Egress IP

Every SubImage deployment reaches the internet from one static public IP. If your internet-facing systems restrict access by source address, allowlist that IP so SubImage can reach them.

Your egress IP

When you view these docs inside your authenticated tenant, SubImage fills in your deployment's address here:

<EGRESS_IP>

The same value is shown on the Configuration settings page, where you can copy it.

What egresses from it

Your deployment runs in its own AWS account and its own VPC. These workloads sit in private subnets with no public address of their own, so they all reach the internet through a single NAT gateway holding this IP:

• Cloud and SaaS API calls. Every sync module talking to AWS, GCP, Azure, GitHub, Okta, and the rest.
• Container image pulls. The vulnerability scanner fetching images from your registries.
• Agent sandbox traffic. Repository clones and package installs performed by the chat agent.
• Outbound notifications. Slack, email, and custom webhook deliveries.

One exception: traffic routed through a SubImage Outpost reaches your network over your own Tailscale tailnet, so it does not arrive from this IP. Allowlist the Outpost host instead for those targets.

When it changes

In practice, never. The address is allocated when your deployment is provisioned and stays attached to it. Application deploys, task restarts, and scaling events do not change it.

It only changes if the deployment's network is rebuilt, for example when moving the deployment to a different AWS region. That is a planned operation, and SubImage tells you the new address in advance.