My command is such

docker run -it --rm --pull=always \
  -e SANDBOX_CONTAINER_URL_PATTERN="<http://10.100.3.70>:{port}" \
  -e OH_WEB_URL="<http://10.100.3.70:3000>" \
  -e AGENT_SERVER_IMAGE_REPOSITORY=<http://ghcr.io/openhands/agent-server|ghcr.io/openhands/agent-server> \
  -e AGENT_SERVER_IMAGE_TAG=1.10.0-python \
  -e LOG_ALL_EVENTS=true \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/.openhands:/.openhands \
  -p 3000:3000 \
  --network host \
  --add-host host.docker.internal:host-gateway \
  --name openhands-app \
  docker.openhands.dev/openhands/openhands:main

I opened all the inbound ports on EC2.

I am able to use the openhands-app on port 3000 and start conversations (docker runtime spins up) and able to converse with the LLM and produce artifacts inside the runtime. But I am not able to view the served files or apps eg

python3 -m http.server 8080 --bind 0.0.0.0

You can't pick just any port # and it needs to be listening on either port 8011 or 8012 instead of 8080. Once this PR is merged, you can ask OH to start the app for you and select an "externally visible port" and it will pick correct one for you: https://github.com/OpenHands/docs/pull/286. In mean time, you must tell it what port to us. If you remove the

--network host

option, it will no longer by hard code externally to fixed ports 8011 and 8012. Instead it picks dynamic port # per conversation (so you are then allowed to have multiple conversations at once) although your app must still pick either 8011 or 8012 inside container. To find what the dynamic ports make the app visible, in the conversation go to Tools then View Available Skills and then "work_host" skill. It will tell you what URL to connect to. If you want to view your app in the App tab within OH conversation, the app must enable CORS support as well as pick port 8011.