---
title: How to deploy a Serverless Container behind Edge Services
description: Deploy a Serverless Container behind a Scaleway Edge Services pipeline using the CLI or Terraform. Configure HTTPS termination and a public endpoint.
tags: serverless containers edge services deploy CLI terraform
dates:
  validation: 2026-06-15
  posted: 2026-01-15
categories:
  - serverless-containers
---
import Requirements from '@macros/iam/requirements.mdx'

<Requirements />

- [Owner](/iam/concepts/#owner) status or [IAM permissions](/iam/concepts/#permission) allowing you to perform actions in the intended Project

## Introduction

This guide walks you through deploying a Serverless Container behind a Scaleway Edge Services pipeline. Create a namespace and deploy a container. Then configure an Edge Services pipeline with stages for backend routing, TLS termination, and DNS to expose a public endpoint.

<Message type="note">
This same procedure applies to **Serverless Functions**. The Edge Services backend stage supports both backends. Replace the container namespace and container resources with the equivalent Function namespace and function resources. Then use the corresponding function ID in the backend stage configuration.
</Message>

<Tabs>

  <TabsTab label="CLI">
To complete the actions presented below, you must have:
- The Scaleway CLI installed and configured
- A valid [Scaleway API key](/iam/how-to/create-api-keys/) with appropriate permissions
- An active [Edge Services subscription](/edge-services/how-to/subscribe-edge-services/)

## Step 1: Create a Serverless Container namespace

First, create a namespace to hold your container:

```bash
scw container namespace create name=edge-container-ns
```

Note the returned `ID` (namespace ID). You need it in subsequent steps.

## Step 2: Create and Deploy a container

Create a simple container. Replace the registry image with your own, or use a sample image for testing:

```bash
scw container container create \
  namespace-id=<YOUR_NAMESPACE_ID> \
  name=web-app \
  image="nginx:alpine" \
  port=80
```

After creating the container, note the `id` (container ID) from the output. You need it to attach the container to Edge Services.

## Step 3: Create an Edge Services pipeline

A pipeline is the core Edge Services entity. It defines the request processing chain from the public endpoint to your origin (backend).

```bash
scw edge-services pipeline create \
  name=my-pipeline \
  description="Pipeline for my Serverless Container"
```

Note the returned `ID` (pipeline ID).

## Step 4: Create the stages

A pipeline needs a chain of stages from the entry point (head stage) to the origin (backend stage). For a simple setup, you need:

1. **Backend stage** (origin - where requests are forwarded to your Serverless Container)
2. **TLS stage** (entry point - handles HTTPS termination)
3. **DNS stage** (provides the public endpoint URL)

### 4.1 Create a backend stage

The backend stage defines your origin. To connect a Serverless Container, use the `scaleway-serverless-container` option:

```bash
scw edge-services backend-stage create \
  pipeline-id=<YOUR_PIPELINE_ID> \
  scaleway-serverless-container.region=fr-par \
  scaleway-serverless-container.container-id=<YOUR_CONTAINER_ID>
```

Replace the following placeholders:
- `<YOUR_PIPELINE_ID>`: The pipeline ID from Step 3
- `<YOUR_CONTAINER_ID>`: The UUID of your Serverless Container from Step 2

Note the returned `ID` (backend stage ID).

<Message type="important">
If the `scaleway-serverless-container` option is not available in your CLI version, update the Scaleway CLI to the latest version. You can check your version with `scw --version`.
</Message>

### 4.2 Create a TLS stage

The TLS stage handles TLS termination and can use a managed Let's Encrypt certificate. You can link it directly to the backend stage during creation:

```bash
scw edge-services tls-stage create \
  pipeline-id=<YOUR_PIPELINE_ID> \
  managed-certificate=true \
  backend-stage-id=<YOUR_BACKEND_STAGE_ID>
```

Replace `<YOUR_BACKEND_STAGE_ID>` with the backend stage ID from Step 4.1.

Note the returned `ID` (TLS stage ID).

<Message type="note">
By linking the backend stage during TLS stage creation, you avoid needing a separate update command later.
</Message>

### 4.3 (Optional) Create a route stage

A route stage allows you to define routing rules that forward requests to different backends based on path or method patterns:

```bash
scw edge-services route-stage create \
  pipeline-id=<YOUR_PIPELINE_ID>
```

Note the returned `ID` (route stage ID).

### 4.4 (Optional) Set route rules

If you created a route stage, you can define routing rules. For a simple setup that forwards all traffic to your backend:

```bash
scw edge-services route-rules set \
  route-stage-id=<YOUR_ROUTE_STAGE_ID> \
  route-rules.0.backend-stage-id=<YOUR_BACKEND_STAGE_ID> \
  route-rules.0.rule-http-match.path-filter.value=".*" \
  route-rules.0.rule-http-match.path-filter.path-filter-type=regex 
```

## Step 5: Create a DNS stage and set it as head

You need a DNS stage to expose your pipeline with a public endpoint URL.

### 5.1 Create a DNS stage

Create a DNS stage linked to your TLS stage:

```bash
scw edge-services dns-stage create \
  pipeline-id=<YOUR_PIPELINE_ID> \
  tls-stage-id=<YOUR_TLS_STAGE_ID>
```

Note the returned `ID` (DNS stage ID) and the `default_fqdn` field - this is your public endpoint URL.

<Message type="note">
If you want to use a custom domain, add the `fqdns.0=app.example.com` parameter. You need to configure a DNS record (CNAME) pointing your domain to the endpoint provided by the DNS stage response.
</Message>

### 5.2 Set the DNS stage as the pipeline head

Set the DNS stage as the entry point of your pipeline:

```bash
scw edge-services pipeline set-head \
  pipeline-id=<YOUR_PIPELINE_ID> \
  add-new-head-stage.new-stage-id=<YOUR_DNS_STAGE_ID>
```

Replace `<YOUR_DNS_STAGE_ID>` with the DNS stage ID from Step 5.1.

## Step 6: Verify the setup

List your pipeline to check the configuration:

```bash
scw edge-services pipeline get <YOUR_PIPELINE_ID>
```

Get the DNS stage details to retrieve your endpoint URL:

```bash
scw edge-services dns-stage get <YOUR_DNS_STAGE_ID>
```

The output shows your endpoint in the `default_fqdn` field:

```
ID                  b92d2abe-4304-4d98-85ea-0f44f51dab8f
DefaultFqdn         79778b1b-afbf-47a8-9609-f034ae28dfaf.svc.edge.scw.cloud
DefaultPrivateFqdn  -
Type                auto
PipelineID          79778b1b-afbf-47a8-9609-f034ae28dfaf
Status              active
```

List the stages to verify the configuration:

```bash
scw edge-services tls-stage list pipeline-id=<YOUR_PIPELINE_ID>
scw edge-services backend-stage list pipeline-id=<YOUR_PIPELINE_ID>
```

Test the endpoint by making an HTTP request to your pipeline endpoint:

```bash
curl -v https://<YOUR_ENDPOINT_FQDN>
```

## Alternative: Simplified workflow

For a quicker setup, you can chain the commands together:

```bash
# Create pipeline
PIPELINE_ID=$(scw edge-services pipeline create \
  name=my-pipeline \
  description="Pipeline for my Serverless Container" \
  -o json | jq -r '.id')

# Create backend stage
BACKEND_STAGE_ID=$(scw edge-services backend-stage create \
  pipeline-id=$PIPELINE_ID \
  scaleway-serverless-container.region=fr-par \
  scaleway-serverless-container.container-id=<YOUR_CONTAINER_ID> \
  -o json | jq -r '.id')

# Create TLS stage linked to backend
TLS_STAGE_ID=$(scw edge-services tls-stage create \
  pipeline-id=$PIPELINE_ID \
  managed-certificate=true \
  backend-stage-id=$BACKEND_STAGE_ID \
  -o json | jq -r '.id')

# Create DNS stage
DNS_STAGE_ID=$(scw edge-services dns-stage create \
  pipeline-id=$PIPELINE_ID \
  tls-stage-id=$TLS_STAGE_ID \
  -o json | jq -r '.id')

# Set DNS stage as head
scw edge-services pipeline set-head \
  $PIPELINE_ID \
  add-new-head-stage.new-stage-id=$DNS_STAGE_ID

# Get endpoint URL
scw edge-services dns-stage get $DNS_STAGE_ID
```

This workflow automates the process by capturing IDs in variables and chaining the commands together.

  </TabsTab>

  <TabsTab label="Terraform">
To complete the actions presented below, you must have:
- [Terraform](https://developer.hashicorp.com/terraform/install) installed on your local machine (version 1.0 or later)
- A valid [Scaleway API key](/iam/how-to/create-api-keys/) with appropriate permissions
- An active [Edge Services subscription](/edge-services/how-to/subscribe-edge-services/)

## Step 1: Configure the Scaleway provider

Create a new directory for your Terraform configuration and initialize it:

```bash
mkdir edge-container-tutorial
cd edge-container-tutorial
```

Create a file named `main.tf` with the following content:

```terraform
terraform {
  required_providers {
    scaleway = {
      source = "scaleway/scaleway"
    }
  }
  required_version = ">= 0.13"
}
```

Set your Scaleway credentials as environment variables:

```bash
export SCW_ACCESS_KEY="SCWXXXXXXXXXXXXXXXXX"
export SCW_SECRET_KEY="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
```

<Message type="important">
Never commit your API keys to version control. Use environment variables or a secret manager to store your credentials securely.
</Message>

Initialize the Terraform provider:

```bash
terraform init
```

## Step 2: Create a Serverless Container namespace

Add the following to your `main.tf` file to create a namespace for your container:

```terraform
resource "scaleway_container_namespace" "main" {
  name        = "edge-container-ns"
}
```

## Step 3: Deploy the Serverless Container

Add the container resource to your `main.tf` file. For this document, we will use a lightweight Nginx image:

```terraform
resource "scaleway_container" "main" {
  name         = "web-app"
  namespace_id = scaleway_container_namespace.main.id
  image        = "nginx:alpine"
  port         = 80
}
```

<Message type="note">
The `memory_limit_bytes` must correspond to the right amount of vCPU. For 100m vCPU, use 512 MiB (536870912 bytes). Refer to the [memory and vCPU configuration table](/serverless-containers/reference-content/containers-limitations/) for valid combinations.
</Message>

## Step 4: Create the Edge Services pipeline

Add the pipeline resource to your `main.tf` file:

```terraform
resource "scaleway_edge_services_pipeline" "main" {
  name        = "container-pipeline"
  description = "Pipeline for Serverless Container"
}
```

## Step 5: Create the Stages

An Edge Services pipeline is built from a chain of **stages** that process requests from the public endpoint to your origin (backend). For a simple setup, you need:

1. **Backend stage** (origin - where requests are forwarded to your Serverless Container)
2. **TLS stage** (entry point - handles HTTPS termination)

<Message type="note">
A route stage is optional. It allows you to define routing rules that forward requests to different backends based on path or method patterns. For this tutorial, we will skip the route stage and link the TLS stage directly to the backend stage. A head stage is then required to set the entry point of the pipeline.
</Message>

### 5.1 Create a backend stage

Add the backend stage resource to connect your Serverless Container:

```terraform
resource "scaleway_edge_services_backend_stage" "main" {
  pipeline_id = scaleway_edge_services_pipeline.main.id
  
  container_backend_config {
    container_id = scaleway_container.main.id
    region       = "fr-par" # Adjust to your container's region
  }
}
```

<Message type="important">
Replace `"fr-par"` with the region where your Serverless Container is deployed if you are using a different region (e.g., `"nl-ams"`, `"pl-waw"`).
</Message>

### 5.2 Create a TLS stage

Add the TLS stage resource to your `main.tf` file. Link it directly to the backend stage using the Terraform resource reference:

```terraform
resource "scaleway_edge_services_tls_stage" "main" {
  pipeline_id         = scaleway_edge_services_pipeline.main.id
  backend_stage_id    = scaleway_edge_services_backend_stage.main.id
  managed_certificate = true
}
```

The `managed_certificate = true` parameter tells Scaleway to generate and manage a Let's Encrypt certificate automatically for your Edge Services endpoint.

<Message type="note">
By linking the backend stage during TLS stage creation, you avoid needing a separate update command later. This is the same approach as the CLI workflow.
</Message>

## Step 6: Create a DNS stage and set it as head

A DNS stage is required to expose your pipeline with a public endpoint URL. Create the DNS stage, then link all stages together in a chain.

Add the DNS stage resource to your `main.tf` file:

```terraform
resource "scaleway_edge_services_dns_stage" "main" {
  pipeline_id = scaleway_edge_services_pipeline.main.id
  tls_stage_id = scaleway_edge_services_tls_stage.main.id
}
```

The DNS stage provides your public endpoint URL in the `default_fqdn` field.

<Message type="note">
If you want to use a custom domain, add `fqdns = ["app.example.com"]` to the DNS stage resource. You need to configure a DNS record (CNAME) pointing your domain to the endpoint provided by the DNS stage.
</Message>

Then create a head stage to set the DNS stage as the pipeline entry point:

```terraform
resource "scaleway_edge_services_head_stage" "main" {
  pipeline_id   = scaleway_edge_services_pipeline.main.id
  head_stage_id = scaleway_edge_services_dns_stage.main.id
}
```

## Step 7: Deploy the infrastructure

Your complete `main.tf` file should look like this:

```terraform
terraform {
  required_providers {
    scaleway = {
      source  = "scaleway/scaleway"
      version = "~> 2.0"
    }
  }
}

provider "scaleway" {
  # Credentials should be set via environment variables:
  # SCW_ACCESS_KEY and SCW_SECRET_KEY
}

# Container Namespace
resource "scaleway_container_namespace" "main" {
  name        = "edge-container-ns"
  description = "Namespace for Edge Services container"
}

# Serverless Container
resource "scaleway_container" "main" {
  name         = "web-app"
  namespace_id = scaleway_container_namespace.main.id
  image        = "nginx:alpine"
  port         = 80
}

# Edge Services Pipeline
resource "scaleway_edge_services_pipeline" "main" {
  name        = "container-pipeline"
  description = "Pipeline for Serverless Container"
}

# Backend Stage (Serverless Container)
resource "scaleway_edge_services_backend_stage" "main" {
  pipeline_id = scaleway_edge_services_pipeline.main.id
  
  container_backend_config {
    container_id = scaleway_container.main.id
    region       = "fr-par"
  }
}

# TLS Stage
resource "scaleway_edge_services_tls_stage" "main" {
  pipeline_id         = scaleway_edge_services_pipeline.main.id
  backend_stage_id    = scaleway_edge_services_backend_stage.main.id
  managed_certificate = true
}

# Head Stage
resource "scaleway_edge_services_head_stage" "main" {
  pipeline_id   = scaleway_edge_services_pipeline.main.id
  head_stage_id = scaleway_edge_services_dns_stage.main.id
}

# DNS Stage
resource "scaleway_edge_services_dns_stage" "main" {
  pipeline_id  = scaleway_edge_services_pipeline.main.id
  tls_stage_id = scaleway_edge_services_tls_stage.main.id
}

# Outputs
output "pipeline_id" {
  description = "The ID of the Edge Services pipeline"
  value       = scaleway_edge_services_pipeline.main.id
}

output "endpoint_url" {
  description = "The public endpoint URL of the Edge Services pipeline"
  value       = "https://${scaleway_edge_services_dns_stage.main.default_fqdn}"
}
```

Now deploy the infrastructure:

1. Review the execution plan:

   ```bash
   terraform plan
   ```

2. Apply the configuration:

   ```bash
   terraform apply
   ```

3. Type `yes` when prompted to confirm.

Terraform will create all the resources and display their IDs and endpoints upon completion.

## Step 8: Verify the setup

After Terraform completes the deployment, you can verify the setup:

1. Your Edge Services endpoint URL will be:

   `https://${scaleway_edge_services_dns_stage.main.default_fqdn}`
   (or check the output from `terraform output`)

2. Test the endpoint using curl:

   ```bash
   curl -v https://<YOUR_ENDPOINT_FQDN>
   ```

   You should see the Nginx welcome page (or your container's application response).

3. Check the pipeline status in the console:
   1. Navigate to **Edge Services** in the **Network** section.
   2. Click your pipeline.
   3. Verify that all stages are active and healthy.

  </TabsTab>

</Tabs>

## Going further

Now that you have deployed your Serverless Container behind Edge Services, you can explore additional configurations:

- [Configure caching](/edge-services/how-to/configure-cache/) to optimize content delivery performance
- [Configure WAF](/edge-services/how-to/configure-waf/) to add web application firewall protection
- [Monitor with Cockpit](/edge-services/how-to/monitor-cockpit/) to track your pipeline's metrics and logs
- [Add a custom domain](/edge-services/how-to/configure-custom-domain/) to your Edge Services pipeline
- [Secure a container](/serverless-containers/how-to/secure-a-container/) with IAM authentication for private access
- [Use Private Networks](/serverless-containers/how-to/use-private-networks/) to connect your Serverless Container to other Scaleway resources in an isolated network

## Limitations

<Message type="note">
    **Availability:** This feature is available via the API, CLI, SDK, and Terraform. It is **not available** in the Scaleway console.
</Message>