Hostnames and DNS

Every container deployed on Bahriya gets one or more hostnames automatically. You don't need to configure DNS manually — Bahriya handles it.

Default hostname

When a container is created, Bahriya gives it a unique, generated host name, such as mamluk-123. Its hostnames are built from that name, not from the container's handle. In each region it runs in, the container is reachable at a regional hostname:

{name}.{region}.x.on.bahriya.app

For example, a container named mamluk-123 deployed to helsinki-1 gets:

mamluk-123.helsinki-1.x.on.bahriya.app

If the container runs in multiple regions, each region gets its own regional hostname. Traffic to a regional hostname always goes to the container in that specific region. The container's default hostname, {name}.x.on.bahriya.app, covers all of its regions.

These hostnames are created automatically and managed entirely by Bahriya. The console shows them in the container's networking settings.

Vanity hostname

A vanity hostname routes traffic across two or more regions. The hostname depends on the DNS mode you choose:

{name}.rr.on.bahriya.app    (round-robin mode)
{name}.geo.on.bahriya.app   (geo mode)

See DNS Modes for details on each routing mode.

Custom domains

A custom domain lets you use your own domain name (e.g. api.yourcompany.com) rather than a bahriya.app subdomain. You provide the domain and Bahriya issues the certificate and routes traffic.

You can attach up to 5 custom domains to a single container. The first is included; each additional custom domain is billed at $2.50 per month, metered per minute (60-second minimum, rounded up) — the same model as every other addon.

For each custom domain:

1. Add the domain in the container's networking section (or via domains: in YAML / Reis).
2. Add a CNAME record at your DNS provider pointing your domain to the Bahriya-provided target, and a CNAME from _acme-challenge.<your-domain> to the _acme-challenge target shown beside it. See Setting Up a Custom Domain.
3. TLS is provisioned automatically once both records resolve. All custom domains for a container share a single multi-SAN certificate, so adding or removing a domain triggers a single renewal.

Custom domains support the same DNS modes as vanity hostnames.

www → apex redirect

For apex domains (e.g. example.com, not sub.example.com), you can opt in to a www.{domain} → {domain} redirect on a per-domain basis. When enabled, the redirect is provisioned automatically and the certificate covers both the apex and the www. variant. The toggle is only available for apex entries — sub-hostnames don't qualify.

TLS / HTTPS

All hostnames — default, vanity, and custom — are served over HTTPS. TLS certificates are provisioned automatically via the ACME protocol and renewed before expiry. You do not need to manage certificates.

HTTP traffic is redirected to HTTPS.

DNS TTL

You can configure the DNS TTL (time to live) for your container's DNS records. A lower TTL means DNS changes (such as adding a region or enabling failover) propagate faster, at the cost of slightly higher DNS query volume.

Available values: 60s, 300s, 600s, 1800s, 3600s. The default is 300s (5 minutes).