Run Supabase Locally in a Cloud Sandbox

sbx new --name supabase-dev --type default
id=sb_ydztcc1fj6    # the id that sbx new printed

sbx exec $id 'curl -fsSLo /tmp/supabase.deb https://github.com/supabase/cli/releases/download/v2.122.0/supabase_2.122.0_linux_amd64.deb && sudo dpkg -i /tmp/supabase.deb && supabase --version'

Unpacking supabase (2.122.0) ...
Setting up supabase (2.122.0) ...
2.122.0

sbx exec $id 'mkdir -p ~/myapp && cd ~/myapp && supabase init'
sbx exec $id --detach 'cd ~/myapp && s=$(date +%s.%N); supabase start > start.log 2>&1; echo exit=$? > start.result; echo elapsed=$(python3 -c "print(round($(date +%s.%N)-$s,1))") >> start.result'

sbx exec $id 'cat ~/myapp/start.result'

exit=0
elapsed=101.0

Started supabase local development setup.
│ Studio  │ http://127.0.0.1:54323     │
│ Mailpit │ http://127.0.0.1:54324     │
│ Project URL    │ http://127.0.0.1:54321              │
│ REST           │ http://127.0.0.1:54321/rest/v1      │
│ URL │ postgresql://postgres:postgres@127.0.0.1:54322/postgres │
…
Local dev security notice
All services bind to 0.0.0.0 (network-accessible, not just localhost)
API keys and JWT secrets are shared defaults. Do not use in production
Studio, pgMeta (/pg/*), and analytics have no authentication

-- todos.sql
create table public.todos (
  id bigint generated always as identity primary key,
  task text not null,
  done boolean not null default false
);
alter table public.todos enable row level security;
create policy "anyone can read todos" on public.todos
  for select to anon using (true);
insert into public.todos (task) values ('write the guide'), ('delete the sandbox');

sbx scp todos.sql $id:/home/user/myapp/todos.sql
sbx exec $id 'cd ~/myapp && docker exec -i supabase_db_myapp psql -U postgres -d postgres < todos.sql'
sbx exec $id 'cd ~/myapp && eval $(supabase status -o env 2>/dev/null | grep ^ANON_KEY=); curl -s "http://127.0.0.1:54321/rest/v1/todos?select=id,task,done" -H "apikey: $ANON_KEY"'

CREATE TABLE
ALTER TABLE
CREATE POLICY
INSERT 0 2
[{"id":1,"task":"write the guide","done":false},
 {"id":2,"task":"delete the sandbox","done":false}]

sbx host $id 54323 --title studio
sbx host $id 54321 --title api

{"ok":true,"type":"port.hosted","sandboxId":"sb_ydztcc1fj6","port":54323,"url":"https://vivid-able-fig-54323.box.sandboxer.com?_token=<token>","access":"private",…}
{"ok":true,"type":"port.hosted","sandboxId":"sb_ydztcc1fj6","port":54321,"url":"https://vivid-able-fig-54321.box.sandboxer.com?_token=<token>","access":"private",…}

curl -s -o /dev/null -w '%{http_code}\n' https://vivid-able-fig-54323.box.sandboxer.com/
# 401   (no token)

curl -sL -c jar -b jar -o /dev/null -w '%{http_code} %{url_effective}\n' "https://vivid-able-fig-54323.box.sandboxer.com?_token=<token>"
# 200 https://vivid-able-fig-54323.box.sandboxer.com/project/default

API=https://vivid-able-fig-54321.box.sandboxer.com
curl -s -o /dev/null -c api.jar "$API/?_token=<token>"        # 302, sets the cookie
curl -s -b api.jar "$API/rest/v1/todos?select=id,task,done" -H "apikey: $ANON_KEY" -w '\nHTTP %{http_code} in %{time_total}s\n'

[{"id":1,"task":"write the guide","done":false},
 {"id":2,"task":"delete the sandbox","done":false}]
HTTP 200 in 0.240160s