Cloud Development Environment Platform  ·  View 02 of 21  ·  Context and scope

High-Level Architecture

Seven stages from a request to a running workspace, with the shedding gate before placement rather than inside it.

Editable source SVG draw.io All views
Ask Editor client browser · SSH Agent client headless API Edge Regional edge Envoy · TLS · authz Session router stateless Admit Admission control quota · class shed Placement late binding Incarnate Host agent Firecracker Warm pool claimed, not built Run Workspace microVM own kernel · root Forwarded ports private by default Persist Snapshot store content-addressed Prebuild artefacts per definition rev Mediate Egress policy point per workspace Secret broker minutes-long tokens lazy block fetch retryable refusal High-Level Architecture — Request to Running Workspace Person or role External / third party Interface / broker Application we own Decision point Security / platform Data store synchronous failure / alternate Agent creations are shed at the admission gate before human resumes are, which is the only place in the set where the two classes are treated differently. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • Admission is a stage of its own, ahead of placement: a workspace that will not fit is refused explicitly and retryably rather than queued invisibly.
  • Agent creations shed before human resumes. This is the only place in the whole set where the two classes are treated differently, and it is deliberate (ADR-08).
  • Persistence and egress hang off the end of the flow because neither is on the keystroke path: a snapshot is asynchronous, and egress is mediated per workspace rather than per request.

Assumptions

  • 40,000 starts/hour at peak and 1,200,000 per day, with headroom for a 10× agent burst sustained for 60 seconds.
  • Warm-pool claim p95 ≤ 3 s, prebuild restore p95 ≤ 25 s, inline build p95 ≤ 4 min.

Deliberately omitted

  • The control plane is not drawn as a stage because it is not one: it decides and records, and the stages run without it (ADR-12).
  • Hibernation is not on this diagram — stopping a workspace has its own view (15), because there are four reasons for it and one mechanism.
◀  System Context All views Actors and Their Core Journeys  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1002-high-level-architecture