Nothing is public until you say so.
Real VPCs, real subnets, real route tables. Isolation is the default state of every Instance, not a rule you remember to add.
VPCs and subnets
A production VPC with a public web subnet and a private db subnet. The db subnet has no internet route — by default it cannot reach the internet, and the internet cannot reach it.
Reserved IPs
A Reserved IP is yours until you release it. Attach it to an Instance to make that Instance reachable; detach it and attach it to another — the address follows you, not the machine.
Free while attached to a running Instance; a small idle fee applies when reserved but unattached — final rate published at launch.
Published at launchEgress without babysitting a NAT instance.
Managed egress for private subnets: Instances with no public address can still reach package mirrors, APIs, and webhooks through a gateway you control. It replaces the hand-rolled NAT Instance you’d otherwise babysit — and it belongs to the same honest-pricing pillar as everything else here.
Managed egress for private subnets — final pricing published at launch.
Published at launchOne firewall, top to bottom.
One tier of rules per VPC, priority-ordered, evaluated top down. No security-group- plus-NACL split to reason about — one list, one order, one answer.
Stated plainly
Firewall rules have sensible limits, and if you turn off firewalling on an Instance, it’s open — we tell you when that’s the case.
Deeper than simple-cloud networking
These are real subnets with real route tables — you decide what routes exist, not a flat network with a checkbox for “private.” Multi-tier layouts, isolated databases, and controlled egress are network design here, not workarounds.
Create a VPC from any surface
Create a VPC from the CLI, the API, or Terraform — the same control plane answers all three.
triton vpc create production --region ams-1
triton subnet create db --vpc production --private