Use Serverless Containers with Private Networks

Private Networks (PNs) let your Serverless Containers communicate in an isolated and secure network without needing to be connected to the public internet. Each container can be connected to one Private Network. VPC Routing is supported and lets you build your own network topologies.

For full information about Scaleway Private Networks and VPC, see the VPC documentation and its best practices guide.

Before you start

To complete the actions presented below, you must have:

• A Scaleway account logged into the console (External link)
• Owner status or IAM permissions allowing you to perform actions in the intended Organization
• Created a Private Network

Attach a Serverless Container to a Private Network

Enable a container private endpoint

When a container is attached to a PN, the other resources attached to the same PN can use the private endpoint to communicate with your container.

1. In the Scaleway console (External link) side menu, go to Serverless > Containers. The Serverless Containers page opens.
2. Click the relevant containers namespace.
3. Click the name of the container you want to manage.
4. In the Network & Domains tab, in the Private endpoint section, click Enable private endpoint.
5. In the confirmation dialog box, click Enable private endpoint.

Retrieve and use the private endpoint of a container

A container private endpoint uses the format http://<CONTAINER_ID>.<PRIVATE_NETWORK_ID>.internal. You can use this URL from a resource with connectivity to the corresponding VPC, for example:

curl http://<CONTAINER_ID>.<PRIVATE_NETWORK_ID>.internal

The Serverless Containers API returns the private endpoint in the container private_endpoint field. If the private endpoint is not enabled, the field is not returned.

If authentication is enabled on the container, you must provide the required authentication when accessing it through either its public or private endpoint.

curl -H "X-Auth-Token: $SCW_SECRET_KEY" http://<CONTAINER_ID>.<PRIVATE_NETWORK_ID>.internal

Private endpoint HTTPS access and Certificate Authority (CA) trust

Clients must trust the Scaleway containers private endpoint CA when establishing an HTTPS connection. To establish this connection, retrieve the CA and add it to the trust store of your client.

You can download the CA from the Scaleway console or retrieve it through the Serverless Containers API, CLI, Terraform provider, or SDK.

For example using the API, for the fr-par region:

1. Download the CA from: https://api.scaleway.com/containers/v1/regions/fr-par/private-endpoint-ca?dl=1
2. Save the certificate locally, for example, as private-endpoint-ca.pem.
3. Provide the CA explicitly when accessing your container, for example:
   curl --cacert ./private-endpoint-ca.pem https://<CONTAINER_ID>.<PRIVATE_NETWORK_ID>.internal

   The --cacert option tells curl to trust the provided CA when verifying the TLS certificate presented by the private endpoint.

Alternatively, you can add the CA to the trust store of your application, container image, or operating system. You can then connect over HTTPS without having to provide the CA explicitly for every request.

curl https://<CONTAINER_ID>.<PRIVATE_NETWORK_ID>.internal

Disable a container private endpoint

1. In the Scaleway console (External link) side menu, go to Serverless > Containers. The Serverless Containers page opens.
2. Click the relevant containers namespace.
3. Click the name of the container you want to manage.
4. In the Network & Domains tab, in the Private endpoint section, click Disable private endpoint.
5. In the confirmation dialog box, click Disable private endpoint.

Detach a container from a Private Network

1. In the Scaleway console (External link) side menu, go to Serverless > Containers. The Serverless Containers page appears.
2. Click the relevant containers namespace.
3. Click the name of the container you want to manage.
4. In the Network & Domains tab, in the Private Network section, click Detach Private Network.
5. In the confirmation dialog, click Detach Private Network.

Your container is redeployed and is now detached from the PN.

Delete a Private Network

You can delete a PN from the VPC section of the console. See Delete a Private Network.

Private Networks and containers limitations

For more information on limitations when using PNs with Serverless Containers, see Serverless Containers and Private Networks integration.