Services and deployment topology
Choose a profile in the installation overview before comparing running services. The development source profile expects an external OIDC issuer. Its documented checks reach platform, router and web on loopback ports 5193, 5194 and 5195 on the VM. The packaged profiles add their own ingress, identity and control services.
Packaged service boundaries
| Boundary | Services and responsibility |
|---|---|
| Public ingress | The proxy alone publishes host ports 80 and 443. It routes HTTPS traffic to the internal browser gateway, MCP listeners or the identity service. The gateway uses an internal Valkey store for browser sessions. |
| Application | web serves the browser, platform handles deployment and workspace administration, and router discovers applications and handles scoped MCP. The optional workspace service serves the configured workspace ID. |
| Application database | db is on the private database network. The fixed worker claims durable jobs and publishes through the fixed core. The telemetry collector also has private database-network connectivity. |
| Control database and identity | control-db is on the separate control network. Keycloak joins the application and control networks and uses internal HTTPS. The proxy trusts the provisioned internal CA for its Keycloak connection. |
| Build and authoring | The build broker connects the database and sandbox networks. The host sandbox launcher is a separate process. Users edit Python in the embedded browser editor or an MCP client; the isolated builder returns a typed plan to the fixed core. |
What to expect after bootstrap
The release inventory lists 12 steady-state services, or 13 with the optional workspace listener. The release installer runs the selected control and Keycloak bootstrap jobs to completion. Compose configuration also lists a one-shot builder and the required control and identity bootstrap definitions. Use the active profile inventory to judge steady state, then check listener readiness and administrator sign-in.