Portal

What it is

Most of the apps Henning and Claude have built run in containers on one Windows machine. Portal is the front door to all of them. It has one card per app that shows whether the app is running, with buttons to start, restart and stop it.

It also does the setup that used to take six or seven steps across three dashboards. It gives an app a public address, routes it through a shared tunnel and puts a login in front of it. And it has a panel where Claude Code runs in a real terminal in the browser.

How it works

In August 2026, six apps shared one Cloudflare tunnel and three kept their own. All nine had Cloudflare Access in front. Portal shows a plan before it changes anything there, and it refuses to publish an address with nothing in front of it.

Portal is deliberately not allowed to control Docker directly. Status comes from a small separate service that can only read. A separate watcher on the host carries out Start and Stop.

Replacing the Portal container closes the terminal tabs.

The documents Claude reads

When Portal registers an app, it writes four documents about how the app is built, how it is published and how it calls Claude. It also adds a pointer in CLAUDE.md, the file Claude Code actually reads. The four documents now have their own folder. Portal overwrites anything in that folder and leaves everything else in the app alone. Uploading a Markdown file no longer replaces an existing file without asking. Before, uploading a file named claude.md replaced the app’s whole CLAUDE.md.

Rules that apply to every app now live in one shared place. Every Claude session loads them, including the terminal in Portal. A new app’s CLAUDE.md now says only what is specific to that app.

When the watcher looked dead

In early October, Stop sometimes hung at “waiting for the watcher” even though the watcher was running. The fix on 7 October closed three gaps in Claude’s code:

• A docker compose command that hung blocked the queue. Every command now has a time limit.
• Reused process IDs fooled the lock. The lock now depends on a heartbeat.
• An unexpected error crashed the watcher. Now it is logged instead.

Apps that lost their port

On the night of 10 October, one app stopped answering, but its container still showed as healthy. The port forwarding on the host was gone, and the status showed green. This can happen after Docker Desktop restarts. Until then, someone had to notice this and recreate the container by hand.

Now the watcher checks the apps’ ports every five minutes. If a port fails twice in a row while its container is healthy, the watcher recreates only the container that publishes that port, from the same image. It does this at most once per quarter hour per app. After three tries it gives up and says so on the card. It never touches stopped apps. For Portal itself it only warns by default, because recreating Portal would close the terminal tabs.

Pending updates

Since 13 October, each card in the Status tab shows how many component updates Dependabot has proposed for the app and whether GitHub has security alerts for it, with links. Critical and high alerts are highlighted. Portal updates nothing itself. It only reads, using its own read-only token, and keeps GitHub’s answer for half an hour. Apps without a GitHub repository get no line.

Keeping the tunnel software current

On 26 October it turned out that both tunnels were running a cloudflared build from June, version 2026.6.1. The compose file asked for the latest image, but that tag only moves when the image is pulled again, and that had not happened since June. Versions before 2026.10.2 trust eight compromised eMudhra intermediate certificates that Cloudflare had warned about on 20 October. Claude first pinned cloudflared to 2026.10.4.

The next day a nightly job replaced the pin. Between 03 and 05, the host watcher pulls the latest cloudflared image and recreates the tunnels that follow it, one at a time. It waits until each tunnel has registered its connection with Cloudflare before it moves on, and goes back to the previous image if the tunnel does not connect. Each tunnel is down for about four seconds during the switch, so the job runs at night. Tunnels pinned to a specific version are left alone, but if the pinned version is old, the app’s card in Status says so. That line appears only after Portal itself has been rebuilt.