dstack-cloud: add no_public_ip (--no-address) for network-isolated VMs#721
Merged
kvinwang merged 1 commit intoJun 10, 2026
Merged
Conversation
GcpConfig gains a no_public_ip flag; when set, 'gcloud compute instances create' is given --no-address so the VM has no ephemeral external IP. With no Cloud NAT on the subnet this also drops internet egress; the VM is still reachable over IAP TCP forwarding (SSH, and the on-prem launcher's courier, go over IAP either way). The on-prem operator tooling already requests this (no_public_ip in the deploy sys-config), but upstream dstack-cloud silently ignored it and created a public IP.
Contributor
There was a problem hiding this comment.
Copilot wasn't able to review any files in this pull request.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
GcpConfiggains ano_public_ipflag. When set,gcloud compute instances createis given--no-address, so the VM is created with no ephemeral external IP.Why
The on-prem (KMS-less sca) operator tooling deploys confidential workloads that should be network-isolated — no public IP, reachable only over IAP TCP forwarding. The operator already writes
no_public_ip: trueinto the deploy sys-config, but upstreamdstack-cloudhad no such field, so it was silently ignored and the VM got a public IP — i.e. an 'isolated' deploy was actually internet-exposed.With
--no-address(and no Cloud NAT on the subnet) the VM also has no egress; SSH and the launcher's courier still work because both go over IAP (ingress via Google's edge to the internal IP) regardless.Change
3 small additions to
scripts/bin/dstack-cloud(+8 lines): the dataclass field, its config-template default, and the--no-addressarg when the flag is set. No behavior change when unset (defaultFalse).