Reaching a port inside Linux

msl forward <instance> 8080:3000
msl forward <instance> list
msl unforward 8080

localhost:8080 on your Mac then reaches port 3000 inside the instance — so a development server in Linux opens in a Mac browser. One number means the same port both sides.

The port is bound to your Mac only. Nothing else on the network can see it.

Two routes, and why you may need the second#

Most development servers bind 127.0.0.1 by default — Flask, Vite, Rails and manage.py runserver all do — and nothing outside the guest can reach a loopback socket. So if the default route connects to nothing, add --ssh: it goes through the instance's own SSH server, which makes the connection from inside.

MSL checks when you set one up and tells you which to use rather than leaving you with a connection that resets.

They come back#

A forward is remembered and restored when the instance next starts. list shows which are live and which are waiting:

localhost:8080  ->  work:3000
localhost:9000  ->  work:5432 through SSH  (not running - starts with the instance)

What it will not do#

• A forward does not keep an instance awake. An idle instance still suspends, and the listener is taken down with it so a request is refused at once rather than hanging. It comes back when the instance does.
• It is refused while the instance is sandboxed. A forwarded port is a hole in exactly the box those gates draw — see The four gates.
• Ports below 1024 are reserved by macOS and MSL cannot bind them.