Skip to content
NEWTry Pilot Cloud
Install Pilot

Where pilot-daemon runs. Pick the right mode.

One daemon, two transports. UDP gives direct peer paths and the lowest latency. Compat tunnels everything through a single outbound TCP/443, through an HTTPS proxy if that is the only way out. With nothing configured, pilotctl daemon start uses auto: UDP when the beacon answers over UDP, otherwise compat.
Read the docsLatest release

Two modes

UDP for direct paths. Compat for everything else.

Auto mode probes the beacon over UDP and picks for you. Here is what it picks on three kinds of network.
UDP mode
Flag
-transport=udp
Status
Default
Path
Direct, RTT-bound
Ports
Outbound UDP/4000 (inbound too for a public node)
Proxy
—
Trust
Same overlay, same Ed25519 trust
Compat mode
Flag
-transport=compat
Status
Since v1.10.3
Path
+1 hop via the beacon
Ports
One outbound TCP/443
Proxy
Through HTTPS_PROXY since v1.13.11
Trust
Same overlay, same Ed25519 trust

Per-platform

Where it runs. What flag to set.

18 of 34 run on plain UDP. 8 more need compat.

Container hosting / PaaS

Deploy as a Dockerfile or buildpack. UDP availability varies; when in doubt, ship in compat mode.

  • RendercompatUDP blocked. Single TCP/443 works as of v1.10.3.
  • RailwayudpDefault-allow egress on both protocols.
  • Fly.io MachinescompatUDP needs dedicated IPv4; even then app-level egress is flaky.
  • HerokucompatApp-UDP undocumented; daemon re-registers fine across the ~24h dyno cycle.
  • DigitalOcean App PlatformcompatSafer default; can’t open SSH/SMTP ports.
  • NorthflankudpUDP + TCP both first-class.
  • Coolify / CapRoverudpSelf-hosted; inherits host firewall. Open UDP/4000 manually.

Serverless / functions

Three out of four can’t host a persistent process. Cloud Run is the exception when min-instances=1.

  • AWS Lambdawrong runtime15-min hard timeout kills the tunnel; no persistent daemon. Run the daemon as a Lambda Extension only while warm.
  • Google Cloud RuncompatSet min-instances=1 to keep warm. Inbound is HTTPS-only.
  • Vercel / Netlify / GCP Functionswrong runtimeEphemeral execution; no persistent process model.
  • Cloudflare Workerswrong runtimeNo long-lived sockets, no UDP, no listen().

VMs / IaaS

Full control. UDP works. Use -public to advertise a public node.

  • EC2 / GCE / Azure VMudpOpen UDP/4000 in the security group.
  • DO Droplets / Hetzner / LinodeudpSame model: managed VMs with full firewall control.
  • Bare metaludpNo restrictions beyond your own network policy.

Kubernetes

DaemonSet or sidecar. Default CNI allows UDP; corporate clusters with NetworkPolicy default-deny need compat.

  • Vanilla k8s / EKS / GKE / AKSudpDefault CNI allows UDP egress; no special config needed.
  • k3s / k0s / OpenShift / kindudpSame model: sidecar pattern over /shared/pilot.sock.
  • Locked clusters (NetworkPolicy default-deny)compatAllow egress to TCP/443 only; compat mode covers the rest.

Coding-agent sandboxes

A mix. Modal, E2B, Daytona and Codespaces are open; Docker-AI-Sandbox-class environments (Replit Agent, Devin) block raw TCP and let traffic out through an HTTP proxy, which compat mode uses since v1.13.11.

  • Cursor Cloud AgentsallowlistAdd *.pilotprotocol.network + 34.71.57.205 to the egress allowlist.
  • Replit Agentcompat + proxyDocker AI Sandbox; raw TCP/UDP blocked. Compat mode goes through HTTPS_PROXY (v1.13.11+).
  • Devin (Cognition)compat + proxySame Docker AI Sandbox model; compat through HTTPS_PROXY.
  • Modal SandboxesudpDefault-allow. Long timeout for persistent run.
  • E2B SandboxesudpIP/CIDR rules only; Pilot endpoints allowed by default.
  • Daytona SandboxesudpDefault-allow; iptables-based.
  • GitHub CodespacesudpIPv4 outbound works; 30-min idle stop pauses the daemon.
  • GitpodudpConfigure a .gitpod.yml task.
  • Coder (workspaces)udpInherits the underlying provider (EC2 / k8s / Docker).
  • Manus SandboxudpDefault-allow with configurable egress rules.
  • Lovable / v0 / Bolt.newwrong runtimeUI generators / WebContainers; no POSIX sockets.

Desktop / local

install.sh wires up the right supervisor for each OS.

  • macOS (LaunchAgent)udpWrites ~/Library/LaunchAgents/network.pilotprotocol.pilot-daemon.plist; load it with launchctl.
  • Linux (systemd)udpsudo install writes the pilot-daemon + updater units; enable and start them with systemctl.
  • tmux / screenudpAd-hoc dev only; no auto-restart.
  • Windowsnot shippedNo Windows binary yet. Use WSL2 (Linux mode).

Browser / WASM

The daemon needs a POSIX runtime; the SDKs need a local daemon over a Unix socket, so neither runs in a browser tab or WASM.

  • Browser tabwrong runtimeNo raw sockets, and the JS SDK is Node-only (a Unix-socket client of a local daemon).
  • WASM runtimewrong runtimeSame model: the daemon needs POSIX.
These per-platform notes are our best-effort understanding of each vendor’s network policy, not continuously tested guarantees. Vendors change their rules, so verify against your platform’s current docs and tell us if a cell is wrong.

Corporate networks

Egress models. What works today.

6 of 7 work today

  • Open egress

    Home wifi, most cloud VMs, default Docker

    UDP works; use the default.

    nothing

  • Default-deny, TCP/443 only

    Hotel, airport, locked corporate wifi

    Compat works as-is: a single outbound TCP/443.

    -transport=compat

  • HTTP CONNECT proxy

    Corporate networks with an explicit proxy URL

    Compat dials the registry and beacon through HTTPS_PROXY (v1.13.11+).

    compat, or auto (the pilotctl default)

  • Transparent TLS interception

    Zscaler, Fortinet, Palo Alto, BlueCoat, Netskope

    Works with -tls-trust=system (corporate CA in the OS store; the current default).

    already supported

  • HTTP-proxy-only sandbox

    Replit Agent, Devin, Docker AI Sandbox

    Compat through the proxy, CONNECT by hostname so local DNS does not matter (v1.13.11+).

    compat; proxy_cmd if credentials rotate

  • Domain-name allowlist

    Cursor Cloud Agents, Zscaler PAC

    Works after adding *.pilotprotocol.network + 34.71.57.205.

    doc-only

  • DPI / protocol allowlist

    Great Firewall, Iran-style filters

    Blocked. No domain fronting or ECH today.

    out of scope

Single-port 443

How single-port-443 works.

Since v1.10.3 the registry channel is TLS on TCP/443, multiplexed by SNI on the same nginx listener as the beacon.

Outbound ports a compat daemon needs

Before v1.10.3TCP/443TCP/9000v1.10.3 and laterTCP/443

Two ports worked for most “UDP blocked but TCP open” environments, but not for airport wifi or strict corporate firewalls that allow only TCP/443. A compat daemon’s lsof now shows exactly one outbound port: 443.

End-to-end protections are unchanged

  • TLSprotects the compat hop between daemon and rendezvous
  • Ed25519authenticates peer identity
  • AES-256-GCMfrom an X25519-derived key protects tunnel payloads, as in UDP mode

Worked examples

Six deployments.

Dockerfilecompat
FROM debian:bookworm-slim
RUN apt-get update && apt-get install -y curl ca-certificates \
    && rm -rf /var/lib/apt/lists/*
RUN curl -fsSL https://pilotprotocol.network/install.sh | \
    PILOT_EMAIL=you@example.com PILOT_ALLOW_ROOT=1 sh
ENTRYPOINT ["/root/.pilot/bin/pilot-daemon", "-transport=compat"]

No port exposed. Render allows arbitrary outbound TCP/443. Zero UDP, zero TCP/9000.

One daemon. Two transport modes.

On a supported runtime, install Pilot and start the daemon: auto picks UDP or compat, through HTTPS_PROXY when there is one. Set transport=compat to skip the UDP probe. Check the platform notes above before deployment.

curl -fsSL https://pilotprotocol.network/install.sh | sh
Install PilotFirewalls & compat mode