didericis/bot-bottle
1
0
Fork 0
Code Issues 25 Pull Requests 9 Actions Packages Projects Releases Wiki Activity

docs(prd): 0070 per-host orchestrator service #352

Closed
didericis-claude wants to merge 12 commits from prd-orchestrator into main
pull from: prd-orchestrator
merge into: didericis:main
Conversation 25 Commits 12 Files Changed 33
+22 -9
1 changed files with 22 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 8e567edde4 - Show all commits
docs/prds/0070-per-host-orchestrator.md
+22 -9
View File
6
 @@ -325,18 +325,31 @@ orchestrator becomes a VM. Decouple the two risks instead:
secret handling) is proven with fast iteration — *then* wrap that exact
service in the VM and solve wiring separately.
Backend order (cheapest proof → hardest → last):
### Slices
1. **Docker orchestrator** — nearly free (the sidecar bundle is already
containers; collapse N bundles into one persistent container). Proves
consolidation + the `BottleBackend` seam with the least moving parts.
2. **Firecracker orchestrator** — the real work: the shim + VM-to-VM
Built bottom-up as a stack of small PRs off this one (status: **1–4
implemented** in #352 → #356 → #357 → #358):
1. **Dev-harness core** ✅ — SQLite registry (runtime state) + fail-closed
attribution (source IP + identity token) + the HTTP control plane.
2. **Launch lifecycle + broker contract** ✅ — `launch_bottle` /
`teardown_bottle` + the signed, structured `LaunchBroker` request
(HS256 JWT, static ids/flags only, provenance-verified, fail-closed),
with a stub broker for the harness and registry rollback on failure.
3. **Docker launch broker** ✅ — the first real broker: `docker run` / `rm`
per bottle, built only from the request's static fields; proves the
`BottleBackend` seam on the cheapest backend.
4. **Consolidated per-host sidecar** ✅ — one persistent sidecar shared by
all bottles (idempotent singleton) instead of one per bottle — the core
consolidation win, source-IP-keyed via the attribution invariant.
5. **Firecracker broker + sidecar** — the real work: the shim + VM-to-VM
routing (host forwards `bbfcN` → orchestrator TAP; the nft table grows
forward rules where today it drops all non-DNAT egress). Built against
the dev-harness so the app logic is already proven.
3. **macOS (Apple container)** — last (container-to-container networking).
forward rules where today it drops all non-DNAT egress), against the
already-proven dev-harness.
6. **macOS (Apple container)** — last (container-to-container networking).
Keep the sidecar **service one shared thing** throughout.
Backends land cheapest-first (docker → firecracker → macOS); keep the
sidecar **service one shared thing** throughout.
## Non-goals