For AI agents: The documentation index is at https://docs.digitalocean.com/llms.txt. Markdown versions of pages use the same URL with index.html.md in place of the HTML page (for example, append index.html.md to the directory path instead of opening the HTML document).

Private Droplets are Droplets with VPC-only networking and no direct public connectivity. They are designed to work with VPC products like VPC peering, VPC NAT gateway, and VPC private DNS without additional configuration.

Private Droplets provide:

• VPC peering and VPC NAT gateway integration without additional configuration.
• Automatic use of the private DNS resolver when you create a Private Droplet in a VPC with a NAT gateway.
• Automatic peering support when you peer the VPC with another VPC.
• Automatic outbound internet connectivity when the NAT gateway is configured as the default route for the VPC. This enables downloading artifacts like Docker images and files from Spaces buckets.

Key Differences

The following diagram shows the key differences between standard and Private Droplets.

%%{init: {"themeVariables": {"edgeLabelBackground": "transparent"}} }%%
flowchart LR
    Internet[(<img alt="global-data-centers icon" src="https://docs.digitalocean.com/images/icons/diagram/global-data-centers.0ae9dbf9cd223ee5dc3ad44d496d5f74d801c59f6c8a19cf0d3532200a374888.svg" class="mermaid-icon" />  Internet)]

    subgraph VPCA["<img alt="virtual-private-cloud icon" src="https://docs.digitalocean.com/images/icons/diagram/virtual-private-cloud.d6919bf7da788149f5b1a583f0e5317dbd2c9391799b6e83abfa252fa2252258.svg" class="mermaid-icon" />  VPC A 10.0.0.0/16"]
        direction TB
        V1["<img alt="standard-droplet icon" src="https://docs.digitalocean.com/images/icons/diagram/standard-droplet.2409fa281ef5c3436178f08a67fb78544ae1085a9e9554c602c00982c33c0480.svg" class="mermaid-icon" />  Standard Droplet<br/>eth0: Public IPv4<br/>eth1: Private IPv4"]
        V2["<img alt="standard-droplet icon" src="https://docs.digitalocean.com/images/icons/diagram/standard-droplet.2409fa281ef5c3436178f08a67fb78544ae1085a9e9554c602c00982c33c0480.svg" class="mermaid-icon" />  Private Droplet<br/>eth0: Private IPv4 Only"]
        NAT[<img alt="load-balancers icon" src="https://docs.digitalocean.com/images/icons/diagram/load-balancers.1624ac0bbbc110a344dd677a12b6c9c5aa2aa9fa63c2aa61358b03eacf0bcc40.svg" class="mermaid-icon" />  NAT Gateway]
        VDNS[<img alt="DNS icon" src="https://docs.digitalocean.com/images/icons/diagram/DNS.eaec0145fbe47ae8b281a840282e4cedf91868e996a9831fc65fcbbde1385f2a.svg" class="mermaid-icon" />  VPC DNS Resolver]
    end

    subgraph VPCB["<img alt="virtual-private-cloud icon" src="https://docs.digitalocean.com/images/icons/diagram/virtual-private-cloud.d6919bf7da788149f5b1a583f0e5317dbd2c9391799b6e83abfa252fa2252258.svg" class="mermaid-icon" />  VPC B 10.1.0.0/16"]
        DropB[<img alt="standard-droplet icon" src="https://docs.digitalocean.com/images/icons/diagram/standard-droplet.2409fa281ef5c3436178f08a67fb78544ae1085a9e9554c602c00982c33c0480.svg" class="mermaid-icon" />  Droplet]
    end

    VPCA <-->|VPC Peering| VPCB
    V1 --> Internet
    V2 --> NAT --> Internet
    V2 --> VDNS

    %% Styling aligned with DO theme
    classDef doStyle fill:#0069ff,stroke:#0061EB,color:#fff
    classDef neutralStyle fill:#E5E8ED,stroke:#ccc,color:#000

    class Internet,NAT,VDNS doStyle
    class V1,V2,DropB neutralStyle

    style VPCA fill:transparent,stroke:#8A8F98
    style VPCB fill:transparent,stroke:#8A8F98

Standard Droplets

• Two network interfaces: public IPv4 (eth0) and private IPv4 (eth1).
• Direct internet access through public interface or Reserved IP.
• Can use public DNS resolvers or VPC-local DNS.

Private Droplets

• Single private IPv4 interface (eth0).
• Internet access only through VPC NAT gateway.
• Uses VPC-local DNS resolver for improved performance.
• No direct public ingress except from a regional or global load balancer.

Overview

Pricing

Private Droplets do not have additional costs beyond standard Droplet pricing. See Droplet Pricing.

Availability

Private Droplets are available in all regions.

Feedback and Support

Private Droplets are generally available and receive full support.

Our terms of service govern your use of DigitalOcean and cover details of eligibility, content, use, payments and billing, and warranties.

Create a Private Droplet

You create a Private Droplet the same way as a standard Droplet, but with public networking disabled. For Control Panel, API, doctl, and Terraform instructions, see How to Create a Private Droplet.

Networking Differences from Standard Droplets

Private Droplets have a single private network interface (eth0) instead of the two interfaces (eth0 public, eth1 private) used by standard Droplets:

• No public interface. The interfaces/public metadata path is absent. Use interfaces/private/0/ipv4/address to retrieve the Droplet’s IP address from the metadata API.
• NAT gateway routing is automatic. When the VPC has a NAT gateway set as the default route, Private Droplets route outbound traffic through it without manual route configuration. You do not need the metadata route workaround (ip route add 169.254.169.254) described in Configure Droplets for NAT Gateway.
• VPC peering routes are automatic. Private Droplets do not need manual peering route updates. See Update Peering Routes.
• Load balancer backends. Private Droplets work as backends for regional HTTP load balancers, internal network load balancers, and global load balancers. For internal network load balancers, use eth0 for both public and internal configurations (instead of eth1 for internal load balancers on standard Droplets). See Configure Droplets for Network Load Balancers. External network load balancers (ENLB) are not currently supported.

Use Private Droplets with Other Products

Load Balancers

Private Droplets work as backends for the following load balancer types:

• Regional HTTP load balancers (external and internal) connect to Private Droplets via the VPC network automatically.
• Internal network load balancers require the same backend Droplet routing configuration as standard Droplets, but use eth0 for both public and internal configurations. See Configure Droplets for Network Load Balancers.
• Global load balancers connect to Private Droplets via the VPC network.

External network load balancers (ENLB) are not currently supported.

Because Private Droplets have no public interface, all load balancer traffic reaches them through the VPC. The load balancer provides public ingress for services running on Private Droplets.

NAT Gateway

When a VPC has a NAT gateway set as the default route, Private Droplets route outbound internet traffic through it automatically. No manual route configuration is required.

For details on creating and configuring a NAT gateway, see How to Create a NAT Gateway.

VPC Peering

Private Droplets support VPC peering without additional route configuration. When two VPCs are peered, Private Droplets in either VPC can communicate with resources in the other VPC over their private IP addresses.

For details, see How to Create a VPC Peering.

Partner Network Connect

Partner Network Connect operates at the VPC level. Private Droplets in a VPC with a Partner Network Connect attachment can communicate with the connected on-premises or third-party network over their private IP addresses without additional configuration.

DigitalOcean Kubernetes (DOKS)

DOKS clusters do not currently use Private Droplets for worker nodes. DOKS worker nodes are provisioned as standard Droplets with both public and private interfaces. Private Droplets created outside the cluster can communicate with DOKS worker nodes over the VPC network if they share the same VPC or are connected via VPC peering.

Limitations and Known Issues

Private Droplets have image compatibility, IP addressing, and conversion limitations. For the full list, including image requirements for snapshots, see Private Droplet Limits.

FAQ

How do I get outbound internet access with a Private Droplet?

Use a VPC NAT gateway, or configure your own.

How do I SSH into a Private Droplet?

Use a bastion host (jump host) in the same VPC or a peered VPC. See How to Connect to a Private Droplet for SSH ProxyJump examples, separate SSH keys, and troubleshooting. For broader VPC security guidance, see VPC Best Practices.