Skip to main content

​
Public IP

Every VM gets a dedicated public IPv4. Shown in machine0 get and machine0 ls. Suspended VMs get a new IP on resume.

​
HTTPS proxy

Every VM gets authenticated HTTPS at https://<name>.mac0.io, proxying to port 80. No DNS or TLS setup. Renaming a VM updates the endpoint. Only you can reach your VM through the proxy — requests are authenticated against your account before they reach the machine. A few behaviors are worth knowing:
  • Embedding is restricted to machine0. Proxied pages can be framed only by the machine0 dashboard (the machine panel’s Web tab) and by the page itself. Any X-Frame-Options or CSP frame-ancestors your app sets is overridden, and other sites embedding your <name>.mac0.io URLs in an iframe are blocked by the browser.
  • Apps with their own login may not work embedded. Inside the dashboard’s Web tab the proxied site is a cross-site frame, so a VM app that sets its own session cookie can’t always complete sign-in there. Use the toolbar’s open in a new tab link for the full-fidelity view.
  • WebSockets are not proxied. wss://<name>.mac0.io connections (dev-server hot reload, notebooks, terminals) don’t pass through the proxy — open the app in a new tab or use machine0 ssh with port forwarding.
  • Cross-origin writes need header auth. Browser requests that change state (POST/PUT/etc.) from a different origin are rejected; use an API key or Authorization header for machine-to-machine calls.
  • __proxy_token and __proxy_cookie_check are reserved query parameters used by the sign-in flow and are stripped before the request reaches your VM.
  • Responses are not edge-cached. The proxy marks every response no-store so your authenticated content is never served from a shared cache.

​
Firewall

All VMs run ufw with ports 22, 80, and 443 open. To open more: