Cloud Development Environment Platform  ·  View 20 of 21  ·  Assurance

Trust Zones

Six zones, with the workspace sandbox placed above the host because it is the least trusted thing here.

Editable source SVG draw.io All views
Internet Developer client Agent runtime Preview visitor Package registries Perimeter Envoy edge TLS · authz Preview router private default Registry proxy pull-through Workspace sandbox · untrusted, root inside Guest kernel assumed compromised Unreviewed code Guest agent advisory only Host · the boundary that holds Host agent Egress policy point vsock side channel no network path Platform · control plane and brokers Control plane Secret broker Audit log Durable content Snapshot store tenant-scoped keys mTLS · OIDC published port only attach, scoped every packet allowlist · deny-default broker request workspace identity write delta Trust Zones — A Machine Whose User Has Root Person or role External / third party Interface / broker Risk / gap Application we own Security / platform Data store synchronous The sandbox sits above the host on purpose: it is less trusted than the internet zone, and it has no network path at all to the control plane or the broker. v 1.0 · owner Platform Architecture · date 2026-10

Decisions

  • One microVM per workspace, with its own kernel, so an escape inside the workspace reaches only a kernel the platform is willing to lose (ADR-04).
  • Every packet out of the guest passes a per-workspace policy enforcement point on the host; the guest agent is advisory and is never trusted to enforce anything.
  • The broker is reached over a vsock side channel, so the guest has no network path to the control plane or to the secret broker at all (ADR-05).

Assumptions

  • Three egress postures per workspace class — open with audit, allowlisted, deny-by-default with a registry proxy — with the active posture visible inside the workspace.
  • Preview URLs are private to authorised principals by default; publication is an explicit, audited action with expiry.

Risks

  • A published preview URL is a hole from the internet into a machine running unreviewed code; defaults and expiry are the whole defence.
  • Nested containerisation inside a workspace is a requirement, and it means the guest kernel is exercised hard by exactly the code the platform assumes is hostile.
◀  The Loop That Pays For It All views Identity Flow — A Token Into a Root-Owned Machine  ▶
Solution Architecture v1.0 · open source on raw/bare-metal compute · Platform Architecture · 2026-1020-network-segmentation