The decisions behind Sandstorm v0.6 as it is built: a gVisor sandbox fleet, one master and many nodes, that oversells by moving idle sandboxes down through four tiers. Each record says what was decided, why, and what follows from it. ADR 1 says how these are written and kept.
| # | Decision | Status |
|---|---|---|
| 1 | Record architecture decisions | Accepted |
| 2 | Run sandboxes on gVisor, so no host needs KVM | Accepted |
| 3 | Four tiers: hot, frozen, snapshot, detached | Accepted |
| 4 | A master holds desired state in SQLite; nodes run sandboxes | Accepted |
| 5 | The control plane runs on mutual TLS, in either direction | Accepted |
| 6 | A pool is a migration domain, set by a computed fingerprint | Accepted |
| 7 | The node's gateway wakes a sandbox when a request reaches it | Accepted |
| 8 | Each node decides for itself whether it can take work | Accepted |
| 9 | A wake makes room on its node, spares sandboxes in use, and has 2 s to start | Accepted |
| 10 | One binary: master, node and panel | Accepted |
| 11 | Firecracker as an optional second backend, behind one trait | Accepted, and run on KVM and under PVM |
- v0.6 RFC (Chinese), written before most of v0.6 was built. Several of
its proposals were changed or dropped, so read it as history: last version
at
7b39861. - v0.2 to v0.5, the Firecracker runtime:
DESIGN.md,DESIGN-v0.4*.md,DESIGN-v0.5-diff-snapshot-chains.mdanddocs/design/are in thev0.5.3tag.
Copy the shape of an existing one: Status, Context, Decision, Consequences.
Take the next number, name the file NNNN-short-title.md, and add a row
above. Record a decision once it is made and in the code. To change one,
write a new record and mark the old one Superseded by NNNN.