expose apps instead of subnets