# Gyro Containers: egress IPs, namespace and service-to-service traffic

https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-egress-ip-and-internal-address

- **What you will learn**: which IPv4 addresses your services reach the internet from (for the IP allow list of a database, payment provider or partner API), your environment's Kubernetes namespace and how services of the same environment reach each other.
- **Time**: 5 minutes

## 1. Finding the egress IPs

1. Open **Management > Node Pool** in your environment. The **Network: egress IPs and internal addressing** card at the top has the current list.
2. Use **Copy all** and add **all** addresses to the IP allow list of the external service.
3. A short summary is also shown on top of the **Services** page.

```
gyro container egress-ips 12345
curl -s https://www.gyrohosting.com/api/v1/client/cloud/containers/12345/egress-ips -H "Authorization: Bearer $GYRO_TOKEN"
```

Terraform:

```
data "gyro_container_environment" "app" { service_id = 12345 }
output "egress_ips" { value = data.gyro_container_environment.app.egress_ips }
```

## 2. Which IP is used?

Container traffic leaves to the internet from the IP of the node the container runs on (there is no separate NAT gateway).

| Environment | Egress IPs |
| --- | --- |
| Dedicated nodes (Mini, Small, Starter ...) | The IPs of your own nodes + the shared pool node **during updates**: the new copy starts on the shared pool for about a minute, then moves back to your node. It is marked "During updates" in the list; add it to the allow list too. |
| Serverless | The IPs of the shared sandboxed pool nodes. When the pool grows a new address can be added. |
| Gyro Pipeline builds | Build machines (only while downloading code / archives). Listed separately. |

- The list changes **when the nodes change**: plan change, node replacement, pool growth or shrink.
- When it changes the owner is **notified** through the channels on the Notifications page (e-mail, Telegram, webhook). Event **Egress IPs changed** (`egress`); you can turn it off.
- IPv4 only. Outbound TCP 25 (SMTP) is closed.

## 3. Namespace and internal addressing

- Every environment has a Kubernetes **namespace** (e.g. `t-canli-12345`). It is shown in **Node Pool > Network** and on top of the Services page, in the API answer of `GET /cloud/containers/{id}` (`namespace`, `cluster_dns`) and with `gyro container get 12345`.
- Services of the same environment reach each other without going to the internet:
  - Full name: `<service>.<namespace>.svc.cluster.local:80` (e.g. `api.t-canli-12345.svc.cluster.local:80`)
  - Short name: `<service>:80` (e.g. `http://api`)
- Always connect to port **80**; it is forwarded to the service's own port (e.g. 8080). Only services with a port have an internal address.
- The service detail shows **Internal address (same environment)** with a copy button; API `internal.address`, Terraform `gyro_container_service.<name>.internal_address`.
- Other environments (yours or other customers') cannot reach these addresses.

## 4. Frequently asked questions

**Can I get a fixed egress IP?**

Today the egress IP follows the nodes. You are notified when the list changes; update the external allow list then.

**Why is a shared pool address listed for a dedicated environment?**

Updates are seamless because the new copy starts on the shared pool for a short time. Meanwhile it connects to external services from that address; if it is not on the allow list those connections are refused for that minute.

**The short name ( http://api ) does not answer. Why?**

The target service needs a port and must be in the same environment, with at least one ready copy; a brand-new service answers after a few seconds.

## Next step

- [Autoscaling and alerts](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-autoscaling-and-alerts)
- [API, CLI and Terraform](https://www.gyrohosting.com/en/knowledgebase/article/gyro-containers-api-cli-terraform)