Private services and isolated environments
Keep a service off the internet while other services in its environment can still reach it, and previews can no longer reach production.
Any service that listens, from a repository, an upload or an image, can now be private. A private service has no public URL, domain or certificate. Other services in the same environment reach it on its own port:
${{services.api.host}}:${{services.api.port}}The service drawer shows that internal address instead of a public URL. Turn private off to publish the service again. Custom domains, a chosen subdomain, the access gate and on-demand sleep need a public URL, so they are unavailable while a service is private.
Environments are isolated from each other
Traffic between services is now limited to the same organization and the same environment. A preview or staging environment can no longer connect to production, including another project’s production. Pre-deploy and post-deploy commands follow the same isolation as their service.
The first deploy in an organization after this change labels its existing workloads, so each running service restarts once.
See Private networking in the service docs.