Mission

What is the data plane?

The data plane is sandbox service exposure: HTTPS and WebSocket traffic to applications running inside sandboxes. Port forwarding and file uploads are outside this scope and remain part of the gateway/control plane.

What do we need from service exposure?

• Independent scaling. Scale the data plane independently from the control plane. Prevent application traffic from consuming the resources needed for responsive control-plane operations.

• Independent access restrictions. Apply separate network rules to control-plane and data-plane traffic.
  Application-owned authentication. Serve sandbox applications without requiring OpenShell request authentication, so applications can provide their own authentication.

• Platform-managed authentication. Protect sandbox applications through the authentication infrastructure used for the control plane, such as Cloudflare tunnels and zero-trust proxies.

Working Group

Lead: @TaylorMutch

Members:

• TODO

RFC: https://github.com/NVIDIA/OpenShell/tree/main/rfc/0017-sandbox-service-exposure