pushleft How it worksTopologyManual Source ↗ Deploy now → How a deployment earns its URL.
This is the exact sequence pl up drives, and what each step has to prove before the next one starts. Read it once and you know what the platform will never do behind your back.
Five legs, five executors, five proofs. Written from the code, not the roadmap.
The gateway hands the build node the one archive its lease names and re-authorises after the read. Rootless BuildKit builds it in a fresh workspace; the digest is published inside the same lease that built it.
A node with the right pool, capability and free CPU and memory gets a reservation. A reservation is bookkeeping, not permission: nothing runs on it yet.
One mesh per environment. The gateway container, its nftables rules and host routes are applied and verified; admission is recorded as evidence with a generation, and only evidence admits.
Containers start with CPU, memory and PID limits and a health check. After durable health the scheduler publishes the Caddy route; a later release drains the old one. Crash replay adopts the same container.
Routes removed first, containers next, the environment network last, and only when no sibling still uses it. The record stays; the subnet slot is never reused.
Watch it leave the gate.
The demo runs the whole sequence on one machine in about six minutes, including the failures it has to refuse.