Namespaces
A namespace is a wall between two sets of work on the same installation. Stacks, secrets, configs, jobs, domains and placement rules all live inside one, and nothing in one namespace can see or reach into another. Most people run one for what is live and one for what is being tried out, and switch between them in the top bar.
One is a fine number
Every installation has default - where everything goes when
nobody chooses. It cannot be deleted. If you only ever use that one,
everything shares a network and nothing is hidden from anything else, which
for a single application is exactly right.
What a namespace actually is
- Its own container network, named after it, that its stacks are attached to for you.
- A prefix on the names of the stacks inside it, so two namespaces can hold a stack of the same name. Stacks in
defaultkeep the name you typed. - A label on everything it owns, which is how a deploy into the wrong namespace is refused rather than silently colliding.
- The boundary a secret marked global is global to. A global secret never crosses into another namespace.
Creating one
New namespace asks for a name in lowercase letters, digits and dashes, and optionally three limits: a stack limit, a CPU limit in millicores and a memory limit in bytes. Zero means no limit. Only the stack limit is enforced today - a deploy that would go past it is refused, and the refusal quotes the count. The other two are recorded and shown.
Deleting one is refused while stacks are still in it; the button says how many have to be moved or removed first.
How many you get
| Plan | Namespaces | Quotas |
|---|---|---|
| Community | 1 | - |
| Personal | 2 | - |
| Team | 5 | - |
| Max | Unlimited | Yes |
Below Max the quota fields are disabled and the page says why: a namespace is still a boundary there, it just has no budget attached. The page also shows how many of the plan's namespaces are in use, and the New namespace button is disabled once they all are.
Roles inside a namespace
On Team and above a person's role can be set per namespace, which replaces their role there - a deployer set to viewer in one namespace is a viewer in it. See Users, roles and SSO.