|
6 | 6 | - validation: 2025-07-29 |
7 | 7 | --- |
8 | 8 |
|
9 | | -## Description |
| 9 | +## Compatibility |
10 | 10 |
|
11 | | -Attach a Serverless Function or Container to a Private Network. |
| 11 | +Scaleway Serverless Containers support [Virtual Private Cloud (VPC)](/vpc/) and can be attached to a Private Network, which allows you to securely connect your resources in an isolated environment. Refer to the [dedicated documentation](/serverless-containers/how-to/use-private-networks/) for more information. |
12 | 12 |
|
13 | | -### Availability |
| 13 | +## Features |
14 | 14 |
|
15 | | -- Binding is done per Function or Container, not per namespace: multiple functions/containers in the same namespace can be attached to different PNs |
16 | | -- Works for both sandboxes (v1, v2) |
17 | | -- Feature is free of charge |
| 15 | +- Containers in the same namespace can be attached to different Private Networks. |
| 16 | +- Both [sandbox](/serverless-containers/concepts/#sandbox) environments (`V1` and `V2`) are compatible with Private Networks. |
| 17 | +- Attaching Serverless Containers to Private Networks **does not entail additional cost**. |
| 18 | +- **Egress** (outbound private traffic from a container to resources within the same Private Network) will be routed through the private interface, but external traffic (from the Internet) will be through the public endpoint of the container. |
| 19 | +- All DNS resolution is done through the Private Network (using the VPC DNS server `169.254.169.254`), which allows to resolve `*.internal` records. |
18 | 20 |
|
19 | | -### Features |
20 | | -Container to PN resources (egress) |
21 | | -Currently, no ingress (PN resources to container) |
22 | | -but container still available through public traffic |
| 21 | +## Quotas |
23 | 22 |
|
24 | | -- All internal traffic (to PN) will be routed through the private interface, but external traffic (Internet) will be through the public (already existing) interface |
| 23 | +Refer to the [dedicated documentation](/organizations-and-projects/additional-content/organization-quotas/) for more information on Private Networks quotas for Serverless Containers. |
25 | 24 |
|
26 | | -- All DNS resolution is done through PN (using DNS server `169.254.169.254` (=VPC dns server)). This allows to resolve `*.internal` records |
27 | | - |
28 | | - |
29 | | - |
30 | | - |
31 | | -## Users limitations |
32 | | - |
33 | | -### API |
34 | | - |
35 | | -- A Function/Container can **only** be attached to a single PN |
36 | | -- extra quota for VPC via Containers (Container Unique Private Networks) 5/10 |
37 | | -- UPDATE QUOTAS DOC |
38 | | - |
39 | | - |
40 | | - |
41 | | -### Infrastructure |
42 | | - |
43 | | -- **VPC routing** (custom routes) doesn't work yet |
44 | | - |
45 | | -- Each Function/Container instance will have a unique IP in the PN, assigned by Scaleway. this implies: |
46 | | - - it won't be possible for a user to **preemptively book an IP** in IPAM, and reference it in the attachment |
47 | | - - this can result in a **large number of IPs** being used in the PN. It might be confusing for clients as a single resource (a given Function/Container) with multiple instances will have multiple IPs |
48 | | - |
49 | | -- **Cold-starts will be slightly longer** due to the additional steps required to attach the node to the PN and book an IP. |
50 | | - |
51 | | -Also, as of today, only ingress is implemented (phase 1: call a resource in the PN from a Function/Container). |
52 | | - |
53 | | -Egress (phase 2: calling a Function/Container from a resource in the PN) will be done [later](../#phases). |
| 25 | +## Limitations |
54 | 26 |
|
| 27 | +- VPC works with Namespaces that have **VPC support enabled**. VPC support can only be enabled at [namespace creation](/serverless-containers/how-to/create-manage-delete-containers-namespace/#creating-a-serverless-containers-namespace), and cannot be updated afterward. |
| 28 | +- Only one Private Network can be attached to a container. |
| 29 | +- **VPC routing** (custom routes and cross-PN automatic routing) is not supported yet. |
| 30 | +- **Ingress** (inbound private traffic from resources to a container within the same Private Network) is not supported yet. |
| 31 | +- Each [container instance](/serverless-containers/concepts/#instance) has a unique IP automatically assigned by Scaleway in the Private Network. This implies the following: |
| 32 | + - Users **cannot preemptively book an IP** with [IPAM](/ipam/), and reference it in the attachment. |
| 33 | + - A single Serverless Container can have a **large number of IPs** being used within the Private Network, depending on the number of concurrent instances. |
| 34 | + - **Cold-starts are slightly longer** due to the additional steps required to attach the node to the Private Network and book an IP. |
0 commit comments