Fly.ioAnnouncement
Fly.io introduces 6PN, an IPv6 private network intended to let applications in the same organization communicate without public IP addresses, mTLS, or certificates. Each application instance receives an organization-scoped IPv6 address, while per-application internal DNS zones resolve instances, regions, and sibling apps; enabling it requires private_network = true in fly.toml, though the post says it will soon be on by default. Examples show nginx discovering cache shards, Redis binding to fly-local-6pn, and NATS forming a cross-application cluster through internal names. Behind the feature, addresses encode organization, host, and instance identifiers, while BPF programs enforce network isolation and support WireGuard cryptokey routing; a Rust DNS server serves internal records. The stated goal is simple private connectivity with optional user-managed clustering, service discovery, and certificate infrastructure.
Applications deployed on Fly.io previously communicated through public IP addresses, leaving operators to secure those connections, commonly with mutual TLS and certificates. The post presents 6PN as an answer to the basic VPC-style private networking capability needed by cooperating services.
6PN assigns each application instance an organization-scoped IPv6 address and provides internal DNS zones for application, regional, and organization-level discovery. BPF programs enforce isolation and rewrite addresses for WireGuard cryptokey routing, while a Rust DNS server serves internal records. The feature is enabled with private_network = true in fly.toml and is planned to become enabled by default.
Each instance receives a 6PN IPv6 address reachable only within its organization; an app's internal DNS zone resolves its instances, with names available for regions and sibling applications.
BPF programs enforce that one 6PN network cannot communicate with another and perform address rewriting so WireGuard cryptokey routing works without a dynamic routing protocol.
Redis can bind directly to fly-local-6pn, making the service organization-locked by default through 6PN; TLS certificates remain available for more elaborate authentication needs.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
BPF is not one hook but a set of attachment points, and each one sees different traffic. This diagram maps XDP, TC, socket-level BPF LSM, and sched_ext so you can pick the layer that can actually enforce your rule.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
