Overview
What an app is, where it runs, and what it can reach.
What an app is
A set of files an agent wrote, built into a container and served at
/apps/{slug} behind your SuperSecret login. Anyone who can sign in to the
workspace can open it; nobody outside can.
Agents build these with supersecret_app_deploy. You do not have to write one
by hand, and there is no separate hosting account to manage.
What it can reach
Nothing, at first. A newly deployed app has no network access at all. Not to the internet, not to your database, not to SuperSecret itself.
It asks for access one destination at a time with supersecret_app_request, and
an administrator approves or refuses each request. Anything not approved is
refused by the egress proxy and recorded in the app's logs — so a blocked call
shows up as a diagnosable line rather than a silent hang.
This is the whole point of the feature. An agent writing code you have not read is only safe if the code cannot reach anything you did not agree to.
The pieces
| Piece | What it is |
|---|---|
appd | The runtime. Builds releases, runs containers, and proxies every outbound call. |
| Release | One build of one app. Deploying again creates a new release; the old one stays in history. |
| Connection | One approved host:port an app may reach. |
| Secret | An environment variable holding the credential for an approved connection. |
appd runs under the apps compose profile — start it with make up-apps.