diff --git a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api.pb.go b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api.pb.go
index c540e23fb4..84769491f3 100644
--- a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api.pb.go
+++ b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go. DO NOT EDIT.
 // versions:
 // 	protoc-gen-go v1.31.0
-// 	protoc        v4.23.4
+// 	protoc        v4.24.4
 // source: kurtosis_backend_server_api.proto
 
 package kurtosis_backend_server_rpc_api_bindings
@@ -1179,6 +1179,320 @@ func (x *UpdateAddressArgs) GetCountry() string {
 	return ""
 }
 
+type GetUnlockedPortsRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	InstanceShortUuid string `protobuf:"bytes,1,opt,name=instance_short_uuid,json=instanceShortUuid,proto3" json:"instance_short_uuid,omitempty"`
+	EnclaveShortUuid  string `protobuf:"bytes,2,opt,name=enclave_short_uuid,json=enclaveShortUuid,proto3" json:"enclave_short_uuid,omitempty"`
+}
+
+func (x *GetUnlockedPortsRequest) Reset() {
+	*x = GetUnlockedPortsRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[17]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUnlockedPortsRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUnlockedPortsRequest) ProtoMessage() {}
+
+func (x *GetUnlockedPortsRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[17]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUnlockedPortsRequest.ProtoReflect.Descriptor instead.
+func (*GetUnlockedPortsRequest) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{17}
+}
+
+func (x *GetUnlockedPortsRequest) GetInstanceShortUuid() string {
+	if x != nil {
+		return x.InstanceShortUuid
+	}
+	return ""
+}
+
+func (x *GetUnlockedPortsRequest) GetEnclaveShortUuid() string {
+	if x != nil {
+		return x.EnclaveShortUuid
+	}
+	return ""
+}
+
+type CheckPortAuthorizationRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port *Port `protobuf:"bytes,1,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *CheckPortAuthorizationRequest) Reset() {
+	*x = CheckPortAuthorizationRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[18]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *CheckPortAuthorizationRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*CheckPortAuthorizationRequest) ProtoMessage() {}
+
+func (x *CheckPortAuthorizationRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[18]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use CheckPortAuthorizationRequest.ProtoReflect.Descriptor instead.
+func (*CheckPortAuthorizationRequest) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{18}
+}
+
+func (x *CheckPortAuthorizationRequest) GetPort() *Port {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
+type UnlockPortRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port *Port `protobuf:"bytes,1,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *UnlockPortRequest) Reset() {
+	*x = UnlockPortRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[19]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *UnlockPortRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*UnlockPortRequest) ProtoMessage() {}
+
+func (x *UnlockPortRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[19]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use UnlockPortRequest.ProtoReflect.Descriptor instead.
+func (*UnlockPortRequest) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *UnlockPortRequest) GetPort() *Port {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
+type LockPortRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port *Port `protobuf:"bytes,1,opt,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *LockPortRequest) Reset() {
+	*x = LockPortRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[20]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *LockPortRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*LockPortRequest) ProtoMessage() {}
+
+func (x *LockPortRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[20]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use LockPortRequest.ProtoReflect.Descriptor instead.
+func (*LockPortRequest) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{20}
+}
+
+func (x *LockPortRequest) GetPort() *Port {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
+type Port struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	PortNumber        uint32 `protobuf:"varint,1,opt,name=port_number,json=portNumber,proto3" json:"port_number,omitempty"`
+	InstanceShortUuid string `protobuf:"bytes,2,opt,name=instance_short_uuid,json=instanceShortUuid,proto3" json:"instance_short_uuid,omitempty"`
+	ServiceShortUuid  string `protobuf:"bytes,3,opt,name=service_short_uuid,json=serviceShortUuid,proto3" json:"service_short_uuid,omitempty"`
+	EnclaveShortUuid  string `protobuf:"bytes,4,opt,name=enclave_short_uuid,json=enclaveShortUuid,proto3" json:"enclave_short_uuid,omitempty"`
+}
+
+func (x *Port) Reset() {
+	*x = Port{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[21]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *Port) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*Port) ProtoMessage() {}
+
+func (x *Port) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[21]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use Port.ProtoReflect.Descriptor instead.
+func (*Port) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{21}
+}
+
+func (x *Port) GetPortNumber() uint32 {
+	if x != nil {
+		return x.PortNumber
+	}
+	return 0
+}
+
+func (x *Port) GetInstanceShortUuid() string {
+	if x != nil {
+		return x.InstanceShortUuid
+	}
+	return ""
+}
+
+func (x *Port) GetServiceShortUuid() string {
+	if x != nil {
+		return x.ServiceShortUuid
+	}
+	return ""
+}
+
+func (x *Port) GetEnclaveShortUuid() string {
+	if x != nil {
+		return x.EnclaveShortUuid
+	}
+	return ""
+}
+
+type GetUnlockedPortsResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Port []*Port `protobuf:"bytes,1,rep,name=port,proto3" json:"port,omitempty"`
+}
+
+func (x *GetUnlockedPortsResponse) Reset() {
+	*x = GetUnlockedPortsResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_kurtosis_backend_server_api_proto_msgTypes[22]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *GetUnlockedPortsResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*GetUnlockedPortsResponse) ProtoMessage() {}
+
+func (x *GetUnlockedPortsResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_kurtosis_backend_server_api_proto_msgTypes[22]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use GetUnlockedPortsResponse.ProtoReflect.Descriptor instead.
+func (*GetUnlockedPortsResponse) Descriptor() ([]byte, []int) {
+	return file_kurtosis_backend_server_api_proto_rawDescGZIP(), []int{22}
+}
+
+func (x *GetUnlockedPortsResponse) GetPort() []*Port {
+	if x != nil {
+		return x.Port
+	}
+	return nil
+}
+
 var File_kurtosis_backend_server_api_proto protoreflect.FileDescriptor
 
 var file_kurtosis_backend_server_api_proto_rawDesc = []byte{
@@ -1356,66 +1670,124 @@ var file_kurtosis_backend_server_api_proto_rawDesc = []byte{
 	0x52, 0x0a, 0x70, 0x6f, 0x73, 0x74, 0x61, 0x6c, 0x43, 0x6f, 0x64, 0x65, 0x12, 0x18, 0x0a, 0x07,
 	0x63, 0x6f, 0x75, 0x6e, 0x74, 0x72, 0x79, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63,
 	0x6f, 0x75, 0x6e, 0x74, 0x72, 0x79, 0x42, 0x09, 0x0a, 0x07, 0x5f, 0x6c, 0x69, 0x6e, 0x65, 0x5f,
-	0x32, 0x32, 0xd5, 0x06, 0x0a, 0x1a, 0x4b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x43, 0x6c,
-	0x6f, 0x75, 0x64, 0x42, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x12, 0x42, 0x0a, 0x0b, 0x49, 0x73, 0x41, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22,
-	0x03, 0x90, 0x02, 0x01, 0x12, 0x79, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x6f, 0x75, 0x64,
-	0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2a,
-	0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
-	0x47, 0x65, 0x74, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x2e, 0x2e, 0x6b, 0x75, 0x72,
+	0x32, 0x22, 0x77, 0x0a, 0x17, 0x47, 0x65, 0x74, 0x55, 0x6e, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64,
+	0x50, 0x6f, 0x72, 0x74, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2e, 0x0a, 0x13,
+	0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x5f, 0x75,
+	0x75, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x69, 0x6e, 0x73, 0x74, 0x61,
+	0x6e, 0x63, 0x65, 0x53, 0x68, 0x6f, 0x72, 0x74, 0x55, 0x75, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x12,
+	0x65, 0x6e, 0x63, 0x6c, 0x61, 0x76, 0x65, 0x5f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x5f, 0x75, 0x75,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x65, 0x6e, 0x63, 0x6c, 0x61, 0x76,
+	0x65, 0x53, 0x68, 0x6f, 0x72, 0x74, 0x55, 0x75, 0x69, 0x64, 0x22, 0x49, 0x0a, 0x1d, 0x43, 0x68,
+	0x65, 0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x70,
+	0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6b, 0x75, 0x72, 0x74,
+	0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x52,
+	0x04, 0x70, 0x6f, 0x72, 0x74, 0x22, 0x3d, 0x0a, 0x11, 0x55, 0x6e, 0x6c, 0x6f, 0x63, 0x6b, 0x50,
+	0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x70, 0x6f,
+	0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f,
+	0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x04,
+	0x70, 0x6f, 0x72, 0x74, 0x22, 0x3b, 0x0a, 0x0f, 0x4c, 0x6f, 0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x28, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73,
+	0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x04, 0x70, 0x6f, 0x72,
+	0x74, 0x22, 0xb3, 0x01, 0x0a, 0x04, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x6f,
+	0x72, 0x74, 0x5f, 0x6e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0d, 0x52,
+	0x0a, 0x70, 0x6f, 0x72, 0x74, 0x4e, 0x75, 0x6d, 0x62, 0x65, 0x72, 0x12, 0x2e, 0x0a, 0x13, 0x69,
+	0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x5f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x5f, 0x75, 0x75,
+	0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x11, 0x69, 0x6e, 0x73, 0x74, 0x61, 0x6e,
+	0x63, 0x65, 0x53, 0x68, 0x6f, 0x72, 0x74, 0x55, 0x75, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x73,
+	0x65, 0x72, 0x76, 0x69, 0x63, 0x65, 0x5f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x5f, 0x75, 0x75, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x73, 0x65, 0x72, 0x76, 0x69, 0x63, 0x65,
+	0x53, 0x68, 0x6f, 0x72, 0x74, 0x55, 0x75, 0x69, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x65, 0x6e, 0x63,
+	0x6c, 0x61, 0x76, 0x65, 0x5f, 0x73, 0x68, 0x6f, 0x72, 0x74, 0x5f, 0x75, 0x75, 0x69, 0x64, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x65, 0x6e, 0x63, 0x6c, 0x61, 0x76, 0x65, 0x53, 0x68,
+	0x6f, 0x72, 0x74, 0x55, 0x75, 0x69, 0x64, 0x22, 0x44, 0x0a, 0x18, 0x47, 0x65, 0x74, 0x55, 0x6e,
+	0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f,
+	0x6e, 0x73, 0x65, 0x12, 0x28, 0x0a, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x18, 0x01, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f,
+	0x75, 0x64, 0x2e, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x04, 0x70, 0x6f, 0x72, 0x74, 0x32, 0xb3, 0x09,
+	0x0a, 0x1a, 0x4b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x42,
+	0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x12, 0x42, 0x0a, 0x0b,
+	0x49, 0x73, 0x41, 0x76, 0x61, 0x69, 0x6c, 0x61, 0x62, 0x6c, 0x65, 0x12, 0x16, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
+	0x70, 0x74, 0x79, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x03, 0x90, 0x02, 0x01,
+	0x12, 0x79, 0x0a, 0x16, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x6f, 0x75, 0x64, 0x49, 0x6e, 0x73, 0x74,
+	0x61, 0x6e, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2a, 0x2e, 0x6b, 0x75, 0x72,
 	0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x43,
 	0x6c, 0x6f, 0x75, 0x64, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03, 0x90, 0x02, 0x01, 0x12,
-	0x6a, 0x0a, 0x11, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70,
-	0x69, 0x4b, 0x65, 0x79, 0x12, 0x28, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f,
-	0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29,
-	0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
-	0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65,
-	0x79, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x70, 0x0a, 0x13, 0x47,
-	0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e,
-	0x63, 0x65, 0x12, 0x2a, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c,
-	0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49,
-	0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b,
+	0x69, 0x67, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x2e, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69,
+	0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x43, 0x6c, 0x6f, 0x75, 0x64,
+	0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x03, 0x90, 0x02, 0x01, 0x12, 0x6a, 0x0a, 0x11, 0x47,
+	0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79,
+	0x12, 0x28, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75,
+	0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69,
+	0x4b, 0x65, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x29, 0x2e, 0x6b, 0x75, 0x72,
+	0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f,
+	0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x41, 0x70, 0x69, 0x4b, 0x65, 0x79, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x70, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x4f, 0x72,
+	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x12, 0x2a,
 	0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
 	0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61,
-	0x6e, 0x63, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7c, 0x0a,
-	0x18, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x79, 0x6d,
-	0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x2e, 0x6b, 0x75, 0x72, 0x74,
-	0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72,
-	0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x30, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73,
-	0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x1b, 0x52,
-	0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x79,
-	0x6d, 0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x2f, 0x2e, 0x6b, 0x75, 0x72,
-	0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x52, 0x65, 0x66, 0x72,
-	0x65, 0x73, 0x68, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e,
-	0x74, 0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
+	0x6e, 0x63, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2b, 0x2e, 0x6b, 0x75, 0x72,
+	0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f,
+	0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x49, 0x6e, 0x73, 0x74, 0x61, 0x6e, 0x63, 0x65, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x7c, 0x0a, 0x18, 0x47, 0x65, 0x74,
+	0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x43,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x2c, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73,
+	0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61,
+	0x74, 0x65, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x41,
+	0x72, 0x67, 0x73, 0x1a, 0x30, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63,
+	0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x4f, 0x72, 0x43, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x65, 0x73,
+	0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x00, 0x12, 0x68, 0x0a, 0x1b, 0x52, 0x65, 0x66, 0x72, 0x65,
+	0x73, 0x68, 0x44, 0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74,
+	0x4d, 0x65, 0x74, 0x68, 0x6f, 0x64, 0x12, 0x2f, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69,
+	0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x52, 0x65, 0x66, 0x72, 0x65, 0x73, 0x68, 0x44,
+	0x65, 0x66, 0x61, 0x75, 0x6c, 0x74, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x4d, 0x65, 0x74,
+	0x68, 0x6f, 0x64, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22,
+	0x00, 0x12, 0x64, 0x0a, 0x19, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x50, 0x61, 0x79, 0x6d, 0x65,
+	0x6e, 0x74, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x2d,
+	0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
+	0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x75, 0x62,
+	0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0d, 0x55, 0x70, 0x64, 0x61, 0x74,
+	0x65, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f,
+	0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x55, 0x70, 0x64, 0x61, 0x74, 0x65,
+	0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x41, 0x72, 0x67, 0x73, 0x1a, 0x16, 0x2e, 0x67, 0x6f,
 	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d,
-	0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x64, 0x0a, 0x19, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x50,
-	0x61, 0x79, 0x6d, 0x65, 0x6e, 0x74, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x2d, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c,
-	0x6f, 0x75, 0x64, 0x2e, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x50, 0x61, 0x79, 0x6d, 0x65, 0x6e,
-	0x74, 0x53, 0x75, 0x62, 0x73, 0x63, 0x72, 0x69, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x41, 0x72, 0x67,
-	0x73, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x4c, 0x0a, 0x0d, 0x55,
-	0x70, 0x64, 0x61, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x12, 0x21, 0x2e, 0x6b,
-	0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x55, 0x70,
-	0x64, 0x61, 0x74, 0x65, 0x41, 0x64, 0x64, 0x72, 0x65, 0x73, 0x73, 0x41, 0x72, 0x67, 0x73, 0x1a,
-	0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x42, 0x5d, 0x5a, 0x5b, 0x67, 0x69, 0x74,
-	0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73,
-	0x2d, 0x74, 0x65, 0x63, 0x68, 0x2f, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x2f, 0x63,
-	0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61, 0x70, 0x69, 0x2f, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2f,
-	0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64,
-	0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x72, 0x70, 0x63, 0x5f, 0x61, 0x70, 0x69, 0x5f,
-	0x62, 0x69, 0x6e, 0x64, 0x69, 0x6e, 0x67, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x61, 0x0a, 0x16, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x6f,
+	0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x12,
+	0x2d, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x43, 0x68, 0x65, 0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x49, 0x0a, 0x0a, 0x55, 0x6e, 0x6c, 0x6f,
+	0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74, 0x12, 0x21, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69,
+	0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x55, 0x6e, 0x6c, 0x6f, 0x63, 0x6b, 0x50, 0x6f,
+	0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67,
+	0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74,
+	0x79, 0x22, 0x00, 0x12, 0x45, 0x0a, 0x08, 0x4c, 0x6f, 0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74, 0x12,
+	0x1f, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64,
+	0x2e, 0x4c, 0x6f, 0x63, 0x6b, 0x50, 0x6f, 0x72, 0x74, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x16, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x22, 0x00, 0x12, 0x67, 0x0a, 0x10, 0x47, 0x65,
+	0x74, 0x55, 0x6e, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x12, 0x27,
+	0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e,
+	0x47, 0x65, 0x74, 0x55, 0x6e, 0x6c, 0x6f, 0x63, 0x6b, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x73,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x28, 0x2e, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73,
+	0x69, 0x73, 0x5f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2e, 0x47, 0x65, 0x74, 0x55, 0x6e, 0x6c, 0x6f,
+	0x63, 0x6b, 0x65, 0x64, 0x50, 0x6f, 0x72, 0x74, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
+	0x65, 0x22, 0x00, 0x42, 0x5d, 0x5a, 0x5b, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f,
+	0x6d, 0x2f, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x2d, 0x74, 0x65, 0x63, 0x68, 0x2f,
+	0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73, 0x69, 0x73, 0x2f, 0x63, 0x6c, 0x6f, 0x75, 0x64, 0x2f, 0x61,
+	0x70, 0x69, 0x2f, 0x67, 0x6f, 0x6c, 0x61, 0x6e, 0x67, 0x2f, 0x6b, 0x75, 0x72, 0x74, 0x6f, 0x73,
+	0x69, 0x73, 0x5f, 0x62, 0x61, 0x63, 0x6b, 0x65, 0x6e, 0x64, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65,
+	0x72, 0x5f, 0x72, 0x70, 0x63, 0x5f, 0x61, 0x70, 0x69, 0x5f, 0x62, 0x69, 0x6e, 0x64, 0x69, 0x6e,
+	0x67, 0x73, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -1431,7 +1803,7 @@ func file_kurtosis_backend_server_api_proto_rawDescGZIP() []byte {
 }
 
 var file_kurtosis_backend_server_api_proto_enumTypes = make([]protoimpl.EnumInfo, 1)
-var file_kurtosis_backend_server_api_proto_msgTypes = make([]protoimpl.MessageInfo, 17)
+var file_kurtosis_backend_server_api_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
 var file_kurtosis_backend_server_api_proto_goTypes = []interface{}{
 	(PaymentSubscription_Status)(0),          // 0: kurtosis_cloud.PaymentSubscription.Status
 	(*GetOrCreateApiKeyRequest)(nil),         // 1: kurtosis_cloud.GetOrCreateApiKeyRequest
@@ -1451,7 +1823,13 @@ var file_kurtosis_backend_server_api_proto_goTypes = []interface{}{
 	(*AwsKey)(nil),                           // 15: kurtosis_cloud.AwsKey
 	(*AwsEnvironment)(nil),                   // 16: kurtosis_cloud.AwsEnvironment
 	(*UpdateAddressArgs)(nil),                // 17: kurtosis_cloud.UpdateAddressArgs
-	(*emptypb.Empty)(nil),                    // 18: google.protobuf.Empty
+	(*GetUnlockedPortsRequest)(nil),          // 18: kurtosis_cloud.GetUnlockedPortsRequest
+	(*CheckPortAuthorizationRequest)(nil),    // 19: kurtosis_cloud.CheckPortAuthorizationRequest
+	(*UnlockPortRequest)(nil),                // 20: kurtosis_cloud.UnlockPortRequest
+	(*LockPortRequest)(nil),                  // 21: kurtosis_cloud.LockPortRequest
+	(*Port)(nil),                             // 22: kurtosis_cloud.Port
+	(*GetUnlockedPortsResponse)(nil),         // 23: kurtosis_cloud.GetUnlockedPortsResponse
+	(*emptypb.Empty)(nil),                    // 24: google.protobuf.Empty
 }
 var file_kurtosis_backend_server_api_proto_depIdxs = []int32{
 	6,  // 0: kurtosis_cloud.GetCloudInstanceConfigResponse.launch_result:type_name -> kurtosis_cloud.LaunchResult
@@ -1462,27 +1840,39 @@ var file_kurtosis_backend_server_api_proto_depIdxs = []int32{
 	9,  // 5: kurtosis_cloud.GetOrCreatePaymentConfigResponse.payment_method:type_name -> kurtosis_cloud.PaymentMethod
 	10, // 6: kurtosis_cloud.GetOrCreatePaymentConfigResponse.product:type_name -> kurtosis_cloud.PaymentProduct
 	11, // 7: kurtosis_cloud.GetOrCreatePaymentConfigResponse.subscription:type_name -> kurtosis_cloud.PaymentSubscription
-	18, // 8: kurtosis_cloud.KurtosisCloudBackendServer.IsAvailable:input_type -> google.protobuf.Empty
-	5,  // 9: kurtosis_cloud.KurtosisCloudBackendServer.GetCloudInstanceConfig:input_type -> kurtosis_cloud.GetCloudInstanceConfigArgs
-	1,  // 10: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateApiKey:input_type -> kurtosis_cloud.GetOrCreateApiKeyRequest
-	3,  // 11: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateInstance:input_type -> kurtosis_cloud.GetOrCreateInstanceRequest
-	8,  // 12: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreatePaymentConfig:input_type -> kurtosis_cloud.GetOrCreatePaymentConfigArgs
-	13, // 13: kurtosis_cloud.KurtosisCloudBackendServer.RefreshDefaultPaymentMethod:input_type -> kurtosis_cloud.RefreshDefaultPaymentMethodArgs
-	14, // 14: kurtosis_cloud.KurtosisCloudBackendServer.CancelPaymentSubscription:input_type -> kurtosis_cloud.CancelPaymentSubscriptionArgs
-	17, // 15: kurtosis_cloud.KurtosisCloudBackendServer.UpdateAddress:input_type -> kurtosis_cloud.UpdateAddressArgs
-	18, // 16: kurtosis_cloud.KurtosisCloudBackendServer.IsAvailable:output_type -> google.protobuf.Empty
-	7,  // 17: kurtosis_cloud.KurtosisCloudBackendServer.GetCloudInstanceConfig:output_type -> kurtosis_cloud.GetCloudInstanceConfigResponse
-	2,  // 18: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateApiKey:output_type -> kurtosis_cloud.GetOrCreateApiKeyResponse
-	4,  // 19: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateInstance:output_type -> kurtosis_cloud.GetOrCreateInstanceResponse
-	12, // 20: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreatePaymentConfig:output_type -> kurtosis_cloud.GetOrCreatePaymentConfigResponse
-	18, // 21: kurtosis_cloud.KurtosisCloudBackendServer.RefreshDefaultPaymentMethod:output_type -> google.protobuf.Empty
-	18, // 22: kurtosis_cloud.KurtosisCloudBackendServer.CancelPaymentSubscription:output_type -> google.protobuf.Empty
-	18, // 23: kurtosis_cloud.KurtosisCloudBackendServer.UpdateAddress:output_type -> google.protobuf.Empty
-	16, // [16:24] is the sub-list for method output_type
-	8,  // [8:16] is the sub-list for method input_type
-	8,  // [8:8] is the sub-list for extension type_name
-	8,  // [8:8] is the sub-list for extension extendee
-	0,  // [0:8] is the sub-list for field type_name
+	22, // 8: kurtosis_cloud.CheckPortAuthorizationRequest.port:type_name -> kurtosis_cloud.Port
+	22, // 9: kurtosis_cloud.UnlockPortRequest.port:type_name -> kurtosis_cloud.Port
+	22, // 10: kurtosis_cloud.LockPortRequest.port:type_name -> kurtosis_cloud.Port
+	22, // 11: kurtosis_cloud.GetUnlockedPortsResponse.port:type_name -> kurtosis_cloud.Port
+	24, // 12: kurtosis_cloud.KurtosisCloudBackendServer.IsAvailable:input_type -> google.protobuf.Empty
+	5,  // 13: kurtosis_cloud.KurtosisCloudBackendServer.GetCloudInstanceConfig:input_type -> kurtosis_cloud.GetCloudInstanceConfigArgs
+	1,  // 14: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateApiKey:input_type -> kurtosis_cloud.GetOrCreateApiKeyRequest
+	3,  // 15: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateInstance:input_type -> kurtosis_cloud.GetOrCreateInstanceRequest
+	8,  // 16: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreatePaymentConfig:input_type -> kurtosis_cloud.GetOrCreatePaymentConfigArgs
+	13, // 17: kurtosis_cloud.KurtosisCloudBackendServer.RefreshDefaultPaymentMethod:input_type -> kurtosis_cloud.RefreshDefaultPaymentMethodArgs
+	14, // 18: kurtosis_cloud.KurtosisCloudBackendServer.CancelPaymentSubscription:input_type -> kurtosis_cloud.CancelPaymentSubscriptionArgs
+	17, // 19: kurtosis_cloud.KurtosisCloudBackendServer.UpdateAddress:input_type -> kurtosis_cloud.UpdateAddressArgs
+	19, // 20: kurtosis_cloud.KurtosisCloudBackendServer.CheckPortAuthorization:input_type -> kurtosis_cloud.CheckPortAuthorizationRequest
+	20, // 21: kurtosis_cloud.KurtosisCloudBackendServer.UnlockPort:input_type -> kurtosis_cloud.UnlockPortRequest
+	21, // 22: kurtosis_cloud.KurtosisCloudBackendServer.LockPort:input_type -> kurtosis_cloud.LockPortRequest
+	18, // 23: kurtosis_cloud.KurtosisCloudBackendServer.GetUnlockedPorts:input_type -> kurtosis_cloud.GetUnlockedPortsRequest
+	24, // 24: kurtosis_cloud.KurtosisCloudBackendServer.IsAvailable:output_type -> google.protobuf.Empty
+	7,  // 25: kurtosis_cloud.KurtosisCloudBackendServer.GetCloudInstanceConfig:output_type -> kurtosis_cloud.GetCloudInstanceConfigResponse
+	2,  // 26: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateApiKey:output_type -> kurtosis_cloud.GetOrCreateApiKeyResponse
+	4,  // 27: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreateInstance:output_type -> kurtosis_cloud.GetOrCreateInstanceResponse
+	12, // 28: kurtosis_cloud.KurtosisCloudBackendServer.GetOrCreatePaymentConfig:output_type -> kurtosis_cloud.GetOrCreatePaymentConfigResponse
+	24, // 29: kurtosis_cloud.KurtosisCloudBackendServer.RefreshDefaultPaymentMethod:output_type -> google.protobuf.Empty
+	24, // 30: kurtosis_cloud.KurtosisCloudBackendServer.CancelPaymentSubscription:output_type -> google.protobuf.Empty
+	24, // 31: kurtosis_cloud.KurtosisCloudBackendServer.UpdateAddress:output_type -> google.protobuf.Empty
+	24, // 32: kurtosis_cloud.KurtosisCloudBackendServer.CheckPortAuthorization:output_type -> google.protobuf.Empty
+	24, // 33: kurtosis_cloud.KurtosisCloudBackendServer.UnlockPort:output_type -> google.protobuf.Empty
+	24, // 34: kurtosis_cloud.KurtosisCloudBackendServer.LockPort:output_type -> google.protobuf.Empty
+	23, // 35: kurtosis_cloud.KurtosisCloudBackendServer.GetUnlockedPorts:output_type -> kurtosis_cloud.GetUnlockedPortsResponse
+	24, // [24:36] is the sub-list for method output_type
+	12, // [12:24] is the sub-list for method input_type
+	12, // [12:12] is the sub-list for extension type_name
+	12, // [12:12] is the sub-list for extension extendee
+	0,  // [0:12] is the sub-list for field type_name
 }
 
 func init() { file_kurtosis_backend_server_api_proto_init() }
@@ -1695,6 +2085,78 @@ func file_kurtosis_backend_server_api_proto_init() {
 				return nil
 			}
 		}
+		file_kurtosis_backend_server_api_proto_msgTypes[17].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUnlockedPortsRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_kurtosis_backend_server_api_proto_msgTypes[18].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*CheckPortAuthorizationRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_kurtosis_backend_server_api_proto_msgTypes[19].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*UnlockPortRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_kurtosis_backend_server_api_proto_msgTypes[20].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*LockPortRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_kurtosis_backend_server_api_proto_msgTypes[21].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*Port); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_kurtosis_backend_server_api_proto_msgTypes[22].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetUnlockedPortsResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
 	}
 	file_kurtosis_backend_server_api_proto_msgTypes[4].OneofWrappers = []interface{}{}
 	file_kurtosis_backend_server_api_proto_msgTypes[6].OneofWrappers = []interface{}{}
@@ -1706,7 +2168,7 @@ func file_kurtosis_backend_server_api_proto_init() {
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_kurtosis_backend_server_api_proto_rawDesc,
 			NumEnums:      1,
-			NumMessages:   17,
+			NumMessages:   23,
 			NumExtensions: 0,
 			NumServices:   1,
 		},
diff --git a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api_grpc.pb.go b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api_grpc.pb.go
index 22f1475ceb..182349dbe8 100644
--- a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api_grpc.pb.go
+++ b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_api_grpc.pb.go
@@ -1,7 +1,7 @@
 // Code generated by protoc-gen-go-grpc. DO NOT EDIT.
 // versions:
 // - protoc-gen-go-grpc v1.3.0
-// - protoc             v4.23.4
+// - protoc             v4.24.4
 // source: kurtosis_backend_server_api.proto
 
 package kurtosis_backend_server_rpc_api_bindings
@@ -28,6 +28,10 @@ const (
 	KurtosisCloudBackendServer_RefreshDefaultPaymentMethod_FullMethodName = "/kurtosis_cloud.KurtosisCloudBackendServer/RefreshDefaultPaymentMethod"
 	KurtosisCloudBackendServer_CancelPaymentSubscription_FullMethodName   = "/kurtosis_cloud.KurtosisCloudBackendServer/CancelPaymentSubscription"
 	KurtosisCloudBackendServer_UpdateAddress_FullMethodName               = "/kurtosis_cloud.KurtosisCloudBackendServer/UpdateAddress"
+	KurtosisCloudBackendServer_CheckPortAuthorization_FullMethodName      = "/kurtosis_cloud.KurtosisCloudBackendServer/CheckPortAuthorization"
+	KurtosisCloudBackendServer_UnlockPort_FullMethodName                  = "/kurtosis_cloud.KurtosisCloudBackendServer/UnlockPort"
+	KurtosisCloudBackendServer_LockPort_FullMethodName                    = "/kurtosis_cloud.KurtosisCloudBackendServer/LockPort"
+	KurtosisCloudBackendServer_GetUnlockedPorts_FullMethodName            = "/kurtosis_cloud.KurtosisCloudBackendServer/GetUnlockedPorts"
 )
 
 // KurtosisCloudBackendServerClient is the client API for KurtosisCloudBackendServer service.
@@ -42,6 +46,10 @@ type KurtosisCloudBackendServerClient interface {
 	RefreshDefaultPaymentMethod(ctx context.Context, in *RefreshDefaultPaymentMethodArgs, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	CancelPaymentSubscription(ctx context.Context, in *CancelPaymentSubscriptionArgs, opts ...grpc.CallOption) (*emptypb.Empty, error)
 	UpdateAddress(ctx context.Context, in *UpdateAddressArgs, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	CheckPortAuthorization(ctx context.Context, in *CheckPortAuthorizationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	UnlockPort(ctx context.Context, in *UnlockPortRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	LockPort(ctx context.Context, in *LockPortRequest, opts ...grpc.CallOption) (*emptypb.Empty, error)
+	GetUnlockedPorts(ctx context.Context, in *GetUnlockedPortsRequest, opts ...grpc.CallOption) (*GetUnlockedPortsResponse, error)
 }
 
 type kurtosisCloudBackendServerClient struct {
@@ -124,6 +132,42 @@ func (c *kurtosisCloudBackendServerClient) UpdateAddress(ctx context.Context, in
 	return out, nil
 }
 
+func (c *kurtosisCloudBackendServerClient) CheckPortAuthorization(ctx context.Context, in *CheckPortAuthorizationRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, KurtosisCloudBackendServer_CheckPortAuthorization_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *kurtosisCloudBackendServerClient) UnlockPort(ctx context.Context, in *UnlockPortRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, KurtosisCloudBackendServer_UnlockPort_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *kurtosisCloudBackendServerClient) LockPort(ctx context.Context, in *LockPortRequest, opts ...grpc.CallOption) (*emptypb.Empty, error) {
+	out := new(emptypb.Empty)
+	err := c.cc.Invoke(ctx, KurtosisCloudBackendServer_LockPort_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
+func (c *kurtosisCloudBackendServerClient) GetUnlockedPorts(ctx context.Context, in *GetUnlockedPortsRequest, opts ...grpc.CallOption) (*GetUnlockedPortsResponse, error) {
+	out := new(GetUnlockedPortsResponse)
+	err := c.cc.Invoke(ctx, KurtosisCloudBackendServer_GetUnlockedPorts_FullMethodName, in, out, opts...)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 // KurtosisCloudBackendServerServer is the server API for KurtosisCloudBackendServer service.
 // All implementations should embed UnimplementedKurtosisCloudBackendServerServer
 // for forward compatibility
@@ -136,6 +180,10 @@ type KurtosisCloudBackendServerServer interface {
 	RefreshDefaultPaymentMethod(context.Context, *RefreshDefaultPaymentMethodArgs) (*emptypb.Empty, error)
 	CancelPaymentSubscription(context.Context, *CancelPaymentSubscriptionArgs) (*emptypb.Empty, error)
 	UpdateAddress(context.Context, *UpdateAddressArgs) (*emptypb.Empty, error)
+	CheckPortAuthorization(context.Context, *CheckPortAuthorizationRequest) (*emptypb.Empty, error)
+	UnlockPort(context.Context, *UnlockPortRequest) (*emptypb.Empty, error)
+	LockPort(context.Context, *LockPortRequest) (*emptypb.Empty, error)
+	GetUnlockedPorts(context.Context, *GetUnlockedPortsRequest) (*GetUnlockedPortsResponse, error)
 }
 
 // UnimplementedKurtosisCloudBackendServerServer should be embedded to have forward compatible implementations.
@@ -166,6 +214,18 @@ func (UnimplementedKurtosisCloudBackendServerServer) CancelPaymentSubscription(c
 func (UnimplementedKurtosisCloudBackendServerServer) UpdateAddress(context.Context, *UpdateAddressArgs) (*emptypb.Empty, error) {
 	return nil, status.Errorf(codes.Unimplemented, "method UpdateAddress not implemented")
 }
+func (UnimplementedKurtosisCloudBackendServerServer) CheckPortAuthorization(context.Context, *CheckPortAuthorizationRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method CheckPortAuthorization not implemented")
+}
+func (UnimplementedKurtosisCloudBackendServerServer) UnlockPort(context.Context, *UnlockPortRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method UnlockPort not implemented")
+}
+func (UnimplementedKurtosisCloudBackendServerServer) LockPort(context.Context, *LockPortRequest) (*emptypb.Empty, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method LockPort not implemented")
+}
+func (UnimplementedKurtosisCloudBackendServerServer) GetUnlockedPorts(context.Context, *GetUnlockedPortsRequest) (*GetUnlockedPortsResponse, error) {
+	return nil, status.Errorf(codes.Unimplemented, "method GetUnlockedPorts not implemented")
+}
 
 // UnsafeKurtosisCloudBackendServerServer may be embedded to opt out of forward compatibility for this service.
 // Use of this interface is not recommended, as added methods to KurtosisCloudBackendServerServer will
@@ -322,6 +382,78 @@ func _KurtosisCloudBackendServer_UpdateAddress_Handler(srv interface{}, ctx cont
 	return interceptor(ctx, in, info, handler)
 }
 
+func _KurtosisCloudBackendServer_CheckPortAuthorization_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(CheckPortAuthorizationRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KurtosisCloudBackendServerServer).CheckPortAuthorization(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: KurtosisCloudBackendServer_CheckPortAuthorization_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KurtosisCloudBackendServerServer).CheckPortAuthorization(ctx, req.(*CheckPortAuthorizationRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _KurtosisCloudBackendServer_UnlockPort_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(UnlockPortRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KurtosisCloudBackendServerServer).UnlockPort(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: KurtosisCloudBackendServer_UnlockPort_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KurtosisCloudBackendServerServer).UnlockPort(ctx, req.(*UnlockPortRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _KurtosisCloudBackendServer_LockPort_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(LockPortRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KurtosisCloudBackendServerServer).LockPort(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: KurtosisCloudBackendServer_LockPort_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KurtosisCloudBackendServerServer).LockPort(ctx, req.(*LockPortRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
+func _KurtosisCloudBackendServer_GetUnlockedPorts_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) {
+	in := new(GetUnlockedPortsRequest)
+	if err := dec(in); err != nil {
+		return nil, err
+	}
+	if interceptor == nil {
+		return srv.(KurtosisCloudBackendServerServer).GetUnlockedPorts(ctx, in)
+	}
+	info := &grpc.UnaryServerInfo{
+		Server:     srv,
+		FullMethod: KurtosisCloudBackendServer_GetUnlockedPorts_FullMethodName,
+	}
+	handler := func(ctx context.Context, req interface{}) (interface{}, error) {
+		return srv.(KurtosisCloudBackendServerServer).GetUnlockedPorts(ctx, req.(*GetUnlockedPortsRequest))
+	}
+	return interceptor(ctx, in, info, handler)
+}
+
 // KurtosisCloudBackendServer_ServiceDesc is the grpc.ServiceDesc for KurtosisCloudBackendServer service.
 // It's only intended for direct use with grpc.RegisterService,
 // and not to be introspected or modified (even as a copy)
@@ -361,6 +493,22 @@ var KurtosisCloudBackendServer_ServiceDesc = grpc.ServiceDesc{
 			MethodName: "UpdateAddress",
 			Handler:    _KurtosisCloudBackendServer_UpdateAddress_Handler,
 		},
+		{
+			MethodName: "CheckPortAuthorization",
+			Handler:    _KurtosisCloudBackendServer_CheckPortAuthorization_Handler,
+		},
+		{
+			MethodName: "UnlockPort",
+			Handler:    _KurtosisCloudBackendServer_UnlockPort_Handler,
+		},
+		{
+			MethodName: "LockPort",
+			Handler:    _KurtosisCloudBackendServer_LockPort_Handler,
+		},
+		{
+			MethodName: "GetUnlockedPorts",
+			Handler:    _KurtosisCloudBackendServer_GetUnlockedPorts_Handler,
+		},
 	},
 	Streams:  []grpc.StreamDesc{},
 	Metadata: "kurtosis_backend_server_api.proto",
diff --git a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_rpc_api_bindingsconnect/kurtosis_backend_server_api.connect.go b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_rpc_api_bindingsconnect/kurtosis_backend_server_api.connect.go
index d1d7abe730..06f268d24a 100644
--- a/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_rpc_api_bindingsconnect/kurtosis_backend_server_api.connect.go
+++ b/cloud/api/golang/kurtosis_backend_server_rpc_api_bindings/kurtosis_backend_server_rpc_api_bindingsconnect/kurtosis_backend_server_api.connect.go
@@ -59,6 +59,18 @@ const (
 	// KurtosisCloudBackendServerUpdateAddressProcedure is the fully-qualified name of the
 	// KurtosisCloudBackendServer's UpdateAddress RPC.
 	KurtosisCloudBackendServerUpdateAddressProcedure = "/kurtosis_cloud.KurtosisCloudBackendServer/UpdateAddress"
+	// KurtosisCloudBackendServerCheckPortAuthorizationProcedure is the fully-qualified name of the
+	// KurtosisCloudBackendServer's CheckPortAuthorization RPC.
+	KurtosisCloudBackendServerCheckPortAuthorizationProcedure = "/kurtosis_cloud.KurtosisCloudBackendServer/CheckPortAuthorization"
+	// KurtosisCloudBackendServerUnlockPortProcedure is the fully-qualified name of the
+	// KurtosisCloudBackendServer's UnlockPort RPC.
+	KurtosisCloudBackendServerUnlockPortProcedure = "/kurtosis_cloud.KurtosisCloudBackendServer/UnlockPort"
+	// KurtosisCloudBackendServerLockPortProcedure is the fully-qualified name of the
+	// KurtosisCloudBackendServer's LockPort RPC.
+	KurtosisCloudBackendServerLockPortProcedure = "/kurtosis_cloud.KurtosisCloudBackendServer/LockPort"
+	// KurtosisCloudBackendServerGetUnlockedPortsProcedure is the fully-qualified name of the
+	// KurtosisCloudBackendServer's GetUnlockedPorts RPC.
+	KurtosisCloudBackendServerGetUnlockedPortsProcedure = "/kurtosis_cloud.KurtosisCloudBackendServer/GetUnlockedPorts"
 )
 
 // KurtosisCloudBackendServerClient is a client for the kurtosis_cloud.KurtosisCloudBackendServer
@@ -72,6 +84,10 @@ type KurtosisCloudBackendServerClient interface {
 	RefreshDefaultPaymentMethod(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.RefreshDefaultPaymentMethodArgs]) (*connect.Response[emptypb.Empty], error)
 	CancelPaymentSubscription(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.CancelPaymentSubscriptionArgs]) (*connect.Response[emptypb.Empty], error)
 	UpdateAddress(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UpdateAddressArgs]) (*connect.Response[emptypb.Empty], error)
+	CheckPortAuthorization(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest]) (*connect.Response[emptypb.Empty], error)
+	UnlockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest]) (*connect.Response[emptypb.Empty], error)
+	LockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.LockPortRequest]) (*connect.Response[emptypb.Empty], error)
+	GetUnlockedPorts(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest]) (*connect.Response[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse], error)
 }
 
 // NewKurtosisCloudBackendServerClient constructs a client for the
@@ -126,6 +142,26 @@ func NewKurtosisCloudBackendServerClient(httpClient connect.HTTPClient, baseURL
 			baseURL+KurtosisCloudBackendServerUpdateAddressProcedure,
 			opts...,
 		),
+		checkPortAuthorization: connect.NewClient[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest, emptypb.Empty](
+			httpClient,
+			baseURL+KurtosisCloudBackendServerCheckPortAuthorizationProcedure,
+			opts...,
+		),
+		unlockPort: connect.NewClient[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest, emptypb.Empty](
+			httpClient,
+			baseURL+KurtosisCloudBackendServerUnlockPortProcedure,
+			opts...,
+		),
+		lockPort: connect.NewClient[kurtosis_backend_server_rpc_api_bindings.LockPortRequest, emptypb.Empty](
+			httpClient,
+			baseURL+KurtosisCloudBackendServerLockPortProcedure,
+			opts...,
+		),
+		getUnlockedPorts: connect.NewClient[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest, kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse](
+			httpClient,
+			baseURL+KurtosisCloudBackendServerGetUnlockedPortsProcedure,
+			opts...,
+		),
 	}
 }
 
@@ -139,6 +175,10 @@ type kurtosisCloudBackendServerClient struct {
 	refreshDefaultPaymentMethod *connect.Client[kurtosis_backend_server_rpc_api_bindings.RefreshDefaultPaymentMethodArgs, emptypb.Empty]
 	cancelPaymentSubscription   *connect.Client[kurtosis_backend_server_rpc_api_bindings.CancelPaymentSubscriptionArgs, emptypb.Empty]
 	updateAddress               *connect.Client[kurtosis_backend_server_rpc_api_bindings.UpdateAddressArgs, emptypb.Empty]
+	checkPortAuthorization      *connect.Client[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest, emptypb.Empty]
+	unlockPort                  *connect.Client[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest, emptypb.Empty]
+	lockPort                    *connect.Client[kurtosis_backend_server_rpc_api_bindings.LockPortRequest, emptypb.Empty]
+	getUnlockedPorts            *connect.Client[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest, kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse]
 }
 
 // IsAvailable calls kurtosis_cloud.KurtosisCloudBackendServer.IsAvailable.
@@ -184,6 +224,26 @@ func (c *kurtosisCloudBackendServerClient) UpdateAddress(ctx context.Context, re
 	return c.updateAddress.CallUnary(ctx, req)
 }
 
+// CheckPortAuthorization calls kurtosis_cloud.KurtosisCloudBackendServer.CheckPortAuthorization.
+func (c *kurtosisCloudBackendServerClient) CheckPortAuthorization(ctx context.Context, req *connect.Request[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.checkPortAuthorization.CallUnary(ctx, req)
+}
+
+// UnlockPort calls kurtosis_cloud.KurtosisCloudBackendServer.UnlockPort.
+func (c *kurtosisCloudBackendServerClient) UnlockPort(ctx context.Context, req *connect.Request[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.unlockPort.CallUnary(ctx, req)
+}
+
+// LockPort calls kurtosis_cloud.KurtosisCloudBackendServer.LockPort.
+func (c *kurtosisCloudBackendServerClient) LockPort(ctx context.Context, req *connect.Request[kurtosis_backend_server_rpc_api_bindings.LockPortRequest]) (*connect.Response[emptypb.Empty], error) {
+	return c.lockPort.CallUnary(ctx, req)
+}
+
+// GetUnlockedPorts calls kurtosis_cloud.KurtosisCloudBackendServer.GetUnlockedPorts.
+func (c *kurtosisCloudBackendServerClient) GetUnlockedPorts(ctx context.Context, req *connect.Request[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest]) (*connect.Response[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse], error) {
+	return c.getUnlockedPorts.CallUnary(ctx, req)
+}
+
 // KurtosisCloudBackendServerHandler is an implementation of the
 // kurtosis_cloud.KurtosisCloudBackendServer service.
 type KurtosisCloudBackendServerHandler interface {
@@ -195,6 +255,10 @@ type KurtosisCloudBackendServerHandler interface {
 	RefreshDefaultPaymentMethod(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.RefreshDefaultPaymentMethodArgs]) (*connect.Response[emptypb.Empty], error)
 	CancelPaymentSubscription(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.CancelPaymentSubscriptionArgs]) (*connect.Response[emptypb.Empty], error)
 	UpdateAddress(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UpdateAddressArgs]) (*connect.Response[emptypb.Empty], error)
+	CheckPortAuthorization(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest]) (*connect.Response[emptypb.Empty], error)
+	UnlockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest]) (*connect.Response[emptypb.Empty], error)
+	LockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.LockPortRequest]) (*connect.Response[emptypb.Empty], error)
+	GetUnlockedPorts(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest]) (*connect.Response[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse], error)
 }
 
 // NewKurtosisCloudBackendServerHandler builds an HTTP handler from the service implementation. It
@@ -245,6 +309,26 @@ func NewKurtosisCloudBackendServerHandler(svc KurtosisCloudBackendServerHandler,
 		svc.UpdateAddress,
 		opts...,
 	)
+	kurtosisCloudBackendServerCheckPortAuthorizationHandler := connect.NewUnaryHandler(
+		KurtosisCloudBackendServerCheckPortAuthorizationProcedure,
+		svc.CheckPortAuthorization,
+		opts...,
+	)
+	kurtosisCloudBackendServerUnlockPortHandler := connect.NewUnaryHandler(
+		KurtosisCloudBackendServerUnlockPortProcedure,
+		svc.UnlockPort,
+		opts...,
+	)
+	kurtosisCloudBackendServerLockPortHandler := connect.NewUnaryHandler(
+		KurtosisCloudBackendServerLockPortProcedure,
+		svc.LockPort,
+		opts...,
+	)
+	kurtosisCloudBackendServerGetUnlockedPortsHandler := connect.NewUnaryHandler(
+		KurtosisCloudBackendServerGetUnlockedPortsProcedure,
+		svc.GetUnlockedPorts,
+		opts...,
+	)
 	return "/kurtosis_cloud.KurtosisCloudBackendServer/", http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		switch r.URL.Path {
 		case KurtosisCloudBackendServerIsAvailableProcedure:
@@ -263,6 +347,14 @@ func NewKurtosisCloudBackendServerHandler(svc KurtosisCloudBackendServerHandler,
 			kurtosisCloudBackendServerCancelPaymentSubscriptionHandler.ServeHTTP(w, r)
 		case KurtosisCloudBackendServerUpdateAddressProcedure:
 			kurtosisCloudBackendServerUpdateAddressHandler.ServeHTTP(w, r)
+		case KurtosisCloudBackendServerCheckPortAuthorizationProcedure:
+			kurtosisCloudBackendServerCheckPortAuthorizationHandler.ServeHTTP(w, r)
+		case KurtosisCloudBackendServerUnlockPortProcedure:
+			kurtosisCloudBackendServerUnlockPortHandler.ServeHTTP(w, r)
+		case KurtosisCloudBackendServerLockPortProcedure:
+			kurtosisCloudBackendServerLockPortHandler.ServeHTTP(w, r)
+		case KurtosisCloudBackendServerGetUnlockedPortsProcedure:
+			kurtosisCloudBackendServerGetUnlockedPortsHandler.ServeHTTP(w, r)
 		default:
 			http.NotFound(w, r)
 		}
@@ -303,3 +395,19 @@ func (UnimplementedKurtosisCloudBackendServerHandler) CancelPaymentSubscription(
 func (UnimplementedKurtosisCloudBackendServerHandler) UpdateAddress(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UpdateAddressArgs]) (*connect.Response[emptypb.Empty], error) {
 	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("kurtosis_cloud.KurtosisCloudBackendServer.UpdateAddress is not implemented"))
 }
+
+func (UnimplementedKurtosisCloudBackendServerHandler) CheckPortAuthorization(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.CheckPortAuthorizationRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("kurtosis_cloud.KurtosisCloudBackendServer.CheckPortAuthorization is not implemented"))
+}
+
+func (UnimplementedKurtosisCloudBackendServerHandler) UnlockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.UnlockPortRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("kurtosis_cloud.KurtosisCloudBackendServer.UnlockPort is not implemented"))
+}
+
+func (UnimplementedKurtosisCloudBackendServerHandler) LockPort(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.LockPortRequest]) (*connect.Response[emptypb.Empty], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("kurtosis_cloud.KurtosisCloudBackendServer.LockPort is not implemented"))
+}
+
+func (UnimplementedKurtosisCloudBackendServerHandler) GetUnlockedPorts(context.Context, *connect.Request[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsRequest]) (*connect.Response[kurtosis_backend_server_rpc_api_bindings.GetUnlockedPortsResponse], error) {
+	return nil, connect.NewError(connect.CodeUnimplemented, errors.New("kurtosis_cloud.KurtosisCloudBackendServer.GetUnlockedPorts is not implemented"))
+}
diff --git a/cloud/api/protobuf/kurtosis_backend_server_api.proto b/cloud/api/protobuf/kurtosis_backend_server_api.proto
index f0999062f9..db1ce7fbcc 100644
--- a/cloud/api/protobuf/kurtosis_backend_server_api.proto
+++ b/cloud/api/protobuf/kurtosis_backend_server_api.proto
@@ -19,6 +19,10 @@ service KurtosisCloudBackendServer {
   rpc RefreshDefaultPaymentMethod (RefreshDefaultPaymentMethodArgs) returns (google.protobuf.Empty) {};
   rpc CancelPaymentSubscription (CancelPaymentSubscriptionArgs) returns (google.protobuf.Empty) {};
   rpc UpdateAddress(UpdateAddressArgs) returns (google.protobuf.Empty) {};
+  rpc CheckPortAuthorization(CheckPortAuthorizationRequest) returns(google.protobuf.Empty){};
+  rpc UnlockPort(UnlockPortRequest) returns(google.protobuf.Empty){};
+  rpc LockPort(LockPortRequest) returns(google.protobuf.Empty){};
+  rpc GetUnlockedPorts(GetUnlockedPortsRequest) returns(GetUnlockedPortsResponse){}
 }
 
 message GetOrCreateApiKeyRequest {
@@ -139,3 +143,31 @@ message UpdateAddressArgs {
   string postal_code = 7;
   string country = 8;
 }
+
+message GetUnlockedPortsRequest {
+  string instance_short_uuid=1;
+  string enclave_short_uuid=2;
+}
+
+message CheckPortAuthorizationRequest {
+  Port port = 1;
+}
+
+message UnlockPortRequest {
+  Port port = 1;
+}
+
+message LockPortRequest {
+  Port port = 1;
+}
+
+message Port {
+  uint32 port_number=1;
+  string instance_short_uuid=2;
+  string service_short_uuid=3;
+  string enclave_short_uuid=4;
+}
+
+message GetUnlockedPortsResponse {
+  repeated Port port = 1;
+}