Connect a container environment to a private network (VPC)

Let your containers reach your Istanbul servers privately from a fixed address range, and let the servers call your services at a private endpoint. Free.

# attach (node environments: Mini, Small, Starter, Standard, Pro; subnet /26 or larger)
curl -s -X PUT https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/vpc -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"vpc_id":"vpc-1a2b3c4d","subnet_id":"sn-5e6f7a8b","expose":[{"service":"api","port":8080}]}'
# ready in about a minute: source_range (fixed /28) and endpoint_ip
curl -s https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/vpc -H "Authorization: Bearer $GYRO_TOKEN"

gyro container vpc attach 12345 --vpc vpc-1a2b3c4d --subnet sn-5e6f7a8b --expose api:8080 --wait
gyro container vpc get 12345
gyro container vpc expose 12345 --expose api:8080 --expose web:80
gyro container vpc detach 12345 --wait

resource "gyro_container_vpc_attachment" "app" {
  environment_id = gyro_container_environment.gyro_proje.id
  vpc_id         = gyro_vpc.uretim.id
  subnet_id      = gyro_vpc.uretim.default_subnet_id
  expose {
    service = "api"
    port    = 8080
  }
}

The environment gets a VPC source range: a fixed /28 (16 addresses) inside the subnet. Connections from your containers to the VPC servers (database, cache, internal APIs) come from this range, and it does not change when nodes are replaced, scaled, renewed or the plan changes — allow it once in the server firewall. The first address is the VPC endpoint: VPC servers reach a published service at endpoint_ip:port (it connects to the service's internal address <service>.<namespace>.svc.cluster.local:80). The endpoint is never reachable from the internet. No gateway is needed and VPC traffic is free.

Limits: one VPC subnet per environment at a time, at most 20 published services, each port once; ports 22, 2200, 6443, 9100, 9750, 10250-10256, 30000-32767 and 51820-51821 are reserved. A detached environment that is attached again may get a different range. Serverless environments: coming later.

Limit who can use a port forward#

gyro vpc port-forward add vpc-1a2b3c4d --protocol tcp --public-port 2222 --target-ip 10.10.1.10 --target-port 22 --source 203.0.113.10 --yes
gyro vpc port-forward update vpc-1a2b3c4d pf-9c8b7a6d --source 203.0.113.10 --source 198.51.100.0/24
gyro vpc port-forward update vpc-1a2b3c4d pf-9c8b7a6d --any

curl -s -X PATCH https://www.gyrohosting.com/api/v1/client/cloud/vpcs/vpc-1a2b3c4d/port-forwards/pf-9c8b7a6d -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" -d '{"source_cidrs":["203.0.113.10/32","198.51.100.0/24"]}'

source_cidrs takes up to 20 public IPv4 networks (a single IP is /32; write the network address). An empty list means everyone. Recommended for SSH, RDP and databases.