Hi, I want to access my self-hosted OpenHands instance remotely through my domain using Cloudflare Tunnel + Cloudflare Access Policy. The main OpenHands page is published through Cloudflare, but with my current setup OpenHands seems unable to properly connect to its sandbox when accessed externally. So the issue is basically: • OpenHands is running in Docker • I access it through my domain via Cloudflare Tunnel • Access Policy is enabled • but OpenHands / the browser cannot properly connect to the sandbox when used remotely My question is: What is the correct way to run OpenHands behind Cloudflare Tunnel so that remote access works including sandbox connectivity? These are the environment variables I currently use in Portainer:

text
SANDBOX_RUNTIME_CONTAINER_IMAGE=<http://ghcr.io/openhands/runtime:1.7|ghcr.io/openhands/runtime:1.7>
SANDBOX_VSCODE_PORT=41234
SANDBOX_KEEP_RUNTIME=false
LOG_ALL_EVENTS=true

I also tested additional variables like these, but they did not solve the problem and sometimes even caused a general network error in the UI:

text
SANDBOX_RUNTIME_BINDING_ADDRESS=0.0.0.0
SANDBOX_CONTAINER_URL_PATTERN=<https://sandbox.example.com>
WEB_HOST=<http://openhands.example.com|openhands.example.com>
OH_WEB_URL=<https://openhands.example.com>

I also noticed frontend-related defaults like:

text
VITE_BACKEND_BASE_URL=localhost:3000
VITE_BACKEND_HOST=127.0.0.1:3000

So now I am unsure what the correct setup is. My goal is very simple: • access OpenHands from outside through my domain • keep Cloudflare Tunnel + Access Policy in front of it • make sure OpenHands can still communicate with its sandbox correctly What environment variables / network setup / reverse proxy setup are required for this to work properly? If anyone has a working example for OpenHands behind Cloudflare Tunnel, that would help a lot.

Hi Julian! We're actually working on first-class support for self-hosting OpenHands on a remote VM This is actually a new project, called "Agent Canvas", which is in beta now We've documented how to self host here: https://docs.openhands.dev/openhands/usage/agent-canvas/backend-setup/vm

Thanks for the answer Robert. What is the difference between the OpenHands I have self hosted right now and this Agent Canvas?

What you have now is "Local GUI", which (eventually) will be deprecated in favor of Agent Canvas