--- title: "Addresses and protocols" description: "A Cube's default address under glac.run, your own domains, Cubes with no address on the internet, and the protocols that reach an instance." --- > Documentation Index > Fetch the complete documentation index at: https://glac.ai/docs/llms.txt > Use this file to discover all available pages before exploring further. # Addresses and protocols ## The default address Every app has `https://-.glac.run`, where `` is six characters of the project's id. It has it from the moment it is made; renaming the app changes it. `glac cube get` and the app's `url` show it. Requests to it pass through a proxy in front of the platform, which handles TLS and keeps floods of traffic (DDoS) away. The proxy has limits of its own: request bodies of at most 100 MB, and answers that pause for at most 125 seconds. For more, give the app `direct: true` (`glac cube update api --direct true`): it then also answers at `direct_url`, under `direct.glac.run`, which skips the proxy and has only the platform's own limits in front of it. [Addresses](/docs/platform/addresses/) has the proxy's limits and the direct names of every product side by side. Every app and every sandbox link has a name of its own under `glac.run`. Until `glac.run` is on the Public Suffix List, a page under one of them can set a cookie for all of `glac.run` that other customers' pages can read. Keep your app's cookies to its own name (no `Domain` attribute), and do not trust cookies scoped to the whole domain. ## Your own domain `POST /v1/domains` with `{"domain": "api.example.com", "app": "api"}` points a name of yours at an app (or `{domain, sandbox, port}` at a port of a sandbox). The answer lists the DNS records that prove the name is yours: - **Through the proxy** (the default, `proxied: true`): a `CNAME` from your name to `.glac.run`. The proxy checks the name and issues its certificate. - **Direct** (`proxied: false`): a `CNAME` to `.direct.glac.run`; or, for a name at the top of a domain, which cannot have a CNAME, a `TXT` record at `_sandbox-domain.` with the token, and the name's `A` and `AAAA` records pointed at the addresses the answer gives. The certificate is issued and renewed for you. Every address of the name must point at the platform, and nobody else's proxy or CDN may stand in front of a direct name. Keep the record in your DNS after the name works: without it the certificate is not renewed. `glac domains create api.example.com --app api` does the same and prints the record, `glac domains ls`, `get`, `update` and `rm` do the rest, and so do the SDKs (`glac.domains` in Python) and the MCP server's `domain_*` tools. A domain's `status` is `pending_verification`, `pending_certificate`, `active` or `detached` (its app or sandbox was deleted). Deploys and rollbacks need no change to the domain: it follows the app. A project has at most 100 domains (403 `domain_limit_reached`). Registering, changing and deleting a domain needs a key with the `admin` scope. ## Apps with no address on the internet An app with `public: false` (`--public false`) has no default address. Other services and sandboxes of the project reach it on the project's private network, at `.internal`, and domains pointed at it still work. See [services and Compose](/docs/cube/services/). ## Protocols Clients reach an app over HTTP/1.1, HTTP/2 or HTTP/3. A request that comes over HTTP/2 or HTTP/3 reaches your service over HTTP/2 without TLS (h2c) when your service speaks it, and over HTTP/1.1 when it does not. Nothing needs to be set: the platform asks the port once. A request that comes over HTTP/1.1 reaches it over HTTP/1.1. - **gRPC** works when your service speaks HTTP/2 without TLS, which a gRPC server on a plain port does (gRPC-Go, tonic, grpc-js, grpcio): unary calls, streams in either or both directions, metadata, trailers and status codes pass through as they are. Call it at the app's address on port 443 with TLS. - **A call or a stream is one request**, however long it stays open and however many messages pass on it. While it is open the instance is awake and metered as awake, so give long streams a deadline. - **Trace headers.** A request's `traceparent` and `tracestate` ([W3C Trace Context](https://www.w3.org/TR/trace-context/)) reach your service as the client sent them, over HTTP/1.1 and HTTP/2 alike, unless the app has the platform take part in its requests' traces (its `traces`): then your service gets the platform's own `traceparent`, whose span is the parent of yours, and the client's `tracestate` only where the app takes the client's trace. See [traces](/docs/platform/logs/#traces). - **WebSockets** come over HTTP/1.1. One stays open while the instance sleeps, and new data on it wakes the instance. - **Connections to your service are shared.** After an answer, the platform keeps its connection to the instance's port open for a moment (a second for an instance without a key, 200 milliseconds for a keyed instance or a sandbox) and sends the next request on it, which may be another client's; over HTTP/2, one connection carries every client's requests already. So a service that ties a login to its TCP connection, as NTLM does, cannot stand behind these addresses. A connection kept so does not keep the instance awake. Source: https://glac.ai/docs/cube/addresses/index.mdx