Recommended tenant isolation for a multi-tenant platform on Machines

[deepdas]

We’re building a platform where customers deploy their own code, each
workload running as a Machine. We’re deciding how to lay this out before
we open it up.

Two things we want to guarantee:

• customer workloads cannot reach our control-plane apps
• customer workloads cannot reach each other

As we understand it, 6PN is organisation-wide and .internal DNS resolves
across apps in the org, so a single app holding all workloads wouldn’t give
us either property.

1. Is one Fly app per customer, each created with --network, the
   intended pattern here? Any limits on apps or networks per org?

2. If workloads sit on a custom network, can an app on a different network
   still connect to them by private address — or must it join the same
   network?

3. Is there any way to disable .internal resolution for an app, or to
   restrict inbound 6PN to specific sources?

Happy to share a minimal reproduction.

[lillian]

@deepdas

Is one Fly app per customer, each created with --network, the intended pattern here?

yes. see One App Per Customer - Why? · Fly Docs in our docs for a more complete explanation.

@deepdas

Any limits on apps or networks per org?

nope, you can have as many apps/networks as you want.

@deepdas

If workloads sit on a custom network, can an app on a different network still connect to them by private address

no, this is the point of custom networks. you can assign a Flycast address if you need this: Flycast - Private Fly Proxy services · Fly Docs

@deepdas

Is there any way to disable .internal resolution for an app, or to restrict inbound 6PN to specific sources?

it’s not possible to disable DNS resolution (nor would it make sense to); custom networks are the correct solution for isolating different apps on 6pn.