Publish one route, not the computer behind it

The container serves a public API on hoody-exec under /api/v1. The same container also has a terminal, a files browser, and a sqlite UI.

You put an alias in front of the cryptographic URL: acme-billing-api, with target_path: "/api/v1" and allow_path_override: false. Requests to the alias reach those routes and only those, whatever else the container serves. On the container itself, the permissions document says default deny, with one group allowed http from anywhere and an operators group on JWT for everything else.

Permissions follow the container, so both the alias and the raw URL inherit them. Terminal stays a secret URL behind JWT. The API gets a name on a business card.

No gateway, no nginx location block. The public name points at a path, and the path is all it can see.

The public name points at a path, and the path is all it can see.