Reach a database that never opened a port

The client's Postgres lives behind their firewall, and their security team will not open a port for your BI tool. They don't have to. On your container, DBeaver runs on a display; beside it, hoody pipe forward-tcp a b --listen 127.0.0.1:15432. Inside the client's network, someone runs the mirror command: hoody pipe forward-tcp b a --connect 127.0.0.1:5432. Outbound HTTPS from their side, nothing inbound.

DBeaver connects to localhost:15432 and is talking to their database. Two pipe paths carry the TCP session in both directions; the private side only ever dialed out.

This conversation normally ends in a VPN, a bastion host, and a meeting with their IT. Now it ends in one command they run and a tunnel shaped like two URLs.

The database never opened a port; the pipe dialed out.