Private networking with .internal

Every Aloof account gets a private network where apps reach each other as .internal. How it works, how it's isolated, and its current limits.

Most backends are several processes: a web frontend, an API, a worker and a database. They should talk privately, without a public hop and without hard-coded IPs. On Aloof every app, worker and managed database of an account joins that account's private network, and each is reachable by name:

http://api.internal:8080           # another app
http://api-worker.internal:9090    # a process group's metrics port
postgres://...@pg-mydb:5432/...    # injected as DATABASE_URL

How it works

Each account has its own bridge network on the host. When an instance starts, it's attached with two DNS aliases, <app> and <app>.internal, resolved by the network's embedded DNS. All instances of an app share the alias, so the name keeps working across redeploys and scaling. One-off machines (release commands and cron jobs) join the same network, so a migration can reach your database and a cron job can call your API.

Isolation

Networks are per account, so another account's containers have no route to yours and can't resolve your names. Our integration test checks exactly this on a real Docker host: an app in account A fetches from another app in A by .internal name, and the same request from account B fails. Public traffic only reaches an app through the edge proxy on its HTTP port. Other ports you open are private.

Reaching private ports from your laptop

$ aloof proxy 5432 -a reports-db
proxying 127.0.0.1:5432 -> reports-db:5432 (Ctrl-C to stop)

aloof proxy tunnels TCP over an authenticated WebSocket to the instance's private address. Use it for psql, admin UIs and debugging. Sessions are audited.

Current limits

• .internal spans one host today. Apps placed on different remote nodes don't share a network yet. A WireGuard mesh between nodes is the next step (the control plane already reaches nodes over WireGuard).
• On remote nodes, aloof proxy reaches only the app's HTTP port.
• There's no cross-account peering.

More posts

• Deploying FastAPI with Postgres on Aloof
• Next.js and Rails on Aloof: two stacks, one workflow
• The economics of scale-to-zero
• MCP: let your AI agent deploy (safely)
• Zero-downtime deploys and instant rollbacks
• Managed Postgres backups, off-site and encrypted
• Aloof vs Fly.io, Render and Railway: how they compare