Why network isolation matters

Most "managed" platforms put your workload on a shared box behind a firewall rule and a password. That's a soft boundary: one misconfiguration, one shared kernel bug, and a neighbor can reach traffic that was never meant for them.

A private network per tenant

On Sahabti, every service lives in its own VXLAN overlay. There is no shared L2 segment between tenants, so isolation is enforced by the network fabric itself — not by hoping a firewall rule holds.

What that buys you

• No lateral movement. A compromised neighbor has no route to your service.
• Predictable performance. Your traffic isn't competing on a shared bridge.
• Simpler mental model. Each service is its own island with one public, TLS-terminated door.

sahabti network inspect my-database
# → overlay: vxlan-4817  peers: 0  public-endpoint: db.fra-1.sahabti.com:5432

Isolation shouldn't be a feature you pay extra for. On Sahabti it's the default — the only way we know how to run multi-tenant infrastructure safely.