run in a public subnet