Outbound IP

Every box reaches the internet from one outbound IP. Boxes in the same group share it.

Groups

Project setting	Group of a box
No outbound IP label (default)	The project
--outbound-ip-label tenant	The box’s tenant value; boxes without tenant share the project group

A group gets its address when its first box is created or labeled, and keeps it. A new group takes the address that carries the fewest groups, so groups share addresses when there are more groups than addresses. Other projects may share an address too.

When the address changes

• A box that is awake keeps the address it started with. A new label value or project setting applies at the box’s next start; until then box inspect shows both addresses.
• run9 adds addresses without moving existing groups. If an address is retired, its groups get another one at their next start.

Commands

⌘Copysys9 run project outbound-ips [--label-value <text>]
sys9 run project update --outbound-ip-label <label-key>
sys9 run project update --outbound-ip-label ""
sys9 run box inspect <box-id>

• project outbound-ips lists each address once, then, with a label set, every label value with its address and box count. --label-value keeps values containing the text, ignoring case.
• box inspect prints Outbound IP, as <current> (<next> after next start) while a change waits. JSON output includes outbound_ip, current_runtime_outbound_ip, and pending_outbound_ip_change.
• In the Go SDK, use ListOutboundIPs and UpdateProjectRequest.OutboundIPLabel.

Network rules

• Boxes reach public IPv4 addresses over TCP and UDP.
• Private, link-local, loopback, multicast, and reserved ranges are not reachable.
• DNS works as before.

Only project admins can change the outbound IP label. Every project member can see the addresses.