> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siftd.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloudflare Tunnels + SPIN Runtime

## Using Cloudflare Tunnels to access your SPIN Runtime

[Cloudflare Tunnels](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/) is a service that allows you to make your SPIN runtime accessible from the internet while still allowing it to run behind a firewall.

### Quick Tunnels

For trial and testing purposes, you can use [quick tunnels](https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/), which allow you to create a tunnel without signing up with Cloudflare.

#### Docker Compose Example

```yaml theme={null}
services:
  cloudflare-tunnel:
    image: cloudflare/cloudflared:2025.8.0
    restart: unless-stopped
    command: tunnel --url http://spin-runtime:8888/
  spin-runtime:
    image: ghcr.io/siftd/spin-runtime:latest
    environment:
      - SPIN_TOKEN=<SPIN_TOKEN>
    volumes:
      - ${PWD}/runtime-data:/opt/spin/var
    restart: unless-stopped
```

Replace `<SPIN_TOKEN>` with the token you receive in the SPIN UI when creating a new runtime.

Then run the containers by running:

```bash theme={null}
docker compose up -d
```

#### Getting the Runtime URL

To obtain the runtime URL, view the logs of the cloudflare-tunnel container:

```bash theme={null}
docker compose logs cloudflare-tunnel
```

This will output something like:

```
cloudflare-tunnel-1  | 2025-08-12T05:52:14Z INF +--------------------------------------------------------------------------------------------+
cloudflare-tunnel-1  | 2025-08-12T05:52:14Z INF |  Your quick Tunnel has been created! Visit it at (it may take some time to be reachable):  |
cloudflare-tunnel-1  | 2025-08-12T05:52:14Z INF |  https://toronto-foul-enlargement-gothic.trycloudflare.com                                 |
cloudflare-tunnel-1  | 2025-08-12T05:52:14Z INF +--------------------------------------------------------------------------------------------+
```

Grab the URL (`https://toronto-foul-enlargement-gothic.trycloudflare.com` in the example above) and paste it in the SPIN UI runtime URL field.

#### Quick Tunnel Limitations

* The URL will change on every restart (this requires you to update the runtime config in the SPIN UI)
* No uptime guarantees by Cloudflare
* Best suited for testing before setting up a permanent tunnel

Quick tunnels are ideal for getting something up and running quickly for testing, before investing time and resources (a DNS domain on Cloudflare is required for regular tunnels) to set up a permanent tunnel.

### Permanent Tunnels

For production use, you should set up a permanent tunnel.

Prerequisites:

* A Cloudflare account
* A DNS domain on Cloudflare

Steps:

1. Configure tunnel in the Cloudflare dashboard
2. Run spin-runtime with cloudflared sidecar in docker

#### Configure Cloudflare Tunnel

First, head over to your Cloudflare dashboard, then navigate to **Zero Trust** -> **Networks** -> **Tunnels**.

<img src="https://mintcdn.com/siftd/82Qp2p6SHTjFNPWd/images/cf_tunnels_01.png?fit=max&auto=format&n=82Qp2p6SHTjFNPWd&q=85&s=d1334d4e26b7166a580c5a603620f6a1" alt="Create Tunnel in Cloudflare dashboard" width="2696" height="1886" data-path="images/cf_tunnels_01.png" />

Next, provide a name for your tunnel and click **Create tunnel**.

<img src="https://mintcdn.com/siftd/82Qp2p6SHTjFNPWd/images/cf_tunnels_02.png?fit=max&auto=format&n=82Qp2p6SHTjFNPWd&q=85&s=03d2a7821dcd9a40bde31bc4753e18ad" alt="Provide a name for your tunnel" width="2696" height="1886" data-path="images/cf_tunnels_02.png" />

In the next step, all we need is the **Tunnel token**. Copy the docker command and grab the token (which is everything after the `--token` flag).
We'll use this token in the next step when we configure the SPIN runtime in docker compose.

<img src="https://mintcdn.com/siftd/82Qp2p6SHTjFNPWd/images/cf_tunnels_03.png?fit=max&auto=format&n=82Qp2p6SHTjFNPWd&q=85&s=85c0577f889f399f48f1c16cf6bd50e9" alt="Copy the tunnel token" width="2696" height="1886" data-path="images/cf_tunnels_03.png" />

Lastly, we'll configure the route for the tunnel. You'll have to provide:

* `A`: A hostname for the tunnel
* `B`: Select a DNS domain you own on Cloudflare
* `C`: The service URL: `http://spin-runtime:8888/`

<img src="https://mintcdn.com/siftd/82Qp2p6SHTjFNPWd/images/cf_tunnels_04.png?fit=max&auto=format&n=82Qp2p6SHTjFNPWd&q=85&s=10d6afdcdc892faf548352739222d891" alt="Copy the tunnel token" width="2696" height="1886" data-path="images/cf_tunnels_04.png" />

The tunnel will be reachable at `https://<hostname>.<domain>`.
In the example above, the tunnel will be reachable at `https://mytunnel.spintun.net`.
This is the value we'll provide when configuring the runtime in the SPIN UI.

#### Run SPIN Runtime with Cloudflare Tunnel

```yaml theme={null}
---
version: "3.7"
services:
  cloudflare-tunnel:
    image: cloudflare/cloudflared:2025.8.0
    restart: unless-stopped
    command: tunnel run --token <CLOUDFLARE_TUNNEL_TOKEN>
  spin-runtime:
    image: ghcr.io/siftd/spin-runtime:latest
    environment:
      - SPIN_TOKEN=<SPIN_TOKEN>
    volumes:
      - ${PWD}/runtime-data:/opt/spin/var
    restart: unless-stopped
```

Replace `<SPIN_TOKEN>` with the token you receive in the SPIN UI when creating a new runtime and replace `<CLOUDFLARE_TUNNEL_TOKEN>` with the token you copied in the previous step.

Then run the containers by running:

```bash theme={null}
docker compose up -d
```