Rapids Egress IP Addresses
When a Rapids container makes an outbound request, that request leaves our platform from one of a small set of public IPv4 addresses. If you need to allowlist Rapids traffic at a firewall, CDN or WAF, these are the addresses to use.
Current addresses
The authoritative, machine-readable list lives at:
https://docs.danubedata.ro/rapids-egress-ips-v4.txt
One address per line, plain text, nothing else — so you can poll and diff it from a script:
curl -s https://docs.danubedata.ro/rapids-egress-ips-v4.txt
Always read the file rather than hard-coding a copy of it.
How we announce changes
- New addresses are published at least 14 days before they carry customer traffic. Poll it more often than that and you'll see planned additions before they carry traffic.
- Removed addresses get no advance notice. A stale allow-rule for a retired address cannot break you, so removals are safe to pick up whenever you next poll.
- Emergency capacity may go live sooner than 14 days. This is rare. The file is updated immediately when it happens.
In short: additions are the only change you need to react to, and you get 14 days.
Two things to know before you rely on this
These addresses are shared. Every Rapids container on the platform egresses through the same set, not just yours. An IP allow-rule therefore admits other customers' containers too. That is fine for cutting down noise and drive-by scanning, but it is not an authorization control.
If you need "only my containers can reach this endpoint," use a secret your container holds and your origin verifies — an injected environment variable checked as a custom header, a Cloudflare service token, or mTLS. You can keep the IP rule on top for defense in depth.
IPv6
Rapids containers egress over IPv4 only, so there is no IPv6 list to allowlist.