Docs
PricingConsole

Network guarantees

Last updated 2 November 2026

View .md

Machines are not open yet. These pages describe Machines as they will open; until then, a create answers region_not_offered (422), “Machines are not offered in any region yet.”

Rely on only HTTPS to your declared ports reaching a Machine, and on a fixed set of destinations always being blocked for it.

  • In: HTTPS to the ports the Machine declares, through Tonbo.
  • Out: the internet over IPv4, from an address the region’s Machines share.
  • Always blocked: outbound email, the cloud metadata service and private ranges.
  • An active outbound connection prevents sleep for being idle.

What can reach it

Only HTTPS to its declared ports, through Tonbo; a private port also needs a key (see Serve requests). Nothing else reaches it.

What it can reach

A Machine reaches the internet over IPv4 from an address its region’s Machines share, and a few destinations are always blocked.

  • Outbound data is not billed (“the invite”, below, is Tonbo’s invitation-only launch), and no price list holds a rate for it.
  • A connection your Machine opened never keeps it awake past its sleep-after time, but while one is open Tonbo does not put it to sleep early.
  • A resume, below, would continue a suspended Machine; Tonbo does not suspend Machines, so no wake resumes one.

Word for word

Outbound access. Your Machine can connect to the internet over IPv4.

  • Address: connections leave from an address shared by the Machines in its region, separate from Tonbo's own platform addresses. Limits that a site applies per address, such as anonymous API rate limits, are shared with other Machines, so use your own credentials. Requests to Amazon S3 in the same region use Tonbo's private path to S3 instead.
  • Always blocked: outbound email (SMTP ports 25, 465 and 587), the cloud metadata service, private and internal network ranges, and ports 7470, 10250 and 4437–4439, which Tonbo's own hosts use. Tonbo's own databases are reached inside Tonbo's network.
  • Sleep: outbound connections do not keep a Machine awake, and a sleep or resume ends them.
  • Price: outbound data is not billed during the invite. Tonbo will announce a price before it starts metering it.
  • Abuse: Tonbo may block a Machine's or an account's outbound access when it is used for abuse.

The early sleep is on When it sleeps, and the path of both directions on Network path.