Skip to main content
This feature is in public preview.
Instances can have a public IPv4 address for internet connectivity. You choose whether an instance has a public IP when you create it; you cannot change it afterward. IPv6 is not yet supported.

​
Enabling a public IP

Set --public-ipv4 when creating an instance to assign a public IP address.
SF Compute assigns the public IP automatically and releases it when you delete the instance. No two instances share an IP. Not every SKU supports public IPv4. The interactive SKU picker lists only SKUs that do. If you pass an --instance-sku that does not support it, the request fails with a 422 error. Without --public-ipv4, the only inbound port open on the instance is SSH (TCP port 22); nothing else is reachable from the internet. Connect with sf instances ssh.

​
Internet connectivity

Instances reach the internet via IPv4 using TCP, UDP, and ICMP. SF Compute blocks all other layer 4 protocols. It also blocks outbound SMTP (TCP and UDP port 25). Contact us if you need this restriction removed. Firewall rules govern inbound traffic. Source CIDRs must be public IPv4 addresses. Internet source IPs are spoofable, so treat firewall rules as security hardening, not your primary security control. SF Compute blocks all traffic to an instance’s UDP or TCP port 68 to prevent DHCP attacks.

​
Finding an instance’s IP

Run sf instances get with the instance name or ID to see its public IP.
Instances created with --public-ipv4 show a PUBLIC IPV4 row, which reads pending until SF Compute assigns the IP. In --json output, the public_ip field appears once SF Compute assigns the IP, and only on instances created with --public-ipv4.