# Public ports Start something listening in the container, then publish that port from the workspace's Network tab. ## What publishing does Inside the container Something you started is listening on a port, bound to `0.0.0.0`. A service bound only to `127.0.0.1` cannot be published. Publish Public https:// \* .zerolog.ch \* is name-account: your account name is part of the hostname The URL works immediately, certificate included. Because your account name sits in the hostname, nobody can squat yours. ## How many you get How many ports you may publish is set by your [plan](https://zerolog.ch/docs/plans): Free none, Mini 1, Pro 1, Max 2, Ultra 8. If the limit is used up, withdraw a port first. A withdrawn address stops working at once. ## The first publish The first publish can need one rebuild of the workspace. The panel names the running sessions that will end and asks before it restarts. ## Anything published is public. Put authentication in front of anything that should not be. ## From a listening service to a public URL Mermaid source of the diagram on this page: ```mermaid %% Public ports: from a listening service to a public URL. Facts from server/ingress.js (publish, hostnameFor), server/tiers.js (public_ports), web/apps/web/components/containers/ports-panel.tsx. flowchart TB a["1. A service in your workspace
listens on 0.0.0.0
not only on 127.0.0.1"] b["2. Network tab
the panel lists what
is listening now"] c["3. Pick a name and the port
and publish"] q["Quota used up:
withdraw a port first"] r["First publish can need one
rebuild of the workspace
running sessions end"] url["4. Public HTTPS URL
name-account.zerolog.ch
certificate included
open to anyone who has it"]:::hot w["Withdraw
the address stops
working at once"] a --> b --> c c -->|over your plan's limit| q c --> r c --> url url --> w classDef hot stroke:#8f7ac9 ```