Give Feedback

How to Create Private Droplets

Last verified 22 Jul 2026

DigitalOcean Droplets are Linux-based virtual machines (VMs) that run on top of virtualized hardware. Each Droplet you create is a new server you can use, either standalone or as part of a larger, cloud-based infrastructure.

Copy page as Markdown View page as Markdown

Private Droplets are Droplets with VPC-only networking and no direct public connectivity. You create a Private Droplet the same way as a standard Droplet, but with public networking disabled.

Prerequisites

The automation examples below use the DigitalOcean API and, optionally, doctl.

Create a personal access token and save it for use with the API.
The curl command is installed by default on most operating systems. Refer to your operating system documentation to install the curl package if necessary.
For the doctl example, install doctl and run doctl auth init.

Create Private Droplets Using the Control Panel

Create a Private Droplet from the Control Panel by following the standard Droplet creation steps. In the Networking section, clear both the Public IPv4 address and Public IPv6 address options. (Public IPv4 address is selected by default.) When both are cleared, the Control Panel shows a This Droplet will be private notice confirming the Droplet has no public IPs and can be reached only through another resource with public access in the same VPC.

Create Private Droplets Using Automation

Create Private Droplets Using the API

Send a POST request to the /v2/droplets endpoint, specifying the public_networking parameter:

curl -X POST \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $DIGITALOCEAN_TOKEN" \
  -d '{
    "name": "my-private-droplet",
    "region": "sfo3",
    "size": "s-1vcpu-1gb",
    "image": "ubuntu-24-04-x64",
    "ssh_keys": [
      "de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef"
    ],
    "monitoring": true,
    "with_droplet_agent": true,
    "public_networking": false
}' \
  "https://api.digitalocean.com/v2/droplets"

The API returns information about the newly created Private Droplet.

For details on the response format, see the Create a New Droplet API documentation.

Create Private Droplets Using the CLI

How to Create a New Droplet Using the DigitalOcean CLI

Install doctl, the official DigitalOcean CLI.
Create a personal access token and save it for use with doctl.
Use the token to grant doctl access to your DigitalOcean account.
```
doctl auth init
```
Finally, run doctl compute droplet create. Basic usage looks like this, but you can read the usage docs for more details:
```
doctl compute droplet create <droplet-name>... [flags]
```
The following example creates a Droplet named example-droplet with a two vCPUs, two GiB of RAM, and 20 GBs of disk space. The Droplet is created in the nyc1 region and is based on the ubuntu-20-04-x64 image. Additionally, the command uses the --user-data flag to run a Bash script the first time the Droplet boots up:
```
doctl compute droplet create example-droplet --size s-2vcpu-2gb --image ubuntu-20-04-x64 --region nyc1 --user-data $'#!/bin/bash\n touch /root/example.txt; sudo apt update;sudo snap install doctl'
```
Please note: In Windows Powershell, the example command would be the following instead:
```
doctl compute droplet create example-droplet --size s-2vcpu-2gb --image ubuntu-20-04-x64 --region nyc1  --user-data "#!/bin/bash`n touch /root/example.txt; sudo apt update;sudo snap install doctl"
```

Pass --enable-public-networking=false to create a Private Droplet. This matches public_networking: false in the Create Droplet API. If the flag is missing from doctl compute droplet create --help, upgrade doctl.

The following example uses the same region, size, image, and SSH key fingerprints as the API example above:

doctl compute droplet create my-private-droplet \
  --region sfo3 \
  --size s-1vcpu-1gb \
  --image ubuntu-24-04-x64 \
  --ssh-keys de:ad:be:ef:de:ad:be:ef:de:ad:be:ef:de:ad:be:ef \
  --enable-public-networking=false

Create Private Droplets Using Terraform

You can create Private Droplets with the DigitalOcean Terraform provider. See the digitalocean_droplet resource documentation for the available attributes.

Next Steps

Private Droplets have no public IP address, so you connect to them through a bastion host. See How to Connect to a Private Droplet.

For networking behavior, integrations, and limitations, see Private Droplets.