Skip to main content
Last updated on

Manage port forwarding to serverless compute

Port forwarding to serverless compute lets users reach services running on serverless compute through a URL in your workspace. The SSH tunnel uses port forwarding to connect a local IDE or terminal to serverless compute.

Port forwarding to serverless compute is on by default, except in workspaces with the compliance security profile enabled, where it is off by default. An account admin can turn it off for every workspace in the account. Otherwise, each workspace admin decides for their own workspace.

warning

This setting is a policy control, not a security boundary. If Databricks can't read the setting, connections are allowed. For the other limitations, see Limitations.

Configure port forwarding for an account​

To use the SSH tunnel with serverless compute, an account admin can configure port forwarding as follows:

  1. Log in to the account console.
  2. Click Settings icon Settings.
  3. Click the Feature enablement tab.
  4. Select whether Port forwarding to serverless compute should be on or off.

When enabled, workspace admins can also turn port forwarding on or off at the workspace level. When disabled, port forwarding is off in every workspace and cannot be changed.

Configure port forwarding for a workspace​

Unless an account admin has turned port forwarding off, workspace admins can turn it on or off for their own workspace. In a workspace with the compliance security profile, this is the only way to turn it on.

  1. Go to the settings page.
  2. Click the Compute tab.
  3. Click the Port forwarding to serverless compute toggle under Serverless interactive.
note

After you change this setting in either the account console or workspace settings, new connections usually follow the change within a few minutes, but it can take longer. Refreshing your browser doesn't make it take effect sooner, and connections that are already open aren't closed.

What changes when port forwarding is off​

When port forwarding to serverless compute is off, Databricks refuses new connections to serverless compute on forwarded ports. Users who try to connect get a FEATURE_DISABLED error that says an administrator has disabled port forwarding to serverless compute for the workspace.

The following stop working on serverless compute:

  • The SSH tunnel, including databricks ssh connect and Visual Studio Code or Cursor Remote-SSH sessions.
  • Any service that a user starts on serverless compute and opens through a forwarded URL, such as a Streamlit, Gradio, or Flask app, or a Jupyter server.

The following keep working:

  • The web terminal, Spark UI, cluster metrics UI, Ray dashboard, and TensorBoard.
  • Notebooks, SQL, jobs, Databricks Connect, and the Databricks CLI. These don't use port forwarding.
  • All connections to classic compute.

Connections that are already open stay open until they close.

Manage SSH tunnel access to classic compute​

This setting doesn't apply to classic compute. With classic compute, a user can connect to the SSH tunnel only using dedicated single-user compute that's assigned to them, and only if they have CAN ATTACH TO permissions or greater.

To prevent users from connecting to classic compute using the SSH tunnel, limit which users have dedicated compute assigned to them:

  • Restrict access to the Personal Compute policy, which all users can use by default, and to other compute policies that allow dedicated compute. See Managing access to the Personal Compute policy.
  • Grant the Allow unrestricted cluster creation entitlement only to users who need it. See Compute entitlements.
  • Don't assign dedicated compute to users who shouldn't use the SSH tunnel.

Limitations​

  • If Databricks can't read the setting, it allows the connection.
  • The ports that the web terminal, Spark UI, cluster metrics UI, Ray dashboard, and TensorBoard use stay reachable regardless of which service is listening on them. A user who can run code on serverless compute can start their own service on one of these ports.
  • This setting doesn't apply to classic compute or the web terminal. To control SSH tunnel access to classic compute, see Manage SSH tunnel access to classic compute. To control the web terminal, see Enable the web terminal.
On this page