Zero Port Collisions: Direct IP Container Sandboxing at Scale
This post is about Autobahn Bot, which is paused for maintenance right now. What it describes is not available until it reopens. Product page
Running thousands of dynamic user applications on a single cloud host usually breaks on port exhaustion. Here is how we engineered isolated Docker bridges with direct container IP routing to scale cleanly to 65,000+ workloads.
Zero Port Collisions: Direct IP Container Sandboxing at Scale
When you provide instant, live preview applications for thousands of developers simultaneously, the traditional approach to container networking quickly hits a hard ceiling: Host Port Exhaustion.
If every user application running on https://{subdomain}.autobahn.bot binds a unique port on the host machine (e.g., 3001, 3002, 3003), you face major bottlenecks:
1. Linux ephemeral ports run out quickly under heavy concurrency.
2. Race conditions occur when spinning up and tearing down fast-lived preview containers.
3. Security risk: any port opened on 0.0.0.0 risks unauthorized ingress.
Here is how our engineering team solved this to scale cleanly to tens of thousands of isolated sandboxes on Hetzner VPS infrastructure.
The Architecture: Custom Docker Bridge & Direct IP Routing
Instead of mapping container ports to host ports, we created an isolated Docker network bridge called `sandbox-net` with a private CIDR block (172.28.0.0/16).
This private subnet provides up to 65,534 dedicated IP addresses.
When a user initiates a project session:
1. The container sandbox is spawned on sandbox-net with a dynamic internal IP (e.g., 172.28.0.42).
2. Inside the container, the application listens on its standard default port (such as 3000).
3. No host ports are bound. The host machine's port table remains completely untouched.
Nginx Dynamic Upstream Resolution
How does an external web request to https://project-alpha.autobahn.bot reach container 172.28.0.42:3000?
Our front-facing Nginx reverse proxy resolves the subdomain dynamically via an internal lookup cache and proxies directly to the container's private IP on the Docker bridge:
# Direct Container IP Routing without Host Port Binding
location / {
proxy_pass http://$target_container_ip:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
}Because Nginx and the containers share the same network interface bridge, packets route with sub-millisecond local latency.
The 6-Layer Security Boundary
Isolated networking is only half the battle. Each container sandbox is protected by a 6-layer security boundary:
- 1Namespace Isolation: Separate PID, mount, IPC, and network namespaces.
- 2Cgroups Resource Limits: Strict RAM quotas (512MB default) and CPU throttling to prevent noisy-neighbor starvation.
- 3Restricted Network Egress: Containers can only make outbound HTTP/HTTPS requests to approved registries; arbitrary TCP scans and private LAN access are blocked at iptables.
- 4Read-Only Root Filesystem: Sandboxes write only to their ephemeral
/workspacedirectory. - 5Seccomp Security Profiles: Restricting dangerous Linux syscalls.
- 6Environment Sanitization: Host secrets and cloud metadata endpoints are completely inaccessible.
Results in Production
This direct IP architecture has been running in production since early 2026. Port conflict incidents dropped to zero, container startup times dropped to under 1.8 seconds using pre-warmed base images, and developer preview stability reached 99.98%.
Autobahn Core Engineering. Ships reliable sandboxes, zero-collision containers, and edge infrastructure.
