Add illustrations-january 2026 batch 2

monitoring/logs-api-options.html.md

@@ -6,6 +6,10 @@ author: kcmartin
 date: 2025-10-01
 ---
 
+<figure>
+<img src="/static/images/logs-api-options.png" alt="Illustration by Annie Ruygt of a rocket ship, a satellite dish, a cargo container, and a clock, all representing different options for logs" class="w-full max-w-lg mx-auto">
+</figure>
+
 ## Overview
 
 Fly.io apps run on Firecracker microVMs we call Machines. Each Machine captures `stdout`/`stderr`, ships those logs over NATS, and stores them for a period of time in a Quickwit-backed search index. Most users consume logs via `fly logs` or by setting up log shipping to an external sink.

networking/flycast.html.markerb

@@ -4,6 +4,10 @@ layout: docs
 nav: firecracker
 ---
 
+<figure>
+<img src="/static/images/flycast-private-proxy.png" alt="Illustration by Annie Ruygt of apps resting on clouds, all connected by pathways" class="w-full max-w-lg mx-auto">
+</figure>
+
 Flycast provides network addressing and routing for private apps on Fly.io private networks. With Flycast, requests to your private apps get routed through the Fly Proxy, rather than Machine-to-Machine via default [private networking](/docs/networking/private-networking/). And unlike private networking using `.internal` addresses you don't need to keep Machines running for the app to be reachable.
 
 Use Flycast within your organization's private network to:

networking/private-networking.html.md

@@ -7,6 +7,10 @@ redirect_from:
   - /docs/reference/private-networking/
 ---
 
+<figure>
+<img src="/static/images/private-networking.png" alt="Illustration by Annie Ruygt of computers that look like buildings connected through underground tunnels" class="w-full max-w-lg mx-auto">
+</figure>
+
 Fly Apps in an organization are connected by a mesh of WireGuard tunnels using IPv6 called a 6PN. Private networking over your 6PN is always available to apps by default; you don't have to do anything special to get it.
 
 Apps within the same organization are assigned special addresses (6PN addresses) tied to 6PN. Those applications can talk to each other because of their 6PN addresses, but applications from other organizations can't. The Fly.io platform won't forward packets between different 6PNs, unless you explicitly allow it, for example when you [allocate a Flycast address](/docs/networking/flycast/#allocate-a-flycast-address).

networking/request-headers.html.md

@@ -4,6 +4,10 @@ layout: docs
 nav: firecracker
 ---
 
+<figure>
+<img src="/static/images/request-headers.png" alt="Illustration by Annie Ruygt of flying ghosts carrying lanterns" class="w-full max-w-lg mx-auto">
+</figure>
+
 Request headers carry information that is specific to the incoming request and its path taken to the application. Request headers are added by the HTTP handler service.
 
 ## Request Headers

networking/services.html.markerb

@@ -6,6 +6,10 @@ redirect_from:
   - /docs/reference/services/
 ---
 
+<figure>
+<img src="/static/images/public_network_services.png" alt="Illustration by Annie Ruygt of a ship carrying apps" class="w-full max-w-lg mx-auto">
+</figure>
+
 Fly.io has public and private network services available. The public network services connect apps to the wider public internet, while the [private network services](/docs/reference/private-networking) allow apps to communicate with other apps within the Fly.io private network.
 
 ## Anycast IP addresses

networking/understanding-cloudflare.html.md

@@ -6,6 +6,10 @@ author: kaelyn
 date: 2025-07-16
 ---
 
+<figure>
+<img src="/static/images/understanding-cloudfare.png" alt="Illustration by Annie Ruygt of a big cloud with Fly balloons exiting from inside it" class="w-full max-w-lg mx-auto">
+</figure>
+
 Many Fly.io apps use Cloudflare—sometimes just for DNS, sometimes with proxying enabled, and sometimes for both. This guide covers the supported configurations, how to set them up, and what to watch out for when using Cloudflare with Fly.io.
 
 ## DNS-only setup