Preview Safely in an Isolated Runtime

This course is built around the public Zheta Kubernetes Lab monorepo. The excerpt below is runnable source, not pseudocode.

Source: services/control_plane/domain.py

def create(self, project_id: str, organization_id: str, name: str, actor: str, archetype: str) -> Project:
        project = Project(project_id, organization_id, name, actor, blueprint={"name": name, "archetype": archetype})
        project.collaborators.add(actor)
        with self.repository.transaction():
            self.repository.create(project)
            self._audit(project, actor, "project.created")
        return project

Code to reality

Declared intent

Create one tenant-owned project and its audit evidence as a single product operation.

Interpreter

Python executes the Forge domain model after the controller supplies authenticated command values.

Software effect

The repository durably owns the project while the event port publishes project.created evidence.

Hardware effect

The service process uses CPU and writes database pages to its persistent volume or managed database.

Observable evidence

A tenant-scoped GET plus a project.created evidence record proves both state and accountability.

The source tables below remain the detailed contract. Begin with these customer paths:

• D06-UC-01
  • Person: Application reviewer
  • Job: Open one generated revision and inspect its behavior
  • Observable result: Digest-matched preview becomes Ready at a short-lived authenticated URL
• D06-UC-02
  • Person: Security reviewer
  • Job: Prove generated preview code cannot reach ungranted endpoints
  • Observable result: DNS and egress allowlist permit only required platform endpoints

Now turn each customer job into a story with a result that an engineer can check:

• D06-US-01
  • Story: As an application reviewer, I want an expiring preview tied to one artifact digest, so that my approval targets exact code
  • Observable acceptance: URL, digest, deployment UID, readiness, reviewer identity, and expiry agree
• D06-US-02
  • Story: As a security reviewer, I want preview egress denied by default, so that generated code cannot discover enterprise or cloud services
  • Observable acceptance: Forbidden request is denied and traced; allowed health and artifact requests remain successful

Finally trace each story through the system that owns its state and the evidence that proves the outcome:

• D06-FLOW-01
  • Trigger: Reviewer selects Preview on a successful generation run
  • Responsible systems: Preview Manager, Artifact Builder, Kubernetes API, Runtime Gateway
  • Authoritative state: Preview record in control-plane PostgreSQL; workload status in Kubernetes
  • Owned record: PreviewEnvironment
  • Observable evidence: Actor, digest, preview ID, namespace, workload identity, Pod UID, URL, HTTP result, expiry, trace ID
  • Failure signal: Missing artifact, failed admission, image pull, readiness, or route binding
• D06-FLOW-02
  • Trigger: Preview code requests a forbidden network endpoint
  • Responsible systems: Network policy controller, DNS, workload identity, Audit Evidence
  • Authoritative state: NetworkPolicy desired state and flow/audit evidence
  • Owned record: PreviewBoundaryEvidence
  • Observable evidence: Denied destination, policy revision, flow log, positive-control probe, deletion UID and timestamp
  • Failure signal: Unexpected allowed flow, missing denial, or failed positive control

Enterprise problem: Generated code can be incorrect or hostile, and running it beside trusted services with ambient credentials turns a review feature into a path to customer data.

Whole-course context: The incoming source artifact has a deterministic digest; today deploys it to the local hosted-runtime store without publishing it.

Today’s slice: Run the implemented tenant-scoped preview deployment, then derive the namespace, identity, network, resource, hostname, and expiry controls still required for an isolated production preview.

End-of-day evidence: A preview response and tenant/app runtime row reference the same artifact digest, and preview.deployed is published; namespace isolation, denied egress, and expiry are explicitly not yet proved.

Still unsolved: Managed application data, enterprise connectors, human identity, sharing, publication, and cloud isolation remain deferred.

Preview must make the app interactive while keeping production authority absent. These use cases prove a working URL and a denied network escape.

A preview URL without isolation evidence is only convenient execution. These stories make both usability and containment observable.

Preview begins when a reviewer chooses an artifact in Forge Studio. The denial path executes inside the same sandbox so the evidence tests the actual boundary.

Namespace isolation alone does not restrict network or cloud authority. Preview Manager composes several controls and owns the sandbox lifecycle, while Kubernetes controllers own reconciliation.

Preview lifecycle must survive a controller restart even though its workload is disposable. No generated-app domain database is needed to render fixture-backed archetypes.

Generated-application database: Not created in this slice — previews use versioned fixtures; durable preview lifecycle and evidence stay in provider stores.

A policy manifest proves only declared intent. The current monorepo implements preview as a tenant-scoped call to the runtime service and persists the payload in local SQLite; it does not yet create per-preview namespaces, enforce egress policy, or expire previews automatically. Kubernetes also requires a network plugin that implements NetworkPolicy; the API object alone is not enforcement (Kubernetes Network Policies). Read the exact operation in services/control_plane/domain.py.

def preview(self, project: Project, actor: str) -> dict[str, object]:
    self._authorize(project, actor)
    artifact = self._latest(project)
    payload = {"mode": "preview", **artifact, "source": self.artifacts.get(project.organization_id, artifact["artifact_id"])}
    result = self.runtime.deploy(project.organization_id, project.project_id, payload)
    self._audit(project, actor, "preview.deployed")
    return result

Treat generated code as untrusted until publication policy says otherwise. The desired production design gives previews no ambient cloud or enterprise permissions, default-deny networking, resource limits, and reconciled expiry; the current local runtime does not prove those controls and must not be presented as a sandbox.