Docs / Networking

Workspace private network

Partial: no service discovery API

Services in the same workspace run on a dedicated Docker bridge network. Containers can reach each other by Docker DNS name lc-{serviceId}.

Each workspace network gets a short Linux bridge iface name iws-* via com.docker.network.bridge.name (IFNAMSIZ-safe hash). Absolute east-west isolation requires the host script ./scripts/setup-workspace-isolation.sh, which DROPs forwarding between iws-* bridges and blocks customer↔customer traffic on the shared edge network while allowing the gateway. Soft Docker networks alone do not guarantee cross-tenant isolation. (Docker still names these networks with a bfc-ws-* prefix today; match host firewall rules on iws-*, not that name.)

What works

  • Web service → Postgres/Key Value over internal hostname
  • Web service → private service on PORT
  • Isolation from other workspaces' containers when host east-west isolation is installed

What is not included

  • Private DNS API or automatic service discovery registry
  • Cross-workspace private networking (intentionally blocked)
  • Encrypted overlay / VXLAN beyond Docker bridge + host iptables

Pass connection strings and internal hostnames via environment variables.