origin through the relay. Opening it once exchanges the access link for an HttpOnly cookie. You can add a per-preview password as a second layer; the private link is still required, the password is stored only as a local hash, and failed attempts are rate-limited.
- Shared browser runs Chromium on the server and streams the same interactive session to people and agents. Choose it when an agent needs browser control, diagnostics, screenshots or traces.
Closing a Fast preview revokes its relay origin. Preview links are access capabilities even when a password is enabled: do not publish them.
Tailscale or your own VPN
For peer-to-peer access without the AirCode Ø relay, open Remote access → Settings and select Private network only. AirCode Ø then opens no public tunnel.
Install Tailscale on the server and your devices.
AirCode Ø detects and binds the tailnet IP automatically; open
http://<tailnet-ip>:7860 from another device. tailscale serve can add HTTPS
with a real certificate:
sudo tailscale serve --bg "http://$(tailscale ip -4):7860"
The first run may print an admin-console link to enable Serve/HTTPS on your tailnet (a one-time, one-click switch).
WireGuard, ZeroTier or an SSH tunnel (ssh -L 7860:localhost:7860 server) work
the same way.
Custom relay
Organizations can run the compatible Caddy + FRP relay from the AirCode Ø source
tree. Select Custom relay in Remote access settings and enter its HTTPS
origin, for example https://relay.example.com.
The desktop and mobile apps
Add a connection with the server URL + password. Connections are stored in the OS keychain. The desktop app shows the active server in the bottom-left status indicator — click it to switch or add servers (local or remote).
Firewalls
The built-in tunnel requires no inbound port. It makes outbound connections to the relay over HTTPS and FRP. Private-network mode opens no additional connection; your VPN determines reachability. Fast previews use authenticated ephemeral ports on the same interface as the AirCode Ø server, so a restrictive host firewall must allow traffic from the private network to those ports.
For a Docker sandbox session, this route still ends at the host AirCode Ø control plane. Terminal traffic then crosses the Docker API to the worker. The tunnel does not automatically carry worker egress and does not publish development ports from the container.