Cloud Development Environment Platform  ·  View 07 of 21  ·  Structure

Layered Architecture

Eight layers, with the untrusted one in the middle and the control plane outside the data path.

Editable source SVG draw.io All views
Clients Browser editor Desktop editor tunnel SSH Agent API client Edge & gateway TLS termination Envoy Principal auth Resume-on-connect Preview routing Admission & placement Quota & spend Class-aware shedding Warm-pool claim Host selection Host agent microVM lifecycle Firecracker Snapshot & restore Resource caps cgroups · quotas Drain & evacuate Workspace sandbox Guest kernel disposable Root for the user assumed hostile Nested containers Dev server & ports Persistence Content-addressed snapshots Memory images Prebuild artefacts Lifecycle & tiering Egress & brokerage Policy enforcement Registry proxy Secret broker vsock Secret scan on push Control plane (off the data path) Workspace state machine Tenants, seats, policy Prebuild index Kill switches resume request placement delta all egress Layered Architecture Application we own External / third party Interface / broker Security / platform Decision point Risk / gap Data store synchronous event / async Eight layers, of which exactly one survives a control-plane outage without caring: everything above the dashed read from cache. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • The workspace sandbox is a layer, and it is marked hostile. Everything above and below it is designed on the assumption that root inside it is compromised (ADR-04).
  • The control plane is the last band rather than the first: it is read through cache, it is not on the keystroke path, and a running workspace survives its outage (ADR-12).
  • Egress and brokerage are one layer because they answer the same question — what may leave, and with whose authority.

Assumptions

  • Open-source components throughout: Envoy at the edge, Kubernetes for the control plane, Firecracker on bare-metal hosts, an S3-compatible object store for snapshots.
  • Control plane ≥ 99.9% monthly; workspace runtime ≥ 99.95% of workspace-hours.

Deliberately omitted

  • Observability is not drawn as a band because it spans all of them; it has its own matrix (view 18).
  • The guest's own contents — language servers, toolchains, the user's dev server — are one node, because the platform deliberately knows nothing about them.
◀  Journey — Patching 1,800 Hosts Without Anyone Noticing All views Platform Components  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1007-layered-architecture