Network sharing

Networks are normally project-isolated — a network in project acme-prod is invisible to acme-staging. Network sharing punches a controlled hole in that isolation: the owner project shares a specific network with a specific other project (in the same workspace), and the receiving project can attach VMs to the shared network as if it were their own.

Use cases: a shared services network (databases, caches, internal APIs) that several application projects need to reach. The alternative is exposing the services on public IPs and re-securing them at L7 — possible, but more complex than sharing the L2 segment within the trust boundary of a workspace.

Cross-workspace sharing isn't possible — that's a deliberate isolation boundary.

What's next

• Networks — the resource that gets shared.
• Workspaces — the boundary of sharing.
• Security groups — what filters traffic on a shared network.