Skip to content

Networking and Load Balancing Updated 2026-05-29

Public IP

How a public IP works on Stack Harbor PaaS — IPv4 and IPv6, the trade-off against the Shared Load Balancer, what features it unlocks, and the rules around primary and additional addresses.

By default the platform routes inbound traffic to your environment through the Shared Load Balancer (SLB). A public IP attaches an internet-routable address directly to a node, bypassing the SLB and giving you a direct path between the public internet and the container.

For production environments where you want predictable inbound networking — your own TLS termination, FTP, IDE-based remote debugging, WebSockets, or a custom protocol — a public IP is the right tool.

When to add a public IP

You need one of these:

  • a custom SSL certificate that you control end-to-end (rather than the platform’s built-in TLS)
  • FTP / FTPS exposure
  • WebSocket connections that need a stable address
  • remote debugging from an IDE
  • HTTP/3 / QUIC end-to-end (the SLB does not yet carry QUIC)
  • a non-HTTP protocol that the SLB does not understand
  • compliance or auditing rules that require a known IP for the environment

The Shared Load Balancer covers most plain HTTP / HTTPS workloads — if none of the above applies, you do not need a public IP.

IPv4 and IPv6

The platform supports both:

  • IPv4 — the long-deployed default, what most clients expect
  • IPv6 — the modern address space, with simpler routing and a much larger pool

Both can be attached to the same node — IPv4 only, IPv6 only, or a mix. They are billed independently.

Attaching a public IP

From the topology wizard:

  1. Open the environment topology (when creating an environment or editing an existing one).
  2. Select the node you want to expose.
  3. In the central panel, set the Public IPv4 count (and/or Public IPv6) to at least 1.
  4. Apply.

When you enable a public IPv4, the Access via SLB option is turned off by default for that node. Expect a brief disruption (a few minutes) while DNS caches catch up.

For horizontally scaled tiers, each replica gets its own set of public IPs.

Managing attached IPs

Expand the node in the environment topology list to see the full IP list. Hovering over an IP gives you:

  • Copy to clipboard — copy the address
  • Attach / Detach IP(s) — change the number of public IPs on the node (both v4 and v6)
  • Detach IP — remove a specific address

Primary and additional IPs

When a node has more than one public IP of the same version:

  • The first IP attached (per version) is the primary one.
  • Outbound traffic from the container goes out the primary IP.
  • Inbound traffic can land on any of the attached IPs.
  • The primary IP can only be removed when no other IP of the same version is attached.

This matters when you change which IP a DNS record points to — give yourself a window where both old and new are attached so cached resolvers do not see an outage.

Operational notes

  • Billing. Public IPs are billed per hour. Both IPv4 and IPv6 are billable, and they are charged separately. The exact rates are part of the platform’s published pricing.
  • Swap domains and public IPs. If any node in an environment has a public IP, the Swap Domains feature is not available — use the Swap External IPs CLI instead.
  • Multiple IPs. Adding several IPs to one container is supported — see multiple public IPs for the rules and use cases.

See also