Portability

The cloud estate described in the preceding chapters is one deployment of a platform built to run in more than one place. This chapter names two things: what separates the platform from the substrate it runs on, and the local stack that already runs the whole thing on a laptop. It closes with where the platform is going.

#What Is Built

One image with roles. Every platform process is the same image with a --role flag, and a development process runs every role at once. Nothing about the split into Deployments is baked into the code; it is a property of the manifests.

The sandbox provider contract. The orchestrator talks to sandboxes through the contract in Execution Islands: six methods and a warm pool, declarative, with no exec and no file writes. The Kubernetes provider is one implementation. The contract was shaped so that Docker Engine and remote sandbox services can implement it too, and the release manager, the job runners and the dev boxes above it never know which one they are on.

Hosts as configuration. Every hostname the platform reads or emits comes from configuration with development defaults derived in code: the app apex, the sandbox apex, the callback origin sandboxes reach back on, the git host, the platform apexes. No personal or environment-specific hostname exists in code. Four audiences read a hostname: the browser, a sandbox, an external sender, and in-network services. The split between them is a divergence in values only, never in code paths.

The routing contract. The platform reads the app, host, and path from query parameters and never routes on the Host header. Any reverse proxy that maps a hostname to those parameters is a valid edge. See Edge and Custom Domains.

The counterparty registry as a capability manifest. Every external service is a surface that declares where its credential lives. A deployment that sets the key has the capability; a deployment that does not gets a clean answer that the service is not configured, rather than an error at a vendor. The admin surface that renders the registry is the manifest of what this deployment can do.

The compose stack. The repository's docker-compose.yml runs the whole platform locally: Postgres, Redis, a local S3, Qdrant, the API and worker roles, the voice worker, ClamAV and Presidio, and a local edge. The local edge is Caddy terminating TLS for a wildcard development domain and routing by host exactly as the production Workers do, with CoreDNS answering the wildcard. The Caddyfile is the routing contract written down.

Sizing in one place. Every sandbox lifecycle and pool setting lives in one configuration file, and every scaling threshold lives in the manifests and Terraform, so a deployment of a different size changes numbers, not code.

#Three Profiles of One Artifact

The cloud profile is the fully built reference deployment this folder documents. The dedicated profile is the same Terraform in another account. The self-hosted profile is the direction: the compose stack runs the platform end to end today, and what remains is making the multi-tenant operational machinery in the cloud, the identity provider, the sandbox provider, and ingress, pluggable, so a single-tenant operator can run plain containers where the cloud runs microVMs.

Moving between profiles is a migration into a deployment someone operates, never an in-place upgrade of a box.