這個頁面還沒有翻譯成繁體中文：以下是英文版。
The ways in
| Way in | What it reaches | More |
|---|---|---|
| A Cube’s address, or your own domain | The app’s instances, over HTTP: a request wakes one, or makes one | Cube addresses, the proxy and direct names |
| A link to a sandbox’s port | One port of one sandbox, over HTTP; the link is the credential | Links |
| SSH | A shell or a command in a sandbox, through the SSH gateway, with your registered key | SSH |
| The project’s private network | The project’s services and sandboxes, by name, from one another | The private network |
| A sandbox’s own IPv6 address | The ports opened at it, over TCP or UDP, to the sources each is opened to | Below |
A sandbox’s own IPv6 address
A sandbox made on a machine that has a pool of IPv6 addresses has a public IPv6 address of its own (ipv6 of the sandbox), for its whole life. Where ipv6 is null, the sandbox has IPv4 alone.
- It stays the sandbox’s: through sleep, a snapshot, a restart from its disk and a move. A fork, or a sandbox made from a snapshot, gets an address of its own.
- Out: what the sandbox sends over IPv6 leaves from that address, untranslated, so a server it calls can allow that one address.
- In: closed by default. A port is opened, over TCP or UDP, to the sources listed and to nobody else: IPv6 prefixes or addresses,
::/0for everybody, which has to be said. Up to 64 ports a sandbox, and 32 sources a port. What answers a connection the sandbox made comes in, and so do pings; anything else is refused at once (a TCP connection with a reset). The program has to listen on::. - Closing a port refuses new connections from then on; those it has go on.
- Asleep, what is open stays open. Its machine answers the keepalives and pings of the connections it has, for it, so they do not keep it awake and are not lost; data on one of them, a new connection to an open port, or a datagram to a UDP port it listens on wakes it. A paused sandbox is resumed by any packet.
glac sandboxes ports open web 5432 --from 2001:db8:1::/48
glac sandboxes ports open web 53/udp --from ::/0
glac sandboxes ports ls web
glac sandboxes ports close web 5432PUT /v1/sandboxes/{id}/tcp/{port} (or udp) with {"from": […]} opens a port, or gives it other sources; DELETE closes it; GET /v1/sandboxes/{id}/tcp lists the open ones, each with where it is reached ([address]:port). inbound on a sandbox’s create and update is the whole list, and glac sandboxes create --inbound 8080=2001:db8::/32 gives it from the start. A keyed instance’s ports are its sandbox’s, under /v1/apps/{app}/instances/{key}/tcp. A sandbox with no address of its own refuses to open one: 409 no_ipv6.
The ways out
- To the internet, a sandbox’s or an instance’s traffic leaves from its machine over IPv4, and from the sandbox’s own address over IPv6. It is traffic out, billed by the region of the machine it leaves from; what goes between sandboxes of one machine is not.
- Network rules say where a sandbox may connect and which requests it may send (network rules), over IPv4 and IPv6 alike. Rules that name hosts send every TCP connection, over either, through the machine’s egress proxy, which holds the account to a share of connections (limits). Over IPv6 the proxy connects from the sandbox’s own address, and tries IPv4 to the same host beside it when IPv6 does not get through.
- The machine’s own public addresses are reached as the internet reaches them: the API, a Cube’s address and the links to sandboxes’ ports answer a sandbox wherever their names lead, the machine it runs on too, and see it come from the address its traffic out leaves from (its machine’s over IPv4, its own over IPv6). What it sends there is traffic out, as it is to any other machine. Nothing else of the machine’s answers it.
- Nowhere, whatever the rules: private address ranges, the cloud’s metadata address and the rest of the machine itself; over IPv6, unique local, link-local and multicast addresses too. Another sandbox is reached at its own IPv6 address as any host is, at the ports it opened.