Networking

Public addresses

Every machine gets its own public IPv6 address, free. You can also reserve public IPv4 addresses and attach one to a machine. Addresses stay with the machine when it sleeps. (A sandbox has no public address and can't be given one: see Sandboxes.)

ssh ip@shell.639cloud.com list
ssh ip@shell.639cloud.com reserve                  # billed monthly while reserved
ssh ip@shell.639cloud.com attach ADDRESS web-1
ssh ip@shell.639cloud.com detach ADDRESS           # stays reserved
ssh ip@shell.639cloud.com release ADDRESS          # detach first

Opening ports

Inbound traffic is closed until you open ports. The list applies to both the machine's IPv4 and IPv6.

ssh ip@shell.639cloud.com inbound web-1                       # show
ssh ip@shell.639cloud.com inbound web-1 443 udp:51820 icmp     # open these
ssh ip@shell.639cloud.com inbound web-1 22 from 203.0.113.0/24  # only from a range
ssh ip@shell.639cloud.com inbound web-1 none                   # close everything

Agents (an API key, MCP, an ssh command) can't open SSH (22), the Docker API (2375, 2376), MySQL (3306), PostgreSQL (5432), Redis (6379), Elasticsearch (9200), memcached (11211) or MongoDB (27017) wider than a /16 (IPv4) or /32 (IPv6) in all: they give a range (22 from 203.0.113.0/24), or a person opens it in the app.

A sleeping machine doesn't answer traffic on its public address until something wakes it.

Private networks (VPCs)

A VPC is a private network between your machines. Members reach each other on eth1 at stable addresses, and machines join or leave live.

ssh vpc@shell.639cloud.com create backend               # picks a free /16
ssh vpc@shell.639cloud.com create backend 10.20.0.0/24  # or choose the range
ssh vpc@shell.639cloud.com attach ubuntu-1 backend
ssh vpc@shell.639cloud.com detach ubuntu-1
ssh vpc@shell.639cloud.com delete backend               # must be empty
ssh vpc@shell.639cloud.com list

Ranges are /16 to /28 inside 10.0.0.0/8 or 192.168.0.0/16.

VPC traffic doesn't wake a machine: while a member is asleep, packets sent to it are dropped. For a machine others reach over the VPC (a database, an internal API), turn auto-sleep off.

Outbound rules

Per machine, the internet is either on with a deny list or off with an allow list (machine page → Internet, the API's network field, or the MCP tool set_network):

{"internet": false, "allow": ["1.1.1.1:53", "151.101.0.0/16:443"]}
{"internet": true,  "deny":  ["203.0.113.0/24"]}

Allow a DNS server when the allowed hosts are reached by name. Outbound email (port 25) is always blocked.

To allow sites by name instead, with the internet off, add presets (github, packages, model-apis) or names of your own (api.example.com, *.example.com):

{"internet": false, "presets": ["github", "packages"], "allow_names": ["*.example.com"]}

The machine can then reach those sites over HTTPS and HTTP, and look names up (DNS to 1.1.1.1 and 1.0.0.1); other traffic stays blocked. Each connection is checked by the site name the program asks for (the TLS server name or the HTTP Host); content isn't decrypted or changed. A name check can't tell apart sites that share an address (a CDN), so it narrows what code can reach rather than sealing it. A machine has up to 256 such connections open at once, within its usual connection limits.

This page as Markdown: /docs/networking.md