Private networking
Every environment has its own private network. Deployments inside it reach each other directly, without leaving the region and without going through the public edge. Nothing outside the environment, including your other environments, can reach that network.
Apps calling apps
Section titled “Apps calling apps”A web app or worker is reachable from the rest of its environment by its deployment name. The deployment’s Overview tab shows the exact address next to the public one:
http://<deployment-name>For example, a worker that needs the api app calls http://api. Traffic is plain HTTP inside the network; TLS is only needed at the public edge. A worker with Public hostname off is reachable this way and nowhere else.
If the target is asleep, the call is held while it wakes, so a request to a public app can wake the private services behind it.
Databases and caches
Section titled “Databases and caches”A Postgres or Valkey deployment has a private address only. Linking it to an app writes that address into the app’s DATABASE_URL or REDIS_URL. The Overview tab of the datastore shows the same address under Private, and says why to prefer it: it stays on the private network, connects faster and its traffic is free.
To reach a datastore from outside the environment, turn on Public access on it, or open a tunnel from your laptop with okctl connect.
Environments are walls
Section titled “Environments are walls”An app in staging cannot reach the database in production, even inside the same project. That is deliberate: it is what makes an environment safe to experiment in. If two services must talk, put them in the same environment. Shared configuration across environments goes through shared variables, not shared network.
What leaves the network
Section titled “What leaves the network”| Traffic | Path | Billed |
|---|---|---|
| App to app, app to datastore, same environment | Private network | Free |
| Public hostname to the internet | Region edge | Per GB at the region rate |
| App to a third-party API on the internet | Region egress | Per GB at the region rate |
| Inbound from the internet | Region edge | Free |
Own cloud
Section titled “Own cloud”On a cluster in your AWS account the same rules apply inside the cluster, and the private address takes the longer form the Overview tab shows, http://<deployment-name>.<environment>.svc.cluster.local. See Clusters.