> Source: https://meetrix.io/blogs/netbox-ipam-gcp/ > Markdown copy of that page. Cite the URL above, not this file. Development # NetBox on GCP: Self-Hosted IPAM and DCIM [By Shalomi Umeshika](https://meetrix.io/blogs/authors/shalomi-umeshika/) • November 6, 2026 • 14 min read ## The IP Spreadsheet Has to Go Somewhere Every network team has a source of truth. Usually it's an IP spreadsheet, a rack diagram nobody has touched since the last refresh, and one engineer who remembers which VLAN the printers are on. That holds until two people assign the same address in the same week. **NetBox on GCP** moves all of it into one PostgreSQL database with an API in front: sites, racks, devices, cables, prefixes, IP addresses, and VLANs, on a VM in your own Google Cloud project. Meetrix's image deploys it from GCP Marketplace in one form: NetBox 4.7.4 in Docker on Ubuntu 26.04, PostgreSQL 18, Valkey, a background worker, Nginx with Let's Encrypt, and a database backup that runs every day and can copy itself to a Cloud Storage bucket. Below: what the image does for you, the form fields that matter, your first site and API token, and when [NetBox Cloud](https://netboxlabs.com/products/netbox-cloud/) is the better buy. You can [launch NetBox on GCP Marketplace](https://console.cloud.google.com/marketplace/product/meetrix-public/netbox-ipam) right now. The Quick Verdict Self-host fits More than 100 devices No cap on devices, IP addresses, or API calls. The thousandth switch costs the same as the first. Self-host fits The map has to stay in your project Every internal address and circuit sits in a database on your VM, in the zone you pick, backed up to your own bucket. Use NetBox Cloud A small network, no VM to run The free plan covers 100 devices and 500 IP addresses, and NetBox Labs runs it. Try Docker first Just evaluating Run netbox-docker on a laptop for an afternoon. Deploy the image when real inventory goes in. ## What Is NetBox? [NetBox](https://netboxlabs.com/docs/netbox/) is an open-source tool for documenting and modeling network infrastructure, under the Apache 2.0 licence. It started at DigitalOcean, NetBox Labs maintains it now, and it's become the default answer when network engineers ask where inventory should live. Source and release notes are on [GitHub](https://github.com/netbox-community/netbox). It records what your network is supposed to look like. It doesn't scan or monitor anything. That's the point: your automation reads from it, so a playbook configures a switch with the VLANs NetBox says it should have. Our piece on the [benefits of Ansible automation](https://meetrix.io/blogs/benefits-of-ansible-automation/) covers the playbook side of that. IPAM - Prefixes, IP addresses, ranges, and aggregates, with utilisation per prefix - VRFs, route targets, VLANs, and VLAN groups - The next free address in a subnet, instead of a guess DCIM - Sites, locations, racks with elevation views, and the devices in them - Interfaces, cables, power feeds, and (new in 4.7) cooling Circuits and more - Providers, circuits, and terminations - Virtual machines, clusters, VPN tunnels, tenants, and contacts Automation - REST and GraphQL APIs - Webhooks, event rules, custom scripts, custom fields, and plugins - Config contexts that hand per-device data to your tools ## What's in NetBox 4.7.4 4.7.0 shipped on September 2, 2026, and 4.7.4 (the version on the GCP image) on October 27. It's still the latest release as of early November, with no 4.8 on the horizon yet. Our [NetBox on AWS article](https://meetrix.io/blogs/netbox-aws-marketplace/) walks through every 4.7 feature and breaking change, so here's the short version, plus what the patch releases actually changed. ### The 4.7 features you'll use - **Background bulk writes.** Add `?background=true` to a bulk create or update and NetBox queues it as a job, returning HTTP 202 straight away. Big imports stop timing out halfway. - **Per-object errors on bulk requests.** A failed bulk request now returns a structured response that names each offending object by its index in the submitted list, so you resubmit only the ones that actually failed. - **Snapshot-aware event rules.** A webhook can fire only when a device's status actually changes to active, not on every save. - Cooling infrastructure, module bay types, relocatable modules, and channelized subinterfaces for breakout ports. ### What the patch releases changed 4.7.2 (September 29) closed a real problem: on 4.7.0 and 4.7.1, the plaintext of API tokens created through background bulk requests was saved in job results, where anyone allowed to view jobs could read it. The image is past that. 4.7.3 (October 13) added a location filter on power feeds and a stack of performance work: skipping config context data when it's excluded from a REST response, reusing nested serializers, deferring GraphQL schema construction, and extending table prefetching to reverse many-to-many relations. 4.7.4 (October 27) is the one on your VM. It adds trunk cable profiles (8C1P, 12C1P, 24C1P), an `__empty` lookup for boolean custom field filters, a copy-to-clipboard button for site addresses, and `object_change_ids` in event data and webhook payloads, so you can trace changes from a webhook back to the changelog. The bigger 4.7.4 headline is the GraphQL circuit status fix, covered below. ### The breaking changes that matter Coming from 4.6 or older, the ones that bite are: - **PostgreSQL 15 or later is required.** PostgreSQL 14 is no longer supported, and the upgrade script will abort if you're on an earlier release. - **Redis 6.0 or later is required.** Redis 5.x support was dropped. - **Selection custom fields now return objects.** Values come back as `{"value": "datacenter", "label": "Data Center"}` instead of a plain string. Writes still accept the raw value. - **`protocol` and `ports` are replaced by `port_mappings`.** The legacy fields are retained as deprecated in the REST and GraphQL APIs, but at the ORM level they're read-only. Passing `protocol` or `ports` to the model raises a `TypeError`. - **Config context is always included in REST API representations.** `?exclude=config_context` is silently ignored, and the `DeviceWithConfigContextSerializer` classes are gone. - **Bulk operations now return structured errors** with an `errors` array keyed by object index. The operation is still all-or-none, but you know which objects failed and why. - **API token plaintext is read-only on creation.** Any value you supply is ignored. - **Running a custom script through the API now needs a token with write ability enabled.** Read-only tokens get a 403. The full list is in the [release notes](https://netboxlabs.com/docs/netbox/release-notes/). ## The GraphQL Circuit Status Change in 4.7.4 This one deserves its own section because it's the first thing that breaks when people upgrade to 4.7.4 with existing GraphQL dashboards. For several releases, the circuit status enum was exposed under the generic type name `status` with unprefixed values (`ACTIVE`, `PLANNED`, and so on) instead of the `CircuitStatusEnum` with `STATUS_` prefixes that every other status enum uses. That was a bug, introduced in 4.3.0 when the enum was created with `as_enum('status')` instead of `as_enum(prefix='status')`. 4.7.4 fixes it. The enum is now `CircuitStatusEnum`, and its values are `STATUS_ACTIVE`, `STATUS_PLANNED`, and so on. The catch: any GraphQL query that filters circuits by the old unprefixed values (`{exact: ACTIVE}`) now fails. You need to update those queries to `{exact: STATUS_ACTIVE}`. The filter input type also changes from `StatusBaseFilterLookup` to `CircuitStatusEnumBaseFilterLookup`. If you have dashboards or automation querying circuits over GraphQL, check them before you upgrade. It's a one-line change per query, but it's a silent failure until you look. ## What the GCP Image Does for You NetBox is a Django app with PostgreSQL, two caches, a background worker and a web server in front. Getting those talking, secured and backed up is the afternoon most people underestimate. The image is that afternoon, done. Five containers, wired up `netbox-app` for the UI and API, `netbox-worker` for jobs and webhooks, `netbox-db` for PostgreSQL 18, and two Valkey instances, one for the task queue and one for the cache. Secrets that are yours Each VM generates its own database and cache passwords on first boot. The admin password is the one you type on the form. SSL handled The image asks Let's Encrypt for a certificate on first boot, and one script on the VM finishes the job once your DNS points at it. Backups that run without you A daily dump at 12:00 UTC, seven days kept on the VM, and an upload to your Cloud Storage bucket if you name one. That last one is the biggest difference from our AWS AMI, where the backup script only runs when you schedule it. On GCP the cron job is already in `/etc/cron.d/netbox-dbbackup` the moment the VM boots. Billing runs through your Google Cloud account. The licence fee lands on the same invoice as the VM, and new subscriptions get a **5-day free trial** with up to USD 50 in licence fee credits. Compute and disk still bill during the trial. The default e2-medium is about **$0.055 an hour** on-demand in us-central1, roughly **$40 a month** before the licence fee and disk. NetBox is light, and that's one of the cheaper servers you'll run. ## Deploy NetBox on GCP in Five Steps 1. Create a backup bucket (optional, but do it)It has to exist before you deploy. The form takes its name without the `gs://` prefix. 2. Open the listingGo to [NetBox on GCP Marketplace](https://console.cloud.google.com/marketplace/product/meetrix-public/netbox-ipam), click Launch, pick your project, and accept the terms. 3. Fill in the formUse the table below. Tick the trial checkbox if you want it, then click Deploy. 4. Point your domainCopy the VM's external IP and create a DNS A record. Then run the certificate script if SSL wasn't issued at boot. 5. Sign inOpen your domain, or the `admin_url` output over plain HTTP until SSL is ready. The username is `admin`. ### Deployment form fields | Field | What to enter | | --- | --- | | Deployment service account | Choose **New account**, or use one with Config Agent, Storage Admin, Compute Admin, and Service Account User. Storage Admin is what lets the deployment grant the VM access to your bucket. | | Machine type | `e2-medium` (the minimum). `e2-standard-2` or larger for big inventories or heavy automation. | | Boot disk | Balanced persistent disk, 20 GB minimum. Go bigger if you'll upload lots of images and attachments. | | External IP | Ephemeral works. A reserved static IP keeps your DNS record valid across stop and start. | | Domain name | For example `netbox.yourcompany.com` | | Admin email | Used for the Let's Encrypt certificate and as the admin user's email | | Backup bucket | An existing bucket name, without `gs://`. Leave it empty and backups stay on the VM only. | | Admin password | 8 to 64 characters: letters, digits, and `!@#%^*_+=.,-` | If the deployment fails with a 403 on the bucket, the service account is missing Storage Admin, or the bucket name is wrong. Deploy again with New account selected. With an ephemeral IP, your DNS record can't exist before the VM does, so the first-boot certificate request usually fails. That's expected. Once the A record resolves: ```bash gcloud compute ssh -vm --zone= sudo bash /root/certificate_generate_standalone.sh ``` A 502 Bad Gateway in the first few minutes just means NetBox is still starting. First boot takes about 5 minutes after the deployment finishes, while the VM generates its passwords and creates the admin user. The [NetBox on GCP developer guide](https://meetrix.io/blogs/netbox-gcp-developer-guide/) has every screen of the form, plus restores, logs, and troubleshooting. ## Your First Site, Prefix, and Token 1. Add a siteUnder _Organization_, open _Sites_ and click _Add_. Name it after the data centre or office. NetBox fills in the slug. 2. Add a prefixUnder _IPAM_, open _Prefixes_, add the network in CIDR notation (say `10.10.0.0/16`) and assign it to the site. 3. Create usersOne account per person, with only the permissions they need. The admin account can delete anything. 4. Create an API tokenUnder _Admin_, open _API Tokens_ and add one. Leave write access off unless the tool changes data, and copy the token straight away. NetBox doesn't show it again. 4.7 tokens start with `nbt_`, and the header format changed. Build it from the key and the token, separated by a dot, and test it against the status endpoint: ```bash curl -H "Authorization: Bearer nbt_." \ -H "Accept: application/json" \ https://netbox.yourcompany.com/api/status/ ``` A JSON reply with the NetBox version means you're in. Scripts written for older NetBox that send `Authorization: Token ...` get a 403, which is the first thing that breaks when people move an existing automation over. The [REST API guide](https://netboxlabs.com/docs/netbox/integrations/rest-api/) covers filtering, pagination, and token formats, and the interactive reference is at `/api/schema/swagger-ui/` on your domain. Migrating a spreadsheet? Every list view has a bulk import for CSV, JSON, or YAML. Import in dependency order (sites, racks, device types, devices, then interfaces and IPs), because NetBox won't accept a device for a site that doesn't exist yet. ## Backups on GCP Everything you record lives in one PostgreSQL database. It's the one thing you can't get back by redeploying, and you usually need it most on the day something else has broken. So it's worth knowing exactly what the image does. | What | Where | | --- | --- | | Schedule | Daily at 12:00 UTC, in `/etc/cron.d/netbox-dbbackup` | | Local copies | `/opt/backups/`, last 7 days | | Cloud Storage | `gs:///netbox-dbbackup/`, never deleted automatically | | Log | `/var/log/scripts/dbbackup.log` | | Not included | Uploaded images and attachments (a separate Docker volume) | One detail I like: the deployment gives the VM's service account **Storage Object Creator** on your bucket and nothing more. The VM can add new dumps but can't read or delete old ones. So if the VM is ever compromised, whoever is on it can't wipe your backup history on the way out. The flip side is that nothing cleans the bucket up. Add an [Object Lifecycle rule](https://cloud.google.com/storage/docs/lifecycle) that deletes dumps after 30 or 90 days, or they pile up forever. And if you use image attachments, snapshot the boot disk now and then, because the daily dump doesn't cover them. ## Running NetBox Safely The VM - SSH is open to the internet by default. Narrow the source range on the form to your own IPs. - Leave "full access to all Google Cloud APIs" unticked. NetBox doesn't need it. - An ephemeral IP changes when the VM stops. Promote it to static, or update DNS after every restart. Accounts and tokens - Keep the admin superuser to one or two people. - One token per tool, read-only unless it writes, with an expiry on anything temporary. - Don't sign in over the plain HTTP `site_url` once SSL works. The password would travel unencrypted. Because NetBox holds a full map of your network, think about who can reach it at all. Plenty of teams keep it off the public internet and reach it over a VPN, which our [OpenVPN server on GCP](https://meetrix.io/blogs/openvpn-vpn-server-gcp/) sets up in the same project. Upgrades can happen in place Unlike the AWS AMI, you don't need a new deployment for a new NetBox version. Run `sudo /opt/scripts/dbbackup.sh`, set `VERSION` in `/opt/netbox/.env` to the new tag, then run `sudo docker compose pull` and `sudo docker compose up -d` in `/opt/netbox`. NetBox applies its migrations on start. Read the breaking changes first if scripts or plugins talk to the API, especially the GraphQL circuit status change in 4.7.4. ## Self-Hosted vs NetBox Cloud NetBox Labs sells a hosted version, and for small networks it's the right call. Here's the comparison, using what NetBox Labs publishes on its [pricing page](https://netboxlabs.com/pricing/). | | NetBox on GCP by Meetrix | NetBox Cloud | | --- | --- | --- | | Where data lives | Your own GCP project and zone | NetBox Labs' cloud, in one of its seven regions | | Pricing | Licence fee plus the VM, billed on your Google Cloud invoice | Free plan, then Starter, Professional, and Premium through sales. No public prices. | | Devices and IP addresses | No cap | Free plan: 100 devices and 500 IP addresses | | API requests | No cap | Free plan: 10,000 a month | | File uploads | No cap beyond disk | Free plan: 5 MB maximum | | Prefix list entries | No cap | Free plan: 10 entries | | Backups | Daily, to your own bucket, built in | Free plan: once per day. Professional and up: hourly | | Plugins, webhooks, custom scripts | Included | Paid plans only | | Upgrades | In place, when you choose | Free plan: automatic. Paid plans: automatic or on-demand | | Support | Meetrix, by email, replies within 12 hours | Email on Starter; 24x7 with SLAs on Premium | My view: under 100 devices, use the free Cloud plan. It costs nothing and there's no server, though it comes with 2 operational branches, 5 MB file uploads, 10 prefix list entries, and no plugins, webhooks, or custom scripts. Past that, Cloud's paid tiers start with a sales call, while the image is one line on your GCP bill with no limit on devices or API calls. If the data has to stay in a project you control, it stops being a cost question. ## Marketplace Image, Docker, or Cloud Recommended Meetrix image on GCP Marketplace Best for production with the least setup PostgreSQL 18, Valkey, Nginx, SSL, per-VM secrets, and daily backups to Cloud Storage. Supported by Meetrix. netbox-docker Best for a laptop or your own server The community [netbox-docker](https://github.com/netbox-community/netbox-docker) project runs the same containers. Proxy, SSL, secrets, and backups are yours. NetBox Cloud Best for a small network Sign up and start documenting. Free up to 100 devices and 500 IP addresses. Docker is the fastest way to try it. For inventory you depend on, the image is less work, because secrets, SSL, and backups are exactly the parts that get skipped on a test install and then carried into production. ## Resources [ NetBox on GCP - Developer Guide Step-by-step deployment on Google Cloud: launching the image from GCP Marketplace, filling in the deployment form, pointing DNS, creating an API token, generating SSL, and backing up and restoring the database with Cloud Storage. Meetrix.IO | Binuka Ranatunga ![NetBox GCP Developer Guide cover](https://meetrix.io/blog-images/paas-products-articles/netbox-gcp/netbox-blog-gcp.png)](https://meetrix.io/blogs/netbox-gcp-developer-guide/) ## Is NetBox on GCP Worth It? For a team past 100 devices, or one that has to keep its network map in its own project, yes. No caps, a database you control, an API your automation can lean on, and backups that run from day one without anyone remembering to schedule them. For a small network, the free Cloud plan does the job. Running on AWS instead? [NetBox on AWS](https://meetrix.io/blogs/netbox-aws-marketplace/) covers the CloudFormation version. Once NetBox knows what your network should look like, the [Apache Guacamole gateway on GCP](https://meetrix.io/blogs/guacamole-remote-desktop-gateway-gcp/) gives your team browser-based SSH and RDP into the machines it documents, and [Rancher on GCP](https://meetrix.io/blogs/rancher-kubernetes-management-gcp/) manages the Kubernetes clusters running on top. Specs and launch options for both clouds are on the [NetBox store page](https://meetrix.io/store/netbox/). ## Frequently Asked Questions What is NetBox? An open-source tool for documenting and modeling network infrastructure (IPAM for addresses and prefixes, DCIM for sites, racks, and devices) with full REST and GraphQL APIs on top. Which version does the GCP image run? NetBox 4.7.4, the patch release from October 27, 2026, in Docker on Ubuntu 26.04 with PostgreSQL 18. It's the latest release as of early November. Which machine type do I need? e2-medium is the minimum and fine for most teams. Go to e2-standard-2 or larger for big inventories or heavy API automation. Are backups automatic? Yes. A daily dump runs at 12:00 UTC, keeps seven days on the VM, and uploads to your Cloud Storage bucket if you named one. Add a lifecycle rule to clean the bucket up, because nothing deletes old dumps automatically. Why does my API token get a 403? Two likely reasons. In 4.7, the header format changed to Authorization: Bearer nbt\_., so older scripts sending Authorization: Token ... will fail. And running a custom script through the API now needs a token with write access enabled. Self-hosted NetBox or NetBox Cloud? Under 100 devices with no data residency requirement, the free Cloud plan is the easier call, though it's limited to 2 operational branches, 5 MB file uploads, and 10 prefix list entries, with no plugins, webhooks, or custom scripts. Past that, or if the network map has to stay in a project you control, self-hosting wins on cost and control. How do I upgrade NetBox on GCP? In place. Back up with /opt/scripts/dbbackup.sh, set VERSION in /opt/netbox/.env, then docker compose pull and docker compose up -d. Migrations run on start. Watch for the 4.7.4 GraphQL circuit status change if you query circuits. Where do I get help? Support goes to the Meetrix team at [support@meetrix.io](mailto:support@meetrix.io), and the [NetBox on GCP developer guide](/blogs/netbox-gcp-developer-guide/) covers the form, restores, logs, and troubleshooting. ## Ready to Replace the IP Spreadsheet? Deploy NetBox 4.7.4 in your own Google Cloud project, with PostgreSQL 18, SSL and daily backups to Cloud Storage. One source of truth for your network, on infrastructure you control. [Get Started on GCP Marketplace](https://console.cloud.google.com/marketplace/product/meetrix-public/netbox-ipam) Meetrix Store NetBox Open-source IPAM and DCIM, the source of truth for your network [Deploy it](https://meetrix.io/store/netbox/) Meetrix Store New Deploy what this guide covers, pre-configured. - [NetBox Open-source IPAM and DCIM, the source of truth for your network](https://meetrix.io/store/netbox/) - [Grafana Dashboards and alerts for Prometheus and more](https://meetrix.io/store/grafana/) - [Headscale Your own Tailscale control plane](https://meetrix.io/store/headscale/) - [Jitsi Meet Self-hosted video calls for 50 to 500 users](https://meetrix.io/store/jitsi-meet/) - [RustDesk Remote desktop AMI, a TeamViewer alternative](https://meetrix.io/store/rustdesk/) - [Coturn TURN/STUN for WebRTC, no per-minute relay fees](https://meetrix.io/store/coturn/) [Browse all products](https://meetrix.io/store/)