Skip to content

Containers

C4 level 2: what runs on an engineer's machine, in the Google Cloud project and outside it, and which seams are on main. Architecture has the system context above this view; Contracts indexes the files and APIs the containers meet at.

Containers and where they runC4 level 2 · Solid: on main · dashed: planned or not yet wiredEngineer machine and CICLI · MCPAgent clientClaude Code or Codexwith the hangar MCPPython CLIai-dlcMachine setup, local worklifecycle, workflow pluginPython CLI · DuckDBflightdeckIngest, statistics, specs,reports, experimentsGoogle Cloud projectGKE clusterPython · always onhangar control planeREST, MCP and web UI :8787Jobs, sessions, intakeLanding and the inboxSQLite on a persistent diskWrites the run outboxOn main · not deployedTowerDecision point, approvals,receipts, passportsControl plane podGateway and egressGit gateway :8788Egress proxy :3128Agent sandbox add-onAgent sandboxesClaude Code, Codex, pi, Antigravity · gVisor on Spot nodes, 0 to NPools off 01:00–10:00 ET · optional Kata heavy tier for DockerCloud Storage · Artifact Registry for imagesStorageCheckpoints: session state that outlives the diskRun outbox: hangar.run/v1, written once · off in the deployData plane: Parquet tables, one folder a dayCloud Run job · nightly · not deployedCompactorFlattens new runs into Parquet each night, while the sandbox pools are offExternalJira and SlackDoors in; questions andapprovals outExternalGitHubTeam repos, PRs, the App,the team harness repoExternalModel providersReached only throughthe egress allowlistExternalMCP serversSpaceport, internal tools,bound at claim timeMCP / RESTtrialsflightdeck reads Parquetdecidecreatesgit, egresscheckpoints, runspushwebhooks from GitHub, Jira and Slack
C4 level 2 · solid: on main · dashed: planned or not yet wired · full size
Container Runs on Owns Status
hangar control plane GKE, always on REST, MCP and web UI; jobs, sessions, intake, landing, inbox; SQLite on a persistent disk On main
Git gateway and egress proxy The control-plane pod Pushes one ref as the GitHub App; the only route from a sandbox to the internet On main
Agent sandboxes GKE gVisor pool on Spot nodes, 0 to N; optional Kata heavy tier Claude Code, Codex, pi and Antigravity sessions; off 01:00–10:00 ET On main
Tower Beside the control plane, one instance Decision point, approvals, receipts, passports On main: the decision API, events and receipts (Tower#13, #17, #18). Not deployed yet (Tower#28, #52); hangar's wiring is hangar#172
Run outbox Cloud Storage Every finished run written once as hangar.run/v1 On main (hangar#163, PR #214); off in the GKE deploy until hangar#273
Compactor Cloud Run job, nightly Flattens new runs into flightdeck.parquet/v1 On main (flightdeck#5, deploy/compactor/); deployed with hangar#273
flightdeck An engineer's machine or CI Ingest, statistics, behavior specs, reports, experiment submission On main (v0); the nightly spec runner is flightdeck#15
ai-dlc An engineer's machine Machine setup, local work lifecycle, workflow plugin On main