DMZ type of deployment configuration

In a typical application I have several components running on Bluemix and now all of them exposes their interfaces to the public network. Of course they have been protected by https and various credentials. Anyway this exposes more interfaces to public interface and creates potential risk of leaks. At least now all runtime based components work in this way.

I would like to see a "normal" deployment option where I can decided the interface components and their very narrow public interfaces. All those components which communicates only inside the application should not be visible to public internet.