ConstellationSign in
Outbound-first by design

Coordinated releases inside a deliberate privilege boundary.

The architecture separates application intent, physical placement, and local privilege so a useful platform does not become a public root shell.

Web delivery
Commit → OCI
Release boundary
Services + bindings
Runner boundary
Local Unix socket

Control plane

Desired state lives in the cloud.

Identity, Web Deployments, Product Releases, bindings, policy, job leases, and audit history stay in an accountable control layer.

  • Organization and Product boundaries
  • Exact service-revision selections
  • Versioned desired-state documents

Environment agent

The environment calls home.

The unprivileged Go agent polls over HTTPS and reports what is true about services and data on the host.

  • Outbound-only communication
  • Leased typed operations
  • Service, health, and capacity reports

Local runner

Privilege stays local.

A separate Go process owns a small allowlist of container, storage, backup, and restore operations.

  • Typed request contracts
  • Bounded OCI and filesystem targets
  • No arbitrary remote shell

The control plane

Publish the product edge, not the manager.

The customer-facing API can be public while the host's management surface stays private. Those are separate decisions.

Open Constellation