Networking Architecture

dstack implements a sophisticated networking model to ensure secure, isolated, and high-performance communication between all components. This page walks you through how networking works in dstack, from routing external HTTPS traffic to managing secure connections inside confidential VMs.

The dstack networking architecture is built on multiple layers, each designed to deliver security, isolation, and flexibility for your deployments. By understanding how these layers interact, you’ll be better equipped to optimize performance, maintain strong security boundaries, and quickly resolve any networking issues that arise.

Network Model Overview

Network Layers (at a glance)

1

Public Access

users connect to your app over HTTPS
DNS points to your app domain
(optional) CDN for static files

HTTP/HTTPS, DNS

2

Gateway Security

gateway handles TLS (auto certificates)
blocks attacks (WAF, rate limiting, DDoS protection)
supports HTTP/2 and HTTP/3

3

Private VPN to CVMs

gateway connects to each Confidential VM (CVM) using a secure WireGuard tunnel. this keeps app traffic private and isolated.

4. Internal CVM Network

Container-to-container communication within a CVM:

# Docker network configuration
networks:
  internal:
    driver: bridge
    ipam:
      config:
        - subnet: 172.20.0.0/16
    internal: true  # No external access

services:
  web:
    networks:
      - internal
      - external
  database:
    networks:
      - internal  # Only internal access

Traffic Routing

Domain-Based Routing

dstack supports multiple routing patterns:

Routing Patterns:

Pattern	Example	Use Case
app.srv.domain	myapp.app.example.com	Default app routing
custom.domain	api.mycompany.com	Custom domain via DNS TXT
port-N.srv.domain	8080.app.example.com	Direct port access
cvm-id.internal	cvm-abc123.internal	Internal debugging

Custom Domain Setup

To use a custom domain, configure DNS records as follows:

DNS Configuration:

Request Routing Flow

---

Network Security Framework

Port Security Configuration

Default Port Configuration:

Port	Service	Access	Security
80	HTTP	Public	Redirect to HTTPS
443	HTTPS	Public	TLS 1.2+ only
51820	WireGuard	Public	Key-based auth
9080	VMM API	Internal	Localhost only
8000	KMS RPC	Internal	RA-TLS required

Firewall Configuration

Recommended Firewall Rules:

Network Isolation Mechanisms

Multi-Layer Isolation:

VLAN Separation: Different VLANs for management and application traffic

Network Namespaces: Each CVM has isolated network stack

Bridge Isolation: Separate bridges prevent cross-CVM communication

Firewall Rules: Default deny with explicit allow rules

WireGuard Encryption: All CVM traffic encrypted

---

HTTPS & Certificate Management

Automatic Certificate Provisioning

dstack automatically provisions and renews TLS certificates using Let’s Encrypt:

Certificate Configuration

Gateway Certificate Settings:

Certificate Transparency Monitoring

CT Log Monitoring:

---

Advanced Networking Features

Multi-Region Deployment Architecture

Deploy across multiple regions with optimized routing:

Load Balancing Strategies

Load Balancing Methods:

Method	Algorithm	Use Case
Round Robin	Sequential distribution	Equal server capacity
Least Connections	Route to least busy	Long-lived connections
IP Hash	Consistent routing	Session affinity needed
Geographic	Nearest region	Global deployments

Service Mesh Integration

For complex microservices deployments:

Istio Integration Example: