Skip to main content
Each project runs in its own network with strict policies. Other tenants cannot reach your services, and yours cannot reach theirs. Traffic between your own services inside a project is unrestricted: any port, any protocol. The rules on this page apply to the public internet.

​
Outbound TCP

TCP works normally except for a short blocklist. Everything else is open, including HTTP and HTTPS, every common database port, and IMAP and POP. Reading mail is not sending it.

​
Outbound UDP

UDP is closed except for 53 (DNS) and 443 (QUIC and HTTP/3). The asymmetry with TCP is deliberate. UDP is connectionless and spoofable, so open UDP egress would let any container be used as an amplification reflector in an attack on someone else. NTP on 123 is included in that closure, because containers take their time from the node. If a workload legitimately needs something on either list, get in touch rather than working around it.

​
Inbound traffic

A service is reachable from the internet only if it declares a port marked public: true. Everything else is reachable by its siblings and nothing more. See Service to service.

​
Edge rate limits

Plans can carry a per-client-IP request rate, with a burst allowance, and a per-client-IP concurrent-request cap. Both are enforced at the edge for every public service, on platform subdomains and custom domains alike. A client that exceeds them receives 429 Too Many Requests. Other clients of the same service are unaffected. These are abuse guards against a single hot client, not a cap on how much total traffic a service may serve. Unlimited means no edge throttle is applied. There is no upstream response timeout at the edge, so long-lived SSE and WebSocket connections are not cut off.

​
Request size

The edge rejects a request body above 10 MB with 413. For larger uploads, send them to object storage with a presigned URL rather than through your service.

​
Resource quotas

Each project is bounded by a resource quota sized from your plan’s pods-per-project cap. The quota is a containment ceiling rather than a reservation: what you pay for is the allocation each service actually runs at. Changing plans re-derives the quota on the next deploy.