The customer's database stays in their building; you get a door they hold open

A developer pulls their laptop's Postgres into a container so the loopback gets longer. A hospital's IT team runs the same PULL binding, in the other direction of trust.

Your product runs in their container on Hoody. Their database stays on their premises, behind their firewall, no inbound port opened. Their side runs the tunnel client with a token scoped to that container's tunnel service, and the PULL puts their 5432 on 127.0.0.1:5432 inside your container. Your app connects to localhost and reaches a database whose network it will never be on.

They are the client on the WebSocket, not the server. Close it and your access is gone after a 60-second grace. GET /api/v1/tunnel/sessions shows exactly one session, theirs.

The developer's tunnel is a convenience. The customer's tunnel is a kill switch they never have to ask you to honor.