As of now if process is run inside jail (network namespace), you can't access it from outside. Which can be inconvenient, let's say you're developing website or webserver with agent and want to test it from browser.
We need to forward ports from host to jail.
It can be either smth like: boundary-run --port-forward 8080:8080 or some kind of auto-detection of ports.