Private networks, and three ways in.

Machines talk to each other on a private network. You reach a service inside through a proxy route, a port forward or a tunnel.

A private network is closed to everything outside it.

Machines on the same network reach each other over private IPs, with nothing exposed on the host. Machines on different networks cannot reach each other.

Private networks work for Linux guests on Firecracker. Windows guests cannot join one yet.

Some VMs take no ingress at all.

A VM created with --network-policy isolated-web accepts no inbound traffic. Kiln refuses proxy routes and port forwards for it and points you to kiln vm forward, which still works.

  1. kiln networks create --name app-net --cidr 10.44.0.0/24

    Creates the network.

  2. kiln vm stop api

    A VM has to be stopped first, because Kiln writes its network configuration to the disk before boot.

  3. kiln vm network attach api --network-id <network-id>

    Attaches the stopped VM.

  4. kiln vm start api

    After start, kiln vm get api --json includes the VM's private_ip.

Routes and forwards follow the machine.

Stop
Kiln removes the machine's exposure rules from the host.
Start
Kiln puts its saved routes and forwards back.
Delete
Kiln removes the routes and forwards for good.

Port forwards serve outside traffic

A forward carries traffic that reaches the host on its real IP or domain. Running curl localhost:8080 on the host itself is not supported.

Proxy routes get HTTPS with the API

With TLS on, Kiln serves each proxy-route domain over HTTPS and redirects plain HTTP. The domain has to resolve to the same host as the API.

Guests resolve DNS through the host.

Linux guests send DNS queries to a Kiln proxy on their gateway address. The proxy forwards them to the resolvers the host had when kilnd started.

Ready means DNS works

Kiln checks that the guest reaches the proxy over UDP and TCP, and that an outside name resolves, before it calls a VM ready.

Or name the servers yourself

Set KILN_GUEST_DNS_SERVERS to a comma-separated list. Kiln skips the proxy and gives guests those servers directly.