In Juju, a constraint is a key-value pair that represents a specification that can be passed to certain juju commands /command flags to customise the hardware resources (bare metal machines, virtual machines, system containers, Kubernetes containers) spawned by Juju.

If the resource is a bare metal machine or a virtual machine, a constraint represents a minimum, whereas if the resource is a system container or a Kubernetes container it represents a maximum.

Constraints can be set directly at the level of the resource (only for machines on machine clouds). However, more commonly they are set at the level of the controller, model, or application. If you set constraints at multiple levels at once – that is, with overlap – the constraint applied at the more specific level takes precedence.

The rest of this document describes all the existing constraints.

Some of these keys – their availability and their meaning – vary from one cloud to another. Below this is indicated with a generic note. For specifics see List of supported clouds > <cloud name>.


List of constraints


Supplying this constraint will determine whether machines are issued an IP address accessible outside of the cloud’s virtual network.

Valid values: true, false.

Note: Applies to public clouds (GCE, EC2, Azure) and OpenStack. Public cloud instances are assigned a public IP by default.


The architecture.

Valid values: amd64, arm64, ppc64el, s390x, riscv64.


Indicates that a machine must be the specified container type.

Valid values: lxd, kvm.


Number of effective CPU cores.

Type: integer.

Alias: cpu-cores.


Abstract CPU power.

Type: integer, where 100 units is roughly equivalent to “a single 2007-era Xeon” as reflected by 1 Amazon vCPU. In a Kubernetes context a unit of “milli” is implied.

Note: Not supported by all providers. Use cores for portability.


(Starting with 3.2) The image ID. If not nil, indicates that a machine must use the specified image.

Note: Not supported by all providers. Value is provider-specific. Also, when applied during juju deploy, must be used in conjunction with the --base flag of the command – the image-id will specify the image to be used for the provisioned machines and the --base will specify the charm revision to be deployed on those machines.


Indicates that the specified role/profile for the given cloud should be used.

Note: Only valid for clouds which support instance roles. Currently only for AWS with instance profiles and (starting with Juju 3.6) for Azure with managed identities.


Cloud-specific instance-type name. Values vary by provider, and individual deployment in some cases.

Note: When compatibility between clouds is desired, use corresponding values for cores, mem, and root-disk instead.


Memory (MiB). An optional suffix of M/G/T/P indicates the value is mega-/giga-/tera-/peta- bytes.


Disk space on the root drive (MiB). An optional suffix of M/G/T/P is used as per the mem constraint. Additional storage that may be attached separately does not count towards this value.


Name of the storage pool or location the root disk is from.

Note: root-disk-source has different behaviour with each provider.


A comma-delimited list of Juju network space names that a unit or machine needs access to. Space names can be positive, listing an attribute of the space, or negative (prefixed with “^”), listing something the space does not have.

Example: spaces=storage,db,^logging,^public (meaning, select machines connected to the storage and db spaces, but NOT to logging or public spaces).

Note: EC2 and MAAS are the only providers that currently support the spaces constraint.


Comma-delimited tags assigned to the machine. Tags can be positive, denoting an attribute of the machine, or negative (prefixed with ^), to denote something that the machine does not have.

Example: tags=virtual,^dualnic

Note: Currently only supported by the MAAS provider.


Virtualisation type.

Valid values: kvm, virtual-machine.


A list of availability zones. Multiple values present a range of zones that a machine must be created within.

Valid values: Depending on the cloud provider.

Example for the aws cloud: zones=us-east-1a,us-east-1c

Note: A zone can also be used as a placement directive (--to zone= <name of zone>).

Last updated 18 days ago. Help improve this document in the forum.