Cloud Development Environment Platform  ·  View 16 of 21  ·  Operations

Deployment Topology

Owned racks in two regions, and the one line this topology refuses to draw.

Editable source SVG draw.io All views
Region eu-west · owned racks · residency boundary Workspace compute Host group A 600 × 128c / 1 TB Host group B 600 × 128c / 1 TB GPU hosts phase 3 Snapshot storage Object store S3-compatible · EC Cold tier 30–90 d Control plane Kubernetes 3 control nodes PostgreSQL sync replicas Event log Kafka · 3 brokers Edge Envoy fleet stateless Region us-east · owned racks · separate residency boundary Workspace compute Host group A 400 × 128c / 1 TB Snapshot storage Object store no cross-region copy Control plane + edge Kubernetes 3 control nodes Envoy fleet Global · identity and catalogue only, never workspace content Identity Tenant IdP federation Workspace identity CA Catalogue Image registry mirrored per region Billing sink no automatic failover digest pull snapshot · lazy fetch Deployment Topology — Owned Racks, Region-Pinned Content Application we own Data store Security / platform Queue / topic Interface / broker External / third party failure / alternate batch synchronous The red line is the one thing this topology refuses: content does not cross a region to keep a workspace up. Migration is a tenant decision. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • The platform owns bare metal rather than renting standard instances, because the snapshot strategy needs hardware virtualisation and local NVMe, and the price per workspace-hour needs the density (ADR-11).
  • Snapshot content never crosses a region. Cross-region resume is an explicit, tenant-authorised migration, not an automatic failover: residency outranks availability (ADR-14).
  • Only identity and the image catalogue are global, and the catalogue is mirrored per region so no start depends on a cross-region fetch.

Assumptions

  • 1,000 workspace hosts in eu-west and 400 in us-east at 128 cores / 1 TB each; three control nodes and three Kafka brokers per region.
  • GPU machine classes are phase 3 and are drawn as present-but-empty capacity.

Risks

  • A region loss makes its workspaces unavailable for the duration — accepted, and it must be stated in the tenant contract rather than discovered during the incident.
  • Owning the fleet means owning kernel patching and hardware failure; the operational cost is real and is the main argument the alternative in ADR-11 has going for it.
◀  Stopping a Workspace — Four Reasons, One Mechanism All views Delivering the Platform Itself  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1016-host-fleet-deployment