Skip to main content

Networking model

Networking is assembled from three independent parts: a project's private networks, the attachments of VMs to those networks, and public IPs with their port forwarding rules. They work together, but their lifecycles are separate.

How the model is put together

  • A project can own one or more private networks.
  • The address range is assigned by the platform: you do not pass cidr when creating a network.

  • VMs attach to a network through an explicit call and receive an internal address.
  • Public IPs are project resources in their own right. Port forwarding rules are created inside a specific publicIpId.

  • When creating a VM, publicIpMode decides whether to take a new address, use an existing one, or go without a public address.

  • Networks and public IPs expose a status field just like VMs do, so you can tell whether the resource is ready or an operation is still running on it.

  1. 1

    Create a private network or take an existing one

    A network gives VMs a shared internal perimeter inside the project. The subnet is assigned automatically — there is nothing to set by hand.

  2. 2

    Attach the VM and read its address

    Attachment and update calls determine where the VM sits in the network. The internal address is assigned by the platform — read it from the resource state rather than deriving it yourself.

  3. 3

    Allocate a public IP or find a ready one

    External access is configured on a separate public IP resource, not on the network. It can be allocated up front and reused.

  4. 4

    Add port forwarding rules

    A rule ties an external port and protocol to a VM and a port inside the project network.

Deletion

A public IP is released by its own delete request. Deleting a network does not touch it: they are different resources. While the address is still in use, releasing it fails with 409 Conflict.

The dashboard and the API group these differently

A dashboard may show a private network and external access side by side as one thing. In the API they remain separate resources: networks own the internal topology, public IPs own the external address and its forwarding rules.