Runtime topology

One public Edge. Everything else stays behind it.

Edge is the only Clearplane container exposed to the host and the outside world. It accepts traffic on ports 80 and 443, then reaches applications and the control plane through separate networks.

Read the docs See the network wiring
01

Runtime boundary

Public request path

Traffic enters once.

Applications publish no host ports for Clearplane traffic. They join the services network and receive matched requests from Edge.

01 / OutsideInternetHTTP · HTTPS
02 / PublicEdgeHost 80 · 443
03 / PrivateApplicationclearplane-services
ContainerNetworksHost portsResponsibility
Edgeinternal · services80 · 443Public ingress, TLS, policy, routing
Coreinternal · egressNoneConfiguration, persistence, management API
UIinternalNoneBrowser management application
ContainerProxyinternalNoneRead-only container-runtime boundary
02

Network wiring

Separate paths, narrow membership

Three networks keep each job in its lane.

01 / Private control plane

clearplane-internal

Edge, Core, UI, and ContainerProxy communicate here over internal HTTPS on port 8443 with exact-identity mTLS. The bridge is marked internal.

Edge · Core · UI · ContainerProxy
02 / Proxied applications

clearplane-services

Edge shares this network with application containers so it can discover and proxy them. Core, UI, and ContainerProxy do not join it.

Edge · application containers
03 / Control-plane outbound

clearplane-egress

Core uses this dedicated outbound path without joining the services network. Other Clearplane containers are not members.

Core only
03

UI and API exposure

Protected like any other route

Management also enters through Edge.

UI and Core publish no host ports. When management access is enabled, ordinary protected routes on Edge expose the browser UI and API on the same public host and origin.

Browser UI/

Routes to UI over clearplane-internal.

Management API/api/{**catch-all}

Routes to Core /external/{**catch-all}.

Browser events/api/ws/*

SignalR upgrades use the API route.

Private service API/internal/*

Never routed publicly.

04

Discovery boundary

The runtime socket stops here

Edge never receives container-runtime access.

  1. 01
    ContainerProxy reads metadata.

    ContainerProxy alone holds the read-only runtime socket and exposes an allowlisted internal API.

  2. 02
    Core reconciles ownership.

    Core combines validated container labels with configuration owned through the UI and API.

  3. 03
    Edge receives one revision.

    Core sends a coherent configuration revision. Edge validates the complete candidate and keeps the last valid configuration when a candidate fails.

05 / Continue

Configure from the UI, API, or Docker labels.

Each resource keeps its owner while Core projects one configuration to the public Edge.

Read the docs