# Private services and isolated environments

Keep a service off the internet while other services in its environment can still reach it, and previews can no longer reach production.

Canonical URL: https://unbroker.cloud/changelog/2026-10-26-private-services
Published: 2026-10-26
Tags: Apps, Security

## Related reading

- [Cloud Apps](https://unbroker.cloud/deploy)
- [Account API](https://docs.unbroker.cloud/api/account)

Any service that listens, from a repository, an upload or an image, can now be **private**. A private service has no public URL, domain or certificate. Other services in the same environment reach it on its own port:

```text
${{services.api.host}}:${{services.api.port}}
```

The service drawer shows that internal address instead of a public URL. Turn private off to publish the service again. Custom domains, a chosen subdomain, the access gate and on-demand sleep need a public URL, so they are unavailable while a service is private.

## Environments are isolated from each other

Traffic between services is now limited to the same organization **and** the same environment. A preview or staging environment can no longer connect to production, including another project's production. Pre-deploy and post-deploy commands follow the same isolation as their service.

The first deploy in an organization after this change labels its existing workloads, so each running service restarts once.

See [Private networking](https://docs.unbroker.cloud/apps/services#private-networking) in the service docs.