Box to box

Boxes are closed to each other by default. To let an app box use a database box, link them:

kvbox new db --near api                  # on the same host as api
kvbox vm link api db --port 5432         # api may reach db's port 5432

Inside api, the database is db.kvbox:5432:

kvbox exec api -- psql -h db.kvbox -U postgres

NamesCopy Anchor Link

Every box resolves <name>.kvbox to the box of that name with the same owner, on the same host. An org's box of another slug is <name>.<slug>.kvbox, and resolves only once it is linked to you. A name is not access: without a link the connection is refused.

Names work in boxes made from base image v0.11.0 or later.

LinksCopy Anchor Link

kvbox vm link api db --port 5432         # one port per link; link again for another
kvbox vm links                           # every link: from, box, port
kvbox vm links db --json                 # [{from, box, port}]
kvbox vm unlink api db --port 5432 -y    # open connections close too

• A link is one way: api reaches db, db does not reach api. TCP only.
• Nothing is published. The internet and other boxes still can't reach db.
• db sees api's own address, so database access rules can name it.
• The two boxes must be on the same host. If they aren't, link says so; make the new box with --near.
• On a self-hosted server, a box made with --local and a box made through a control plane can't be linked.
• With --org acme, the box being reached is acme's: kvbox vm link api db --org acme --port 5432.
• A box other boxes link to never hibernates on its own: a connection would not wake it.
• Removing either box removes its links.