A containerised report renderer must be reachable from partner browsers — which entry shapes can publish it, and what does each trade?

Every container platform has to answer one question for each workload: **who may originate a connection to it, and through which hop does that connection arrive?** Four shapes answer it, and most platforms offer a version of all four under their own object names. Naming them by mechanism instead of by object is what makes the trade-off visible to someone who has only ever used a different platform. ## Internal-only The workload is given an address and a name that resolve **only inside the platform**. Nothing outside can open a connection to it, because nothing outside can route to that address. - It is the correct resting state for a payments ledger API whose callers are all other workloads. - It is **reachability, not authorisation**: every workload on the platform can still reach it unless a separate rule narrows that, so the ledger still authenticates its callers. - It allocates nothing externally — no public address, no balancer instance, no certificate to renew — so it is the only shape with no external bill. ## A port reserved on every host The platform reserves **one port number across the whole fleet** and answers on it at every host. Anything that can reach any host on that number reaches the workload. - Nothing external is allocated, so there is nothing per-workload to pay for. - The number becomes a fleet-scarce, exclusive resource, usually drawn from a restricted range, so an estate of forty services acquires a registry of numbers that humans maintain. - Clients must be handed host addresses, and that set changes whenever the fleet is resized, so something outside still has to spread traffic and drop hosts that are gone. It survives as an escape hatch: traffic a shared edge cannot route, a bootstrap path, a lab. ## A balancer the platform provisions per workload The workload's spec asks for external exposure and the platform calls the infrastructure underneath to create **a balancer with its own external address**, wired to that workload's current replicas. - The workload gets a stable external address of its own and a failure domain of its own. - It can carry traffic that is not request-structured, because the balancer need not parse anything to choose a destination — there is only one. - It bills per workload: an allocated address plus a managed balancer instance, charged for as long as they exist, usually with traffic on top. Forty workloads means forty of each. ## A shared edge routing by hostname and path One external address fronts **many** workloads, and a router at that address chooses the workload from the hostname the client asked for and the path it requested. - Forty services share one address, one bill and one certificate story. - It only works for traffic the edge can parse into requests carrying a hostname; a workload speaking something else cannot be routed this way. - The edge is a **shared failure domain and a shared change surface**: one misapplied routing change, or one overloaded edge, reaches every workload behind it. - Because the certificate is presented at the edge, the hop from edge to workload becomes a separate decision with its own cost. ## Putting them side by side | Shape | External address | Per-workload bill | Chooses destination by | Failure domain | |---|---|---|---|---| | Internal-only | none | none | not applicable | the workload | | Port on every host | none | none | the port number | the fleet's port registry | | Provisioned balancer | one per workload | address plus instance | nothing — one destination | that workload | | Shared edge | one, shared | none | hostname and path | every workload behind it | ## How the choice is actually made 1. **Ask who originates the connection.** If the answer is "only other workloads", stop at internal-only; the other three are cost and surface you did not need. 2. **Ask what the traffic is.** If the edge cannot parse it into requests carrying a hostname, the shared edge is off the table and the real choice is a provisioned balancer or, reluctantly, a fleet-wide port. 3. **Ask what blast radius is acceptable.** A workload whose outage must not be shared with forty others buys its own balancer deliberately, and pays for it deliberately. 4. **Ask who renews the certificate.** A shared edge makes that one team's standing job; a balancer per workload makes it forty teams' job, or forty forgotten calendar entries. For the worked pair: the report renderer that partner browsers reach is request-structured, public and not special, so it belongs behind the shared edge under its own hostname. The payments ledger API stays internal-only; if a partner ever needs it, it joins the same edge under a hostname of its own rather than growing an external address of its own.