Stay organized with collections
Save and categorize content based on your preferences.
Dual-stack subnets let your Cloud Run services and jobs send IPv4
and internal IPv6 traffic to a VPC network with Direct VPC egress.
You can change the stack type of an existing Cloud Run service or job or
update an existing subnet to a dual-stack subnet.
Dual-stack support is only available with subnets in a custom-mode
VPC network. To have the internal access type
available for dual-stack subnets, the VPC network internal IPv6
range must be enabled. Set up or convert
the VPC network to custom mode.
Compared to IPv4-only subnets, dual-stack subnets might experience elevated
cold-start latencies, limiting how quickly your application can scale up.
Dual-stack subnets have both IPv4 and IPv6 address ranges. Cloud Run
services and jobs can only send IPv6 traffic through a subnet that uses
internal IPv6 addresses.
To add a dual-stack subnet with an internal IPv6 range on a Cloud Run
service or job, do the following:
Click Create VPC network if you are creating a new custom-mode network.
If you are using an existing VPC network, click the name of the
VPC network to show its VPC network details page.
If you are creating a new network or converting an existing one, enter the
name and be sure that the Subnet creation mode is set to Custom, then select
Configure a ULA internal IPv6 range for this VPC Network.
From the Subnets tab, click Add subnet. In the panel that appears:
Provide a Name.
Select a Region.
For IP stack type, select IPv4 and IPv6 (dual-stack).
If the Internal option is not available, check that an internal
IPv6 range is assigned on the network.
Click Done, then click Create.
Deploy a Cloud Run service or
execute a job on the dual-stack
subnet that you created. As you enter the needed service or job details, you
can select the new IPv6 address range by following these steps:
Click Container(s), Volumes, Networking, Security and select the
Networking tab.
Click Connect to a VPC for outbound traffic and then Send traffic
directly to a VPC.
Select the Network that you created in the previous step.
Click the Subnet field to select the newly created IPv6 address
range.
The service or job is automatically provisioned
with the subnet's stack type.
gcloud
To create a custom-mode network that supports dual-stack subnets, run the
following command:
NETWORK: the name of the VPC network
that will contain the new subnet.
PRIMARY_IPv4_RANGE: the primary IPv4 range for the new
subnet, in CIDR notation. For more information, see IPv4 subnet
ranges.
REGION: the Google Cloud region that the new
subnet will be created in.
Deploy a Cloud Run service or
execute a job on the dual-stack
subnet that you created. The service or job is automatically provisioned
with the subnet's stack type.
Changing the subnet's stack type from IPv4 and IPv6 (dual-stack) to IPv4 only
(single-stack) is not supported because the Compute Engine IPv6
access type is internal. To change a service or job's dual-stack subnet to a
single-stack subnet, deploy the service or
execute the job on an IPv4-only
(single-stack) subnet.
Verify the network and subnet
To check that your service or job is on the VPC network, run the
following command:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-25 UTC."],[],[],null,["# Set up dual-stack services and jobs\n\n| **Preview\n| --- Dual-stack services and jobs (internal IPv6 addresses only)**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\n\nDual-stack subnets let your Cloud Run services and jobs send IPv4\nand internal IPv6 traffic to a VPC network with Direct VPC egress.\nYou can change the stack type of an existing Cloud Run service or job or\nupdate an existing subnet to a dual-stack subnet.\n\nSubnet types\n------------\n\nVPC networks support the following\n[Compute Engine subnet types](/vpc/docs/subnets#subnet-types):\n\n- IPv4 only (single-stack) subnets, with only [IPv4 subnet ranges](/vpc/docs/subnets#ipv4-ranges)\n\n- IPv4 and IPv6 (dual-stack) subnets, with both IPv4 and internal [IPv6 subnet ranges](/vpc/docs/subnets#ipv6-ranges)\n\nDual-stack limitations\n----------------------\n\nBefore you change the stack type on an existing Cloud Run service\nor job, consider the following limitations:\n\n- Cloud Run only supports subnets with the *internal* IPv6\n access-type setting. Learn more about\n [internal and external access types for IPv6 addresses](/vpc/docs/subnets#ipv6-ranges).\n\n- Dual-stack support is only available with subnets in a custom-mode\n VPC network. To have the internal access type\n available for dual-stack subnets, the VPC network internal IPv6\n range must be enabled. Set up or [convert](/vpc/docs/create-modify-vpc-networks#switch-network-mode)\n the VPC network to custom mode.\n\n- Compared to IPv4-only subnets, dual-stack subnets might experience elevated\n cold-start latencies, limiting how quickly your application can scale up.\n\n- [NAT64](https://tools.ietf.org/html/rfc6146) is not supported.\n\nAdd a dual-stack subnet on a service or job\n-------------------------------------------\n\nDual-stack subnets have both IPv4 and IPv6 address ranges. Cloud Run\nservices and jobs can only send IPv6 traffic through a subnet that uses\n[internal IPv6 addresses](/vpc/docs/subnets#ipv6-ranges).\n\nTo add a dual-stack subnet with an internal IPv6 range on a Cloud Run\nservice or job, do the following: \n\n### Console\n\n1. In the Google Cloud console:\n\n 1. Enable the Compute Engine API:\n\n [Enable the Compute Engine API](https://console.cloud.google.com/apis/library/compute.googleapis.com)\n 2. Go to the **VPC networks** page:\n\n [Go to VPC networks](https://console.cloud.google.com/networking/networks/list)\n2. Click **Create VPC network** if you are creating a new custom-mode network.\n If you are using an existing VPC network, click the name of the\n VPC network to show its *VPC network details* page.\n\n3. If you are creating a new network or converting an existing one, enter the\n name and be sure that the **Subnet creation mode** is set to **Custom** , then select\n **Configure a ULA internal IPv6 range for this VPC Network**.\n\n4. From the **Subnets** tab, click **Add subnet**. In the panel that appears:\n\n 1. Provide a **Name**.\n 2. Select a **Region**.\n 3. For **IP stack type** , select **IPv4 and IPv6 (dual-stack)**.\n 4. Enter an **IPv4 range** . This is the [primary IPv4 range](/vpc/docs/vpc#vpc_networks_and_subnets) for the subnet.\n 5. Select **Internal** for the **IPv6 access type**.\n\n If the **Internal** option is not available, check that an internal\n IPv6 range is assigned on the network.\n 6. Click **Done** , then click **Create**.\n\n5. [Deploy a Cloud Run service](/run/docs/deploying) or\n [execute a job](/run/docs/execute/jobs#execute_jobs) on the dual-stack\n subnet that you created. As you enter the needed service or job details, you\n can select the new IPv6 address range by following these steps:\n\n 1. Click **Container(s), Volumes, Networking, Security** and select the **Networking** tab.\n 2. Click **Connect to a VPC for outbound traffic** and then **Send traffic\n directly to a VPC**.\n 3. Select the **Network** that you created in the previous step.\n 4. Click the **Subnet** field to select the newly created IPv6 address range.\n\n The service or job is automatically provisioned\n with the subnet's stack type.\n\n### gcloud\n\n1. To create a custom-mode network that supports dual-stack subnets, run the following command:\n\n```\ngcloud compute networks create NETWORK \\\n --subnet-mode=custom \\\n --enable-ula-internal-ipv6\n```\n\nReplace \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of the VPC\nnetwork that will contain the new subnet.\n\n1. To convert to or update a custom-mode network so that it supports dual-stack subnets, run the following command:\n\n```\ngcloud compute networks update NETWORK \\\n --subnet-mode=custom \\\n --enable-ula-internal-ipv6\n```\n\nReplace \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e with the name of the VPC\nnetwork that will contain the new subnet.\n\n1. To create a dual-stack subnet with an internal IPv6 range, run the [`subnets create` command](/sdk/gcloud/reference/compute/networks/subnets/create) using the dual-stack settings:\n\n```\ngcloud compute networks subnets create SUBNET \\\n --network=NETWORK \\\n --range=PRIMARY_IPv4_RANGE \\\n --stack-type=IPV4_IPV6 \\\n --ipv6-access-type=INTERNAL \\\n --region=REGION\n```\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eSUBNET\u003c/var\u003e: a name for the new subnet.\n- \u003cvar translate=\"no\"\u003eNETWORK\u003c/var\u003e: the name of the VPC network that will contain the new subnet.\n- \u003cvar translate=\"no\"\u003ePRIMARY_IPv4_RANGE\u003c/var\u003e: the primary IPv4 range for the new subnet, in CIDR notation. For more information, see [IPv4 subnet\n ranges](/vpc/docs/subnets#manually_created_subnet_ip_ranges).\n- \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e: the Google Cloud region that the new subnet will be created in.\n\n1. [Deploy a Cloud Run service](/run/docs/deploying) or [execute a job](/run/docs/execute/jobs#execute_jobs) on the dual-stack subnet that you created. The service or job is automatically provisioned with the subnet's stack type.\n\nChange a subnet from single-stack to dual-stack\n-----------------------------------------------\n\nTo add an internal IPv6 subnet range to an existing IPv4-only subnet in a\ncustom-mode VPC network, see\n[Change a subnet's stack type to dual-stack](/vpc/docs/create-modify-vpc-networks#subnet-enable-ipv6).\nThen, [deploy the service](/run/docs/deploying) or [execute the job](/run/docs/execute/jobs#execute_jobs)\non the dual-stack subnet.\n\nChange a subnet from dual-stack to single-stack\n-----------------------------------------------\n\nChanging the subnet's stack type from IPv4 and IPv6 (dual-stack) to IPv4 only\n(single-stack) is not supported because the Compute Engine IPv6\naccess type is internal. To change a service or job's dual-stack subnet to a\nsingle-stack subnet, [deploy the service](/run/docs/deploying) or\n[execute the job](/run/docs/execute/jobs#execute_jobs) on an IPv4-only\n(single-stack) subnet.\n\nVerify the network and subnet\n-----------------------------\n\nTo check that your service or job is on the VPC network, run the\nfollowing command:\n\n\u003cbr /\u003e\n\n```bash\ngcloud run services describe SERVICE_NAME --region=REGION\n```\n\n\u003cbr /\u003e\n\nReplace \u003cvar translate=\"no\"\u003eREGION\u003c/var\u003e with the Google Cloud region that the\nnew subnet was created in.\n\nThe following example output shows your network and subnet: \n\n VPC Access:\n Network: example-network\n Subnet: example-subnet\n Egress: private-ranges-only"]]
