gVPC limitations and roadmap

​

Limitations

• Each workload attaches to exactly one network through one network interface, and it can’t move to another network.
• Instance addresses aren’t reachable from the internet. To serve traffic publicly, attach an ALB to the workload.
• The networkPolicy field of a network interface has no effect. Don’t rely on it to restrict traffic. Firewall rules are a planned capability.
• You can’t choose a network’s address ranges or create your own subnets.
• Networks carry Compute traffic only in the locations where Compute runs: us-central-1, us-east-1, and us-west-1.
• Every network can reach the internet, and you can’t turn that off.
• Outbound internet traffic leaves from addresses that are shared with other Datum customers. Datum doesn’t publish them, so a destination can’t allowlist your Instances by address.
• Instances reach IPv4-only internet services by hostname only. A connection to an IPv4 address fails. See Reach the internet.

​

Planned capabilities

• Firewall rules: Security groups that control the traffic to and from your Instances.
• Private DNS: Private DNS names, so Instances can find each other without IP addresses.
• Internet access setting: A setting that turns internet access on or off for every Instance on a network.
• Datum DNS resolver: A DNS resolver that Datum runs for Instances, which also performs DNS64.

​

What’s next

• To learn which traffic a network carries, see Traffic and connecting.
• To serve a workload publicly through Datum’s ALB, see Publish a workload.
• To run Instances in more locations, see Placement and scaling.