Users can configure network settings for individual containers using the network section of the container configuration form.
The network form has 3 fields that can be updated.
Field | Description |
|---|---|
Hostname | The name used for DNS queries on the environment network. |
Public Network | The container's public network setting dictates if the container can receive public traffic, can make egress calls, or has all non-environment network disabled. |
Ports | A list of port mappings for the container. |
Egress via Gateway | When enabled, outbound traffic from the container's instances is routed through the environment's gateway service instead of the underlying host. See Egress via Gateway. |
Routes | Additional IP routes applied to the container's instances, used to direct traffic for specific networks over a VPN, Tailscale, or other interface. See Custom Routes. |
Egress via Gateway
By default, egress traffic leaves from whichever host an instance is scheduled on.
Enabling Egress via Gateway routes outbound traffic through a highly available egress gateway instead. This is useful when only a subset of nodes has public egress connectivity, or when a third-party vendor requires static IPs for allowlisting. This approach makes sure that the egress address stays stable no matter where originating instances are scheduled or migrated.
Note: The container's Public Network setting must still permit outbound traffic (
enable,environment-limited, oregress-only).
Custom Routes
Routes direct traffic matching a destination network to a specific gateway and interface inside the instance. Each route added via the form has the following fields:
Field | Description |
|---|---|
Destination | The destination network this route matches. Uses CIDR notation. |
Source | Optional source network the route applies to. Uses CIDR notation |
Ensure Source Exists | When enabled, the source address is verified to exist on the host before the route is applied. |
Family | Optionally pin the route to |
Gateway | The IP address traffic matching the destination is forwarded to. |
Interface | The network interface the route is bound to. |
Next Hops | Additional gateways for multipath (ECMP) routing, each with an optional hop weight controlling traffic distribution. |
Routes apply to all instances of the container.
Restricted Network Space: Routes cannot target
10.10.0.0/16or10.250.0.0/16these subnets are reserved by Cycle for NAT and gateway NAT.
Layer 2 Networks
Layer 2 Networks
Layer 2 networks are powerful, advanced options for connecting individual containers to existing layer 2 SDN's. A more extensive end to end guide is in the works - for specific questions post to https://cycle.io/community.