Service

Defined intabs.hcl

The service resource provides HTTP/HTTPS proxy access to web applications running in sandbox resources such as containers and VMs. It creates browser-accessible tabs that route traffic to services within the lab environment, enabling users to interact with web applications, APIs, and dashboards.

Use Cases

As a lab author, you can use service resources to provide web access:

• Web Application Access: Expose web applications, dashboards, and user interfaces for hands-on interaction
• Development Tools: Access code editors, database admin tools (e.g. pgAdmin), monitoring dashboards (e.g. Grafana)
• Multi-Port Services: Expose different services from the same container or VM on different ports (e.g. frontend and API)

Service resources bridge the gap between isolated lab environments and user browser access, enabling realistic web application scenarios.

HCL Syntax

Basic Syntax

resource "service" "name" {
  target = resource.container.webapp
  port   = 8080
}

Full Syntax

resource "service" "name" {
  target = resource.container.webapp
  scheme = "http"
  port   = 8080
  path   = "/app"
}

Fields

Field	Type	Required	Description
target	referencecontainer, vm, k8s_cluster, kubernetes_cluster, nomad_cluster, ingress	✓	Select the container where your web application or API is running. The service tab will proxy HTTP/HTTPS requests to this container.
port	number	✓	Specify the port where your application listens for connections inside the container. ConstraintsMinimum 1; Maximum 65535
scheme	string	—	Choose whether to connect using HTTP or HTTPS. Use HTTPS if your application has TLS/SSL enabled. Allowedhttp https Defaulthttp
path	string	—	Optional. Set a default path if your application serves content from a subdirectory (e.g., /api or /dashboard). ConstraintsPath must begin with /

Examples

Basic HTTP Service

resource "service" "webapp" {
  target = resource.container.app
  port   = 3000
}

HTTPS Service with Path

resource "service" "dashboard" {
  target = resource.container.monitoring
  scheme = "https"
  port   = 3000
  path   = "/dashboard"
}

VM Service

resource "service" "vm_dashboard" {
  target = resource.vm.devbox
  port   = 8080
  path   = "/dashboard"
}

Multiple Services from One Container

resource "container" "multiservice" {
  image {
    name = "myapp:latest"
  }

  port {
    local = 8080
  }

  port {
    local = 8081
  }
}

resource "service" "app_ui" {
  target = resource.container.multiservice
  port   = 8080
}

resource "service" "app_api" {
  target = resource.container.multiservice
  port   = 8081
  path   = "/api/v1"
}

Service in Layout

resource "layout" "default" {
  column {
    width = "50"
    instructions {}
  }

  column {
    width = "50"

    tab "webapp" {
      target = resource.service.webapp
      title  = "Web Application"
    }
  }
}

Kubernetes Access Pattern

When you want a controlled browser entry point for Kubernetes API access, use a proxy container:

# Proxy container for Kubernetes dashboard
resource "container" "k8s_proxy" {
  image {
    name = "bitnami/kubectl:latest"
  }

  command = ["kubectl", "proxy", "--address=0.0.0.0", "--port=8001", "--accept-hosts=.*"]

  network {
    id = resource.network.main.meta.id
  }

  volume {
    source      = resource.kubernetes_cluster.k8s.kubeconfig_path
    destination = "/root/.kube/config"
    type        = "bind"
  }

  port {
    local = 8001
  }
}

# Service pointing to the proxy container
resource "service" "k8s_dashboard" {
  target = resource.container.k8s_proxy
  port   = 8001
  path   = "/api/v1/namespaces/kubernetes-dashboard/services/https:kubernetes-dashboard:/proxy/"
}

Best Practices

1. Use Meaningful Names: Name your service resources based on their function (e.g., webapp, api, dashboard)
2. Consistent Schemes: Use HTTPS for services when certificates are properly configured
3. Path Configuration: Use the path field to route to specific application paths
4. Port Documentation: Document which ports your services use in comments
5. Health Checks: Ensure the target resource has health checks configured for service availability

Common Issues

1. Target Type Error: “target can only be of the following types: container, vm, k8s_cluster, kubernetes_cluster, nomad_cluster, ingress”

   • Solution: Ensure you’re referencing a supported sandbox resource

2. Service Not Accessible: Service loads but shows connection errors

   • Check that the target resource is running and healthy
   • Verify the port number matches the service’s actual listening port
   • Ensure the target exposes the port in its configuration

3. HTTPS Certificate Issues: When using scheme “https”

   • The service must have valid SSL certificates configured
   • Consider using “http” for development/testing scenarios