> ## Documentation Index
> Fetch the complete documentation index at: /docs/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Agent home for Datum, with what it is, pricing, and how to act: https://agents.datum.net
> If you can only fetch URLs: read https://www.datum.net/docs/llms.txt in full and open the most specific page for the task. Commands, limits, and field paths are on task, operations, and limits pages, not on section overviews. Pages described as "Documentation is coming soon" are placeholders.
> If you have a shell or can save files: download https://www.datum.net/docs/llms-full.txt (every page, about 740 KB) once and search it with grep, instead of fetching pages one at a time.
> datumctl describes itself: `datumctl api-resources` lists resource types and `datumctl explain <resource>` shows a schema. To act on live resources, use Datum MCP or datumctl. To search the docs, use the Docs MCP server at https://www.datum.net/docs/mcp.

# Private DNS for Compute

> How Compute publishes stable private names for instances attached to a Datum VPC.

Compute integrates with [Private DNS](/docs/domain-dns/private-dns.md) to publish a
predictable name for an instance in each VPC to which it is attached. The name
resolves to the instance's programmed private IPv4 and IPv6 addresses and is
visible only within the associated VPC's DNS context.

> [!NOTE]
>
> The Compute integration is under active development and is not yet a stable,
> generally available interface.

## Instance names

Compute publishes instance identity names beneath the `instances` subtree of
the VPC's managed namespace. A name has this general form:

```text theme={null}
<instance-name>.instances.<vpc-managed-suffix>
```

Compute normalizes the instance name into a valid DNS label when necessary. If
two instance names normalize to the same DNS name, Private DNS keeps the first
claim and reports a name conflict for the other instance.

Treat the complete name reported by the service as an output. The managed
suffix is a platform allocation and should not be constructed or parsed by
applications.

The allocated hostname and its publication state are reported for each network
in `Instance.status.dns`.

## Published addresses

Compute publishes:

* `A` records for private IPv4 addresses.
* `AAAA` records for private IPv6 addresses.

An address is eligible only while the instance is ready, its runtime is ready,
and its network interface reports that the address is both allocated and
programmed. Public addresses and delegated prefixes are not published as
instance identity records.

Instance readiness covers the managed runtime and network attachment. Use the
application's own health checks or a service-specific discovery mechanism when
traffic should be sent only to healthy application endpoints.

## Lifecycle behavior

Compute continuously reconciles the DNS records from current instance and
network state:

* Address changes update the records behind the stable identity name.
* An unavailable or deprogrammed interface withdraws its addresses.
* Deleting the instance removes its published records.
* Resource lifetime checks prevent an old instance from publishing addresses
  after it has been replaced.
* An instance attached to more than one VPC receives independently isolated
  DNS state for each VPC.

Publication is asynchronous. A running instance can become ready before its
name is visible in every resolver, and clients can retain an older answer until
the DNS TTL expires.

## Network access

Resolving an instance name does not grant access to the instance. The client
must still have a valid route and be permitted by the applicable network
policy. Clients outside the associated VPC context cannot resolve the private
instance name through public DNS.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.