---
title: "Connect a container environment to a private network (VPC)"
description: "Let your containers reach your Istanbul servers privately from a fixed address range, and let the servers call your services at a private endpoint. Free."
url: https://www.gyrohosting.com/developers/en/howto/container-vpc.html
language: en
openapi: https://www.gyrohosting.com/developers/openapi.json
api_version: 2.34.0
---

# Connect a container environment to a private network (VPC)

Let your containers reach your Istanbul servers privately from a fixed address range, and let the servers call your services at a private endpoint. Free.

**curl**

```bash
# attach (node environments: Mini, Small, Starter, Standard, Pro; subnet /26 or larger)
curl -s -X PUT https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/vpc -H "Authorization: Bearer $GYRO_TOKEN" -H "Content-Type: application/json" \
  -d '{"vpc_id":"vpc-1a2b3c4d","subnet_id":"sn-5e6f7a8b","expose":[{"service":"api","port":8080}]}'
# ready in about a minute: source_range (fixed /28) and endpoint_ip
curl -s https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/vpc -H "Authorization: Bearer $GYRO_TOKEN"
```

**CLI**

```bash
gyro container vpc attach 12345 --vpc vpc-1a2b3c4d --subnet sn-5e6f7a8b --expose api:8080 --wait
gyro container vpc get 12345
gyro container vpc expose 12345 --expose api:8080 --expose web:80
gyro container vpc detach 12345 --wait
```

**Terraform**

```hcl
resource "gyro_container_vpc_attachment" "app" {
  environment_id = gyro_container_environment.gyro_proje.id
  vpc_id         = gyro_vpc.uretim.id
  subnet_id      = gyro_vpc.uretim.default_subnet_id
  expose {
    service = "api"
    port    = 8080
  }
}
```

The environment gets a **VPC source range**: a fixed /28 (16 addresses) inside the subnet. Connections from your containers to the VPC servers (database, cache, internal APIs) come from this range, and it does **not** change when nodes are replaced, scaled, renewed or the plan changes — allow it once in the server firewall. The first address is the **VPC endpoint**: VPC servers reach a published service at `endpoint_ip:port` (it connects to the service's internal address `<service>.<namespace>.svc.cluster.local:80`). The endpoint is never reachable from the internet. No gateway is needed and VPC traffic is free.

Limits: one VPC subnet per environment at a time, at most 20 published services, each port once; ports 22, 2200, 6443, 9100, 9750, 10250-10256, 30000-32767 and 51820-51821 are reserved. A detached environment that is attached again may get a different range. Serverless environments: coming later.


## Limit who can use a port forward

**CLI**

```bash
gyro vpc port-forward add vpc-1a2b3c4d --protocol tcp --public-port 2222 --target-ip 10.10.1.10 --target-port 22 --source 203.0.113.10 --yes
gyro vpc port-forward update vpc-1a2b3c4d pf-9c8b7a6d --source 203.0.113.10 --source 198.51.100.0/24
gyro vpc port-forward update vpc-1a2b3c4d pf-9c8b7a6d --any
```

**curl**

```bash
curl -s -X PATCH https://www.gyrohosting.com/api/v1/client/cloud/vpcs/vpc-1a2b3c4d/port-forwards/pf-9c8b7a6d -H "Authorization: Bearer $GYRO_TOKEN" \
  -H "Content-Type: application/json" -d '{"source_cidrs":["203.0.113.10/32","198.51.100.0/24"]}'
```

`source_cidrs` takes up to 20 public IPv4 networks (a single IP is /32; write the network address). An empty list means everyone. Recommended for SSH, RDP and databases.