Networking

Last updated

Networking here is deliberately simple, and one property of it shapes almost every design decision: there is no private networking.

Every port binding is public

When you bind a container port, it becomes reachable from the internet. There is no internal-only option, no VPC, and no private DNS between your applications.

So if your app talks to a database you also run here, that traffic goes over a public endpoint protected by credentials. Plan accordingly:

  • Use a long random password — it is the entire boundary, not a formality.
  • Remove a port binding when nothing external needs it.
  • Prefer combining two services into one app over exposing an internal one. See Databases.

The three protocols

Protocol What you get
HTTPS A public hostname with a valid certificate, TLS terminated at the edge, traffic forwarded to your container port as plain HTTP
TCP A raw TCP endpoint on a platform host and a generated high port number
UDP The same, for UDP

For HTTPS you get a generated hostname of the form a<appId>-<hash>.<platform-domain>, and you can set your own subdomain label instead. Certificates are automatic — there is nothing to upload or renew.

TCP and UDP bindings are given a generated high port number, not the port you chose inside the container. That matters for anything expecting a standard port, such as git over SSH on 22.

Bind to 0.0.0.0, not localhost

Your app must listen on all interfaces. A server bound to 127.0.0.1 is reachable only from inside its own container, so the router in front of it gets nothing.

This is the most common cause of "the deploy succeeded but the URL doesn't work", and because nothing probes your app, the deploy still reports success.

# reachable                    # not reachable
0.0.0.0:8000                   127.0.0.1:8000

Workers need no ports at all

If your app makes outbound connections only — a Discord or Telegram bot, a queue consumer, a poller — don't bind a port. There's nothing to route, nothing to expose, and nothing to keep awake.

What the edge does and doesn't do

The edge terminates TLS and routes by hostname. That's all.

There is no web application firewall, rate limiting, IP allowlist, request buffering, or authentication in front of your app. Every protection your service has is one you build into it.