A private network
between your servers.
A VPC is a real network on the host your servers run on. Attach two servers to the same one and they get addresses out of your own range and talk over that instead of over the public internet. It's one region, one host, and it has no route out.
A network your servers share
Create a VPC, attach servers to it, and each one comes up with a second interface on a network only they can see. Traffic between them stays on the host instead of leaving and coming back over their public addresses.
An address out of your own range
A VPC carries one range: 10.10.0.0/24, unless you set a different one when you create it. Every server you attach is allocated an address from that range, shown in the console and written into the server's cloud-init network config, so an image that runs cloud-init comes up holding it. Nothing on the network hands addresses out, so check the interface after the reboot rather than assuming.
The private side has no way out
There's no gateway on a private network and no route off it. Your server still reaches the internet through its public IPv4, and the internet still reaches your server the same way. A VPC carries traffic between machines you own: it isn't a NAT gateway, and it isn't a way to run a server without a public address.
Attaching a server reboots it
Attach and the server cold-reboots to come up with the new interface. Detach and it cold-reboots again. Neither one is a live change, so do both in a window where a reboot costs you nothing.
What a VPC does today
Six things, and they're the whole list. A VPC is built on the hypervisor's own software-defined networking, so it's a real network on the host rather than a set of firewall rules standing in for one.
Four things a VPC doesn't do
Each one is missing for a reason we can state, and none of them has a date on it.
Subnets would mean a second record of which address went where, kept in step with the first one by hand, and a subnet with a gateway would quietly hand every attached server a route to the internet you never asked for. DHCP is blocked on three separate things in the hypervisor underneath. Cross-host networking isn't built, and we won't build it before there's a second host to reach.
A VPC lives on one host
The check when you attach a server is on the region, not on the host it landed on. So the console will let you attach two servers that can't actually reach each other, and nothing will warn you that it did. If two servers need to talk over a VPC, attach them both and ping one from the other before you build anything on top of it.
Common questions
Is this the same thing as the network page?
No. That one is the public side: the public IPv4 on every server, the firewall in front of it, inbound DDoS scrubbing and the carriers into each region. Read it on the network page. This page is only about traffic between servers you own.
How many VPCs can I have, and what range do they use?
Five per account. Each one carries a single range, 10.10.0.0/24 unless you set a different one when you create it, and every server you attach gets an address out of it.
Can I split a VPC into subnets?
No. One range per VPC. A second record of which address went where would have to be kept in step with the first one by hand, and a subnet with a gateway would give every attached server a route to the internet nobody asked for.
Is there DHCP on a private network?
No. Nothing on the network hands addresses out. The address is allocated when you attach and written into the server's cloud-init network config, so an image that runs cloud-init brings the interface up with it on the reboot that attaches it. Run ip a once it's back and confirm before you build on it. Three separate things in the hypervisor block DHCP itself, and we won't give a date until that changes.
Does attaching a server take it down?
Yes. Attach and it cold-reboots. Detach and it cold-reboots again. Plan both.
Can a server reach the internet over its private interface?
No. There's no gateway on it. Outbound traffic leaves through the server's public IPv4 and inbound arrives on it, exactly as it did before you created the VPC.
Can servers in two regions share a VPC?
No. A VPC belongs to one region and a server from another one is refused. In practice it's narrower still: a VPC doesn't reach past the host your servers landed on.