For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Limits

• Some Droplet network traffic is restricted to help prevent malicious actions, like reflected DDoS attacks. We know these restrictions also prevent functionality like configuring direct server return and using Droplets as routers and site-to-site VPN gateways. Future changes to our network may support this functionality. Until then, some workarounds include using a VPN mesh network or overlay network.

  The following types of traffic are restricted:

  • TCP and UDP traffic on port 11211 inbound from external networks (due to the Memcached amplification attacks in March 2018).

  • Multicast traffic.

  • Traffic not matching a Droplet’s IP address/MAC address.

  • SMTP via Reserved IPs and IPv6.

• Droplets with Premium CPUs have a network throughput limit of 10 Gbps. GPU Droplets have a network throughput limit of 25 Gbps over VPC and 10 Gbps over public connections. All other Droplets have a maximum network throughput limit of 2 Gbps.

  • All non-GPU Droplets also have an inbound network throughput limit matching their outbound limit: 10 Gbps for Droplets with Premium CPUs and 2 Gbps for all other non-GPU Droplets. We are enabling this limit on a region-by-region basis and currently enforce it in MKC1 and RIC1. Traffic exceeding the limit may be rate limited. This does not affect billing; only outbound traffic counts against your monthly transfer allowance.

  • In addition to the throughput limits, inbound traffic may also be subject to a packet-rate (packets per second) limit. Traffic exceeding this limit may also be rate limited.

• You can’t create more than 10 Droplets at the same time using the Control Panel or the API.

• SMTP ports 25, 465, and 587 are blocked on all Droplets. We recommend using a dedicated email deliverability platform, like SendGrid, and generally recommend against running your own mail server.

• /proc/cpuinfo shows your Droplet plan, either DO-Premium or DO-Regular. You can see which processors each plan uses in Choosing the Right Droplet Plan.

• Root password resets are not available for operating systems with internally-managed passwords, including AlmaLinux, Fedora, and Rocky Linux.

• Droplets cannot have more than one Reserved IP address assigned to them at a time.

Autoscale Pool Limits

• Autoscale pools do not support using Droplets with password authentication. Instead, use SSH key authentication.

• Autoscale pools do not currently support health checks. During configuration changes, autoscale pools provision Droplets with the new configuration, then wait for the pool’s specified cooldown duration before deleting the old Droplets.

• You cannot tag autoscale pools. You can tag the Droplets in an autoscale pool.

• You cannot change the cooldown duration (10 minutes) for autoscale pools set to fixed size. You can change the cooldown duration for autoscale pools set to autoscale.

GPU Droplet Limits

• You cannot resize GPU Droplets.

• GPU Droplets have a network throughput limit of 25 Gbps over VPC and 10 Gbps over public connections.

• Non-GPU Droplets do not support jumbo frames, so GPU and non-GPU Droplets can only communicate over the VPC using the standard 1,500 byte MTU size.

• To create multi-node GPU Droplets, you need to contact support to enable that functionality for your team.

• The control panel currently doesn’t display network transfer for GPU Droplets, but does display other plan details.

• L40S GPU Droplets don’t have NVLink hardware, so they don’t support configuration with NVIDIA Fabric Manager. Instead, use H100 GPU Droplets, which do support NVIDIA Fabric Manager.

Private Droplet Limits

• Private Droplets require a DigitalOcean base image released May 2022 or later. Images released before May 2022 do not support the network configuration mechanism Private Droplets use at boot.

  This also applies to snapshots: a Private Droplet created from a snapshot of a Droplet running a base image released before May 2022 can fail to boot, even if the snapshot itself is recent. If a Private Droplet fails to boot from a snapshot, create the Droplet from a current distribution image instead and migrate your workload to it.

• Public static IPv6 addresses cannot be enabled at creation time or assigned later.

• Reserved IPv4, Reserved IPv6, and BYOIP addresses cannot be assigned to Private Droplets.

• You cannot convert Droplets in either direction. Standard Droplets cannot be converted to Private Droplets, and Private Droplets cannot be converted to standard Droplets. To move a workload, create a new Droplet (for example, from a snapshot) and migrate the workload.

• The Droplet Console is not available for Private Droplets because they have no public IP address. Connect through a bastion host instead. See How to Connect to a Private Droplet.

• Private Droplets are visible in the Control Panel like any other Droplet. Only the VPC IP is shown.

Known Issues

• Due to our network design, traceroute diagnostics between Droplets may display 100% packet loss during the last two hops. The packet loss is expected and does not have any impact on the connectivity between Droplets.

GPU Droplet Known Issues

• Powering GPU Droplets on and off from the control panel may be slow, especially for 8 GPU Droplets. We recommend using soft reboots from the command line (reboot or shutdown --reboot), the API’s reboot action, or doctl compute droplet-action reboot instead.

• When using the AI/ML-ready image on 8 GPU Droplets, journald does not automatically start on boot. To enable journald logs, restart the service with sudo systemctl restart systemd-journald.