Platform under development — site under construction

Enterprise Private AI Canvas & Vibe-Coding Platform

A secure, domain-integrated, self-hosted AI workspace providing private OpenAI Canvas / Anthropic Artifacts capabilities alongside dynamic container sandboxing for zero-leakage "vibe coding."

01 System Architecture Diagram

Everything runs inside your internal perimeter — no external egress, no data leaving the network.

                             [ Internal Corporate Network ]
                                           │
                                           ▼
                       ┌──────────────────────────────────────┐
                       │  Reverse Proxy / Ingress (Traefik)   │
                       └──────────────────┬───────────────────┘
                                          │
            ┌─────────────────────────────┴─────────────────────────────┐
            │                     Authentication                        │
            │           [ Active Directory / LDAP / OIDC ]              │
            └─────────────────────────────┬─────────────────────────────┘
                                          │
                                          ▼
                       ┌──────────────────────────────────────┐
                       │  Workspace Orchestrator (API Engine) │
                       └──────────┬────────────────┬──────────┘
                                  │                │
            ┌─────────────────────┘                └─────────────────────┐
            ▼                                                            ▼
┌──────────────────────┐                                      ┌──────────────────────┐
│  Local LLM Cluster   │                                      │ Dynamic Sandbox Pool │
│ (vLLM / Ollama Node) │                                      │ (Kubernetes / Docker)│
├──────────────────────┤                                      ├──────────────────────┤
│ DeepSeek / Llama 3   │                                      │  User Pod A (React)  │
│ Qwen Code / Internal │                                      │  User Pod B (Python) │
└──────────────────────┘                                      │  User Pod C (Go/API) │
                                                              └──────────────────────┘

02 Core Subsystems & Components

Four layers working together: canvas UI, orchestration engine, execution sandbox, and identity governance.

A. Dynamic Workspace & Canvas Interface

  • Dual-Pane Layout: left chat sidebar for conversational refinement; right split-screen editor for interactive artifacts.
  • Monaco / CodeMirror Integration: real-time syntax highlighting, diff viewing, inline code editing.
  • Live App Sandbox View: embedded iframe rendering apps dynamically generated in isolated user pods.

B. Workspace Orchestrator

  • Session & State Management: tracks version histories for code artifacts and prompt chains.
  • Stream Pipeline Engine: SSE / WebSockets for low-latency streaming from local LLM endpoints to the UI.
  • Pod Lifecycle Manager: listens to LLM code-generation triggers; spins up, monitors, destroys user containers.

C. Dynamic Execution Sandbox

  • On-Demand Provisioning: isolated pods (Node.js, Python, Go) created when the AI builds or runs apps.
  • Subdomain / Path Ingress Routing: ephemeral endpoints like app-user123.internal for instant hot-reload previews.
  • Network & Resource Guardrails: strict CPU/RAM limits, ephemeral storage with TTL cleanup, restricted network policies.

D. Identity, Access & Data Governance

  • Domain Single Sign-On: Active Directory / LDAP authorization mapping group permissions to model access tiers.
  • Air-Gapped Operation: zero external egress — all prompts, context windows and code execution stay inside the perimeter.
  • Audit Logging: enterprise logging of user actions, model calls and pod spawns for compliance.
🧱 Pod CPU / RAM limits

Strict resource quotas per execution container — no runaway workloads.

⏳ TTL auto-cleanup

Ephemeral storage with automatic time-to-live pod destruction.

🔒 Network isolation

Restricted policies preventing access to sensitive internal networks.

03 Request Lifecycle: "Vibe Coding" Workflow

From a single prompt to a live running application — fully automated, fully isolated.

1
Prompt
User requests: "Build a Streamlit dashboard for server stats."
Workspace UI
2
Generation
Model streams code into the Artifacts side-panel canvas.
Local LLM Cluster
3
Trigger
System detects run command / executable app structure.
Pod Lifecycle Mgr
4
Provisioning
Dedicated container initialized; dependencies installed silently.
K8s / Container Runtime
5
Routing
Traefik routes dynamic internal URL (/apps/streamlit-902) to pod port.
Ingress Controller
6
Live Preview
App renders in the right panel; user iterates via text prompts.
Embedded Workspace

04 Technical Stack Matrix

Proven, open-source, self-hostable components across the full stack.

Component LayerTechnologies / Tools
Frontend UINext.js / React, Tailwind CSS, Monaco Editor, Lucide Icons
Backend & APINode.js / Python (FastAPI), WebSockets / SSE
AuthenticationActive Directory / LDAP, Keycloak / OIDC
Database & CachePostgreSQL (State/Artifacts), Redis (Cache & Session Streams)
Inference EnginevLLM / Ollama (OpenAI-compatible internal endpoints)
Container EngineKubernetes / Docker Engine SDK, Traefik / Cilium Ingress

05 Deployment Architecture Highlights

On-premises first. Your data, your hardware, your rules.

🏗️ Infrastructure Target

  • On-premises bare-metal / local virtualized infrastructure (Kubernetes / Talos Linux / Docker Compose).

💾 Storage Strategy

  • Persistent Volumes for user workspace states; ephemeral scratch storage for dynamic user pods.

🛡️ Security Model

  • Zero-trust container runtime isolation, AppArmor / Seccomp profiles, rootless execution.