Home / SSH tunnel Docker API

How to SSH tunnel a localhost Docker API from your Mac

If a Docker service on your VPS listens only on 127.0.0.1 (good), your Mac cannot reach it directly. An SSH local port forward gives you a private pipe — without publishing the API to the open internet.

When you need this

• Browser automation or API containers bound to 127.0.0.1:3000 (or similar).
• You develop on a Mac and the container runs on a cheap VPS.
• You refuse to open 0.0.0.0:3000 on the public IP.

Safe checklist

1. Confirm the service listens on loopback only: ss -lntp | grep 3000 should show 127.0.0.1.
2. From your Mac, open a tunnel (example ports):

   ssh -N -L 3000:127.0.0.1:3000 -L 9223:127.0.0.1:9223 root@YOUR_VPS_IP

3. Keep the SSH session open while you work (or use autossh / a launch agent).
4. On the Mac, call http://127.0.0.1:3000 — traffic rides inside SSH.
5. Do not change Docker publish to 0.0.0.0 “just to test”.

Minimal verification

curl -sS -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/

Expect a non-connection-refused response while the tunnel is up.

Common mistakes

• Publishing CDP/API ports on the public interface.
• Using -R (remote forward) when you meant -L (local forward).
• Forgetting the tunnel dies when the laptop sleeps — reconnect before debugging “API down”.

Why this page is a “新词” MWE

The cluster is narrow (SSH + localhost + Docker API + Mac), answerable in one article, and commercially adjacent (VPS, tools). Real “新站新词” playbooks then multiply such pages, earn organic visits, and sell attention via ads or affiliates — ranking and payouts are not automatic from publishing alone.