Network addressing and traffic

Every Instance gets a private IPv6 address on the network that its workload attaches to. This page describes the address plan, the traffic that a network carries, and how Instances connect to each other.

Galactic VPC is in preview, and the networking.datumapis.com/v1alpha API can change.

How Instances get addresses

Datum assigns all addresses. You don’t choose address ranges or plan subnets. The following table describes each level of the address plan:

Level	Address space	Details
Network	A `/48` IPv6 prefix	Datum assigns the prefix from the unique local range `fd00::/8` when you create the network. Prefixes don’t overlap between networks or projects. The `IPV6PREFIX` column of `datumctl get networks` shows the prefix.
Location	A `/64` from the network’s prefix	Datum assigns one to each location where Instances on the network run.
Instance	A `/96` block from the location’s `/64`	Each Instance’s network interface owns the whole block. The block’s primary address is the Instance’s private IPv6 address.

Inside the Instance, the interface is named eth0, and it has IPv6 addresses only. Unique local addresses are private: they aren’t routable on the internet. To find your Instances’ addresses, run the following command:

datumctl compute instances --workload=WORKLOAD_NAME

Replace WORKLOAD_NAME with the name of your workload. The INTERNAL IP column shows each Instance’s primary private IPv6 address. For all the addresses on an Instance’s interface, run datumctl compute instances describe INSTANCE_NAME.

What traffic a network carries

A network carries private traffic between Instances. The following table describes which kinds of traffic are possible:

Traffic	Available	Details
Between Instances on the same network in the same location	Yes	Instances use their private IPv6 addresses. Any Instance can connect to any port on another Instance in the same network and location.
Between Instances on the same network in different locations	Not guaranteed	A network spans locations, but Datum doesn’t guarantee private connectivity between locations. Don’t depend on it for production traffic.
Between different networks	No	Networks are isolated from each other.
Inbound from the internet	Through Datum’s ALB	Instance addresses aren’t reachable from the internet directly. Public HTTP and HTTPS traffic reaches Instances through Datum’s Application Load Balancer. Raw TCP and UDP exposure is a preview limitation.
Outbound to the internet	Not in the preview	Outbound internet access is on the roadmap, starting with IPv6 destinations, and IPv4 destinations are also planned. During the preview, don’t depend on calling external APIs or package registries from an Instance. Image pulls aren’t affected, because Datum pulls images outside the Instance.
Lookups by name	Not in the preview	Private DNS names for Instances are on the roadmap. Use IPv6 addresses in the preview.
Firewall filtering	Not in the preview	Firewall rules to filter traffic between Instances on a network are on the roadmap.

The workload API accepts a networkPolicy field on each network interface, but the field has no effect. Don’t rely on it to restrict traffic. To limit who can reach a service, check credentials in your app, or put services that must stay apart on different networks. Firewall rules for networks are on the roadmap.

Connect to other Instances

To connect from one Instance to another on the same network, use the peer’s private IPv6 address. Keep the following points in mind:

Make your app listen on IPv6 (::). An app that listens only on 0.0.0.0 accepts IPv4 connections only, and Instances don’t have IPv4 addresses.
In a URL, put an IPv6 address in square brackets, such as http://[fd20:4a3b:91c2:1::1:0:2]:8080/.
Private DNS names aren’t available in the preview. To tell an app about its peers, pass their addresses in environment variables or a ConfigMap.

What’s next

To create a network and attach a workload to it, see Create and manage networks.
To serve a workload publicly through Datum’s ALB, see Publish a workload.
To review what networks can’t do, see Networking limitations and roadmap.

Documentation

TLDR

Platform

Galactic VPC

ALB

Connectors

Compute

Domains & DNS

Agents

Network addressing and traffic

How Instances get addresses

What traffic a network carries

Connect to other Instances

What’s next

​How Instances get addresses

​What traffic a network carries

​Connect to other Instances

​What’s next

How Instances get addresses

What traffic a network carries

Connect to other Instances

What’s next