# Scaleway Serverless Containers now support private-only ingress inside a VPC Scaleway's October 2026 release adds private endpoints for Serverless Containers, allowing internal services to receive traffic through a Private Network while disabling the public endpoint. Operators can now build isolated serverless APIs without a public ingress workaround. Private ingress joins existing private egress for Scaleway Serverless Containers. The new option can isolate services inside a VPC, but private DNS, TLS, authentication, cold-start and network-scope constraints still matter. - Status: Active - Published: 2026-10-20T06:26:14+13:00 - Updated: 2026-10-20T06:26:14+13:00 - Categories: Cloud & Infrastructure, Hosting, Cloud Platforms, Deployment & DevOps - Tags: containers, private networking, Scaleway, serverless, VPC - Canonical HTML: https://beyondthe.news/dossiers/scaleway-serverless-containers-private-ingress-vpc-october-2026 ## What changed Scaleway's October 2026 product changelog announces private endpoints for Serverless Containers. A container attached to a Scaleway Private Network can now expose an internal ingress endpoint, while the public default endpoint can be disabled separately. Previously supported private egress enabled outbound access to VPC resources; the new inbound endpoint completes a private-only service path. Scaleway's current how-to, endpoint concepts and security documentation describe console controls, API visibility and internal DNS. ## Why it matters Small teams often want a worker, API, webhook processor or internal AI service to run on serverless infrastructure but be reachable only by other applications or databases in a VPC. Before private ingress, a public endpoint with authentication or a proxy added an internet-facing surface and operational complexity. Disabling the public endpoint and using internal service discovery changes the default exposure model, without making application authentication or network design optional. ## A private endpoint is distinct from private egress Attach a Serverless Container to a Scaleway Private Network, then enable its private endpoint in Network & Domains. Resources with connectivity to the same VPC can reach the container at an internal hostname of the form http://..internal. The API exposes a private_endpoint field only when the feature is enabled. Private egress, which lets a container call internal resources, existed before this October ingress change. ## Disable public ingress to achieve isolation The private endpoint and the public default endpoint are independent controls. Scaleway's security guide explicitly instructs operators to attach the container to a Private Network, enable private ingress and disable the public endpoint to prevent internet access. Merely enabling a private endpoint while leaving the public one on does not isolate the service. IAM-based X-Auth-Token authentication remains compatible with private endpoints. ## DNS, HTTPS and VPC routing need testing Scaleway assigns an internal DNS name to the private endpoint and supports TLS through a generated private-endpoint certificate. Clients may need to trust the certificate authority. DNS is resolved through the VPC's DNS service; custom routes and automatic routing across Private Networks in the same VPC are supported. Operators should verify the caller's VPC connectivity and certificate trust before disabling their public route. ## There are operational limits Scaleway permits one attached Private Network per container, with an IP allocated to each instance rather than a reservable fixed container IP. Private Network attachment may lengthen cold starts. Both V1 and V2 sandbox environments support the integration. The official reference says attaching a container to a Private Network does not itself add a charge; that is not a promise that compute, traffic or other resources are free. ## A practical migration check For an internal service, attach it to the intended Private Network, enable the private endpoint, test from a VPC-connected caller with HTTPS and the required IAM token, then disable the public endpoint and verify that internet requests fail. Keep a rollback plan and check any external webhooks, health checks or CI jobs that previously called the public URL. Use a gateway only for deliberately public routes. ## Key details - Announced in Scaleway's October 2026 changelog; private ingress is available for Serverless Containers. - Enable the private endpoint under Network & Domains after attaching the container to a Private Network. - Disable the public default endpoint separately to eliminate public internet ingress. - Private endpoint format: ..internal; the API returns private_endpoint when enabled. - Private ingress supports IAM X-Auth-Token authentication and HTTPS with a private-endpoint certificate. - Only one Private Network can be attached per container; each instance has its own automatically assigned IP. - Private Network attachment has no additional charge according to Scaleway's reference, but standard service charges remain. ## Builder takeaways - Check whether your serverless service truly needs a public endpoint; private-only ingress now offers an alternative. - Test internal DNS, TLS trust and caller VPC routes before disabling the public endpoint. - Keep IAM authentication for sensitive internal APIs; private networking is not a substitute for application access control. - Audit webhooks and third-party integrations that cannot reach internal hostnames before changing exposure. - Allow for per-instance IP allocation and potentially longer cold starts. ## What to watch - Provider documentation or API changes to endpoint toggles and private DNS. - Regional availability and any changes to limits or billing. - Independent deployment reports on private-endpoint reliability, cold starts and certificate handling. ## Uncertainties - Scaleway's changelog states October 2026 but does not establish an exact release day in the inspected source. - No independent latency, availability or security assessment of this newly enabled ingress path was located. - Availability may depend on product and region; consult current regional support before deployment. ## Sources - [Scaleway October 2026 changelog](https://www.scaleway.com/en/docs/serverless-containers/) — Scaleway · primary. October feature announcement and distinction from earlier private egress. - [Use Serverless Containers with Private Networks](https://www.scaleway.com/en/docs/serverless-containers/how-to/use-private-networks/) — Scaleway · primary. Enable/disable private endpoints, internal DNS, API field, HTTPS. - [Secure a container](https://www.scaleway.com/en/docs/serverless-containers/how-to/secure-a-container/) — Scaleway · primary. Three-step private-only isolation and IAM authentication. - [Serverless Containers and Private Networks integration](https://www.scaleway.com/en/docs/serverless-containers/reference-content/containers-private-networks/) — Scaleway · primary. Network, routing, cost, compatibility and cold-start limits.