VPS Demo Platform¶

A secure, production-grade sandboxed code execution platform. View source on GitHub

Project Overview¶

This platform enables portfolio visitors to execute code examples in isolated, secure environments. It showcases DevOps, SRE, and Platform Engineering skills through real-world infrastructure automation, containerization, observability, and security practices - all running on a production VPS.

Technology Stack¶

Architecture¶

C4 diagrams generated from workspace.dsl using the Structurizr DSL.

System Context¶

Container Diagram¶

Docker Deployment (Current)¶

Component Detail (Sandbox API)¶

Live Services¶

Security Features¶

Container Isolation¶

• Network Isolation: network_mode: none - containers have no network access
• Read-only Root: Filesystem is read-only except for /tmp (50MB limit)
• Capability Dropping: All Linux capabilities dropped with cap_drop: ALL
• No New Privileges: Prevents privilege escalation
• Process Limits: Maximum 50 processes per container

Resource Constraints¶

• CPU: Limited to 50% of one core
• Memory: Hard limit of 256MB (no swap)
• Execution Time: 30-second timeout (configurable)
• Output Size: 10KB maximum output

Application Security¶

• Rate Limiting: 10 requests per 60 seconds per IP address
• Input Validation: Code length limits, dangerous pattern detection
• Automatic Cleanup: Containers removed after execution
• Logging: All executions logged with metadata

API Reference¶

Base URL¶

Local: http://localhost:8000 | Production: https://api.christosm.dev

Endpoints¶

Execute Request¶

{
  "code": "print('Hello, World!')",
  "environment": "python",
  "timeout": 30
}

Execute Response¶

{
  "execution_id": "uuid",
  "status": "success",
  "output": "Hello, World!\n",
  "error": null,
  "execution_time": 0.523,
  "environment": "python"
}

Monitoring and Observability¶

Prometheus Scrape Targets¶

• prometheus:9090 - Self-monitoring
• traefik:8080 - Reverse proxy metrics
• sandbox-api:8000 - Application metrics
• loki:3100 - Log aggregation metrics

Codebase Overview¶

vps-demo-platform/
├── backend/
│   ├── main.py              # FastAPI application: routes, sandbox manager, security
│   ├── Dockerfile           # Python 3.11 container image
│   └── requirements.txt     # Python dependencies (FastAPI, Docker SDK, Prometheus client)
├── terraform/
│   ├── main.tf              # Infrastructure provisioning: Docker, firewall, deployment
│   └── terraform.tfvars.example  # Example variables (VPS host, SSH key path)
├── monitoring/
│   ├── prometheus/           # Prometheus configuration and scrape targets
│   ├── grafana/              # Grafana datasources and dashboard provisioning
│   ├── loki/                 # Loki storage and schema configuration
│   └── promtail/             # Promtail Docker SD and host log pipelines
├── frontend-integration/
│   └── example.html          # Vanilla JS example for API integration
├── docs/
│   ├── DEPLOYMENT.md         # VPS deployment guide
│   ├── SECURITY.md           # Security architecture documentation
│   └── KUBERNETES_MIGRATION.md  # Planned K8s migration strategy
├── images/                   # C4 architecture diagrams (SVG)
├── docker-compose.yml        # Full service stack definition
├── .env.example              # Required environment variables template
├── GETTING_STARTED.md        # Local development setup guide
├── ROADMAP.md                # Detailed project roadmap
├── test_client.py            # Interactive API test client
└── README.md                 # This file

Future Work¶

Kubernetes Migration¶

• Namespace-based isolation Implemented
• ResourceQuotas and LimitRanges Implemented
• NetworkPolicies for enhanced security Implemented
• Horizontal Pod Autoscaling

Advanced Security¶

• gVisor runtime for enhanced isolation
• Seccomp and AppArmor profiles
• Admission webhooks for policy enforcement
• Secret management with Vault

Monitoring & Observability¶

• Prometheus metrics Implemented
• Grafana dashboards Implemented
• Log aggregation Implemented (Loki + Promtail)
• Distributed tracing with Jaeger
• Alertmanager for alert routing

Developer Experience¶

• WebSocket for real-time output
• Multi-file execution support
• Package installation support
• Collaborative features

Resources¶

• Traefik Documentation
• Terraform Docker Provider
• gVisor Container Security
• Kubernetes Multi-tenancy
• Loki Documentation
• Portfolio: christosm.dev