Skip to main content
By default a container has no network access — it cannot reach the internet or other containers. The exception is the container the shim routes to: the enclave wires the shim to it automatically, with no configuration on your part. You only need a networks block when a container has to make outbound connections (calling an external API) or talk to another container in the same enclave.
The networks block requires cvm-version 0.10.0 or newer.

​
Defining networks

networks is a top-level map of named networks. Each has an egress policy that controls what containers attached to it can reach:
Rules for allow entries:
  • Must be hostnames (e.g. api.example.com), not IP addresses; wildcards are not supported.
  • Allow every hostname the request may contact, including redirect targets and separate CDN or API hostnames.
  • Hostnames are re-resolved periodically (about every 60 seconds), so allowlisting works with rotating DNS. Only IPv4 addresses are allowlisted today.
Network names must be lowercase alphanumeric with hyphens, at most 15 characters. The name shim-net is reserved for the enclave’s internal shim-to-container channel and cannot be used (see Routing).

​
Attaching containers to networks

List the networks a container joins under its networks field:
  • A container may attach to any number of networks, but at most one may have egress other than closed.
  • Containers on a shared network reach each other by container name (e.g. http://api:8000).
  • A container with no networks (and that isn’t the shim’s target) has no connectivity.

​
Routing

The shim section controls which ports and paths your container exposes. Only listed paths are reachable from outside the enclave. Any request to an unlisted path is rejected with a 404 error code. The enclave reaches the target container over a private internal channel — you don’t declare a network for it.
The shim-net channel. The shim reaches your upstream container over an automatic, private Docker bridge named shim-net (a fixed 172.31.255.0/30 subnet). It carries only shim → container traffic and is always closed to the internet. You don’t create it, and the name shim-net is reserved — you can’t declare a network called shim-net or attach a container to it yourself.