Platforms and frameworks: exposure and health endpoints

Verified against primary documentation on 2026-10-11.

Exposure

Platforms aimed at application developers call the inside level private:

• Render: a Private Service has no public URL and is meant "for internal APIs and microservices that should only be accessible to your own infrastructure" (Private services).
• Railway: Private Networking gives every service a *.railway.internal name, apart from Public Networking (Private networking).
• Fly.io: private networking over 6PN addresses and <app>.internal names (Private networking).
• Knative: the networking.knative.dev/visibility: cluster-local label keeps a service off the external gateway (Private services).
• DigitalOcean App Platform: internal_ports without an http_port keeps a component on the private network (Internal routing).

Heroku is the exception, with Internal Routing for apps in Private Spaces (Internal routing). OpenShift sets an ingress controller's load balancer scope to External or Internal (IngressController API).

Cloudflare puts staff tools behind Access, enforcing identity at its edge, and Tunnel, which connects the origin outward so it opens no inbound port (Secure private web apps).

Health endpoints

• GitLab serves /-/health, /-/readiness and /-/liveness on its main port (Health check).
• Prometheus serves /-/healthy and /-/ready, plus /-/reload and /-/quit once --web.enable-lifecycle is set (Management API).
• Spring Boot Actuator serves /actuator/health/liveness and /actuator/health/readiness, optionally on a separate management port (Kubernetes probes).
• Quarkus serves /q/health/live, /q/health/ready and /q/health/started (SmallRye Health).

GitLab and Prometheus both reserve /-/ for operational endpoints, so they cannot collide with application routes.

gRPC health protocol

grpc.health.v1.Health defines Check, Watch and List. The empty service name means the health of the whole server; other names are matched exactly, and the protocol does not mandate a naming scheme (gRPC health checking). grpc-health-probe checks it from the command line and predates the Kubernetes grpc probe (grpc-health-probe).