Networking and egress policy
A computer uses open, allowlist or none egress mode, which you can change live through the network-policy endpoint. These choices remain inside platform exclusions: mail ports 25, 465, 587 and 2525, mining pools, private address ranges and IPv6 are blocked. No outbound SMTP exception is enabled at launch, including for Tier 3.
Rates and policy grammar
| Limit | Tier 1 | Tier 2 |
|---|---|---|
| Bandwidth per computer / per account | 25 / 50 Mbit/s | 50 / 150 Mbit/s |
| Packets per second per computer | 5,000 | 15,000 |
| UDP packets per second per computer | 1,000 | 2,000 |
| New connections per second | 20 (burst 100) | 50 |
| Concurrent connections | 4,096 | 16,384 |
| New connections to one destination IP:port | 5/s | 10/s |
These limits are planned and may change before launch.
NetworkPolicy.allow contains at most 64 entries of at most 253 characters each: lowercase RFC 1123 hostnames (with an optional leading *. and a non-numeric final label), or dotted IPv4 addresses or CIDRs with a numeric prefix. IPv6 and netmask notation are not accepted. allow must be empty outside allowlist mode; invalid values return 422. PUT /computers/{id}/network atomically replaces {mode, allow}; an omitted allow means an empty list. A computer PATCH has no network member.
Address and inbound boundaries
Your outbound IPv4 address is shared by accounts in the same tier and changes when your tier changes. Private reachability between computers is not promised. Public inbound access uses HTTPS previews, bounded hooks and the SSH tunnel paths; there are no public raw TCP or UDP guest ports.
A policy update replaces the intended configuration atomically (applied within about 15 seconds). Read back the current state, and do not interpret a missing measurement or a stale policy as unrestricted access. Previews, SSH and Trust tiers describe the separate admission limits. Restrict an agent's destinations before allowing it to inspect untrusted web content.
Dory is in development; these pages describe the planned service and may change. Questions: support@computeengines.com.