Get

Remote access

AirCode Ø is built to be driven from anywhere while the application, projects, terminals and agents keep running on your own machine. Never expose it unauthenticated to the public internet.

Built-in Remote Access

The desktop app and server include an outbound-only tunnel. You do not need to open a router port or configure dynamic DNS:

  1. Open Remote access from the broadcast icon in the activity bar.
  2. Open Settings and select AirCode relay.
  3. Return to Remote access and enable the tunnel.
  4. Open the generated HTTPS URL, or scan the QR code to add it on your phone.

Your AirCode password still protects the server. The relay only routes traffic; the application and sessions remain on the host machine. The tunnel refuses to start if no password is configured.

Tailscale or your own VPN

For peer-to-peer access without the AirCode relay, open Remote access → Settings and select Private network only. AirCode then opens no public tunnel.

Install Tailscale on the server and your devices. AirCode detects and binds the tailnet IP automatically; open http://<tailnet-ip>:7860 from another device. tailscale serve can add HTTPS with a real certificate:

sudo tailscale serve --bg "http://$(tailscale ip -4):7860"

The first run may print an admin-console link to enable Serve/HTTPS on your tailnet (a one-time, one-click switch).

WireGuard, ZeroTier or an SSH tunnel (ssh -L 7860:localhost:7860 server) work the same way.

Custom relay

Organizations can run the compatible Caddy + FRP relay from the AirCode source tree. Select Custom relay in Remote access settings and enter its HTTPS origin, for example https://relay.example.com.

The desktop and mobile apps

Add a connection with the server URL + password. Connections are stored in the OS keychain. The desktop app shows the active server in the bottom-left status indicator — click it to switch or add servers (local or remote).

Firewalls

The built-in tunnel requires no inbound port. It makes outbound connections to the relay over HTTPS and FRP. Private-network mode opens no additional connection; your VPN determines reachability.

For a Docker sandbox session, this route still ends at the host AirCode control plane. Terminal traffic then crosses the Docker API to the worker. The tunnel does not automatically carry worker egress and does not publish development ports from the container.