Environment Isolation

Environment Network Isolation

Network Isolation controls the default internal-network access between environments inside one platform installation. Each internal connection is checked before it is allowed.
Availability: This feature depends on the configuration selected by the hosting provider.

When an internal request is made between platform nodes, the system checks whether the requesting and requested environments belong to the same isolated group. The request is allowed only when the configured isolation rules permit the connection.

Request handling with firewall and network isolation
Internal requests are checked against network-isolation and firewall rules before being allowed.
Additional protection: Container firewall rules provide more flexible control and can be used for both internal and external access restrictions.
On this page

Private Network Isolation

When Network Isolation is enabled for the platform, user accounts are isolated from one another by default. Environments owned by different accounts cannot communicate through the internal network unless access is explicitly configured at both ends.

The same feature can also separate groups of environments within one account. This is useful when several unrelated applications or projects are hosted under the same account.

Enable Isolation for an Environment Group

Open the Add Group or Edit Group dialog and turn on the Network Isolation switch.

Enable isolation for an environment group
Enable Network Isolation while creating or editing a top-level environment group.
Groups with enabled isolation are marked with a shield icon for quick recognition in the dashboard.

How Isolation Works

The platform automatically collects the private IP addresses of containers inside each isolated group and places them into a dedicated IP set.

Same IP Set Internal communication between nodes is permitted when their addresses belong to the same isolated group.
Different IP Sets Internal communication is blocked when the environments belong to different isolated groups.

The platform automatically updates these IP sets when related account changes occur, including environment removal and horizontal node scaling.

Important Considerations

  • Network Isolation can be enabled only for a top-level environment group, not for a nested subgroup.
  • Isolated groups display a shield icon for easier identification.
  • A collaborator cannot add a shared environment to an isolated group.
  • The feature controls internal platform networking only.
  • It does not restrict access from outside the platform through a public IP address or another external entry point.
External access: Use container firewall rules, load-balancer configuration, endpoints, or public-IP security controls to manage connections from outside the platform.

Using Network Isolation

Network Isolation helps prevent unwanted internal access between applications and projects hosted under one account.

Third-Party Collaboration When application or database access is shared with an external employee or company, containers in another isolated project remain inaccessible over the internal network.
Safe Environment Cloning A clone containing hardcoded database connection details cannot reach the original isolated production project, helping protect live data.

By placing unrelated projects into separate isolated groups, the platform prevents accidental or undesired internal interconnections between them.

What’s next?

  • Environment Groups
  • Container Firewall
  • Shared Load Balancer
  • Public IP
  • Endpoints