Skip to main content
A subnet is a governed compute environment. Builders deploy workloads to subnets. Operators manage subnets and decide who can use them. Providers connect nodes that supply capacity to subnets. Subnets are regional in the control-plane sense. When an operator creates a subnet, they choose the region where the subnet’s control plane is domiciled. Builders then deploy to the subnet; they do not choose the region again for each workload. Actual workload execution happens on admitted data-plane capacity and may be outside that region depending on the subnet’s provider capacity and admission policy.

​
What a subnet controls

A subnet is the governance boundary for workload placement decisions and connected capacity.
User pathHow the subnet is used
BuildChoose the subnet that should manage and govern the workload.
OperateManage the subnet, runtime policy, and admission rules.
ProvideConnect nodes that can provide capacity.

​
Slugs and names

Every subnet has a slug. Commands can use a subnet slug to identify the subnet. A subnet name is a human-readable alias that can point to a subnet slug. Names are useful when people should refer to a subnet by a stable label instead of a numeric slug.

​
Regions

Create a subnet in a region: 
idyl subnet create --region us-east
Use idyl region list to see available regions. Use idyl region enable <region> when the account should allow new workload creation in approved subnets whose control plane is domiciled in that region.

​
Admission

Subnet admission controls two kinds of participation:
Admission typeControls
developerWhich accounts may submit workloads to the subnet.
providerWhich fleets or nodes may join as capacity.
Admission modes are open, approval, and invite. Admission grants can target developer accounts, provider fleets, or provider nodes.

​
Runtime policy

Subnet runtime policy controls which workload isolation classes a subnet accepts. For example, a subnet can allow only microvm workloads, require workloads to state their isolation class explicitly, or provide a default isolation class for workloads that omit one. Runtime policy is separate from admission. A provider node can be admitted to a subnet but still be incompatible with a workload’s requested isolation class. For the builder, operator, and provider model, see Workload isolation.

​
Deploy approval

Deploy approval is separate from subnet admission. Use deploy approval when an account should approve a subnet as a deployment target. Use admission when the subnet operator needs to control which developer accounts or provider capacity can use the subnet.