VEXORA-Code-AI

VEXORA deployment architecture

flowchart LR
  Browser[Browser]
  Proxy[Caddy HTTPS and static assets]
  API[Express API on loopback]
  DB[(MySQL private network)]
  AI[AI provider]
  RunnerProxy[Private HTTPS runner endpoint]
  Runner[Runner service]
  Docker[Isolated execution containers]

  Browser -->|HTTPS and same-origin /api| Proxy
  Proxy -->|/api on loopback| API
  API -->|Parameterized owner-scoped SQL| DB
  API -->|Server-side key, bounded requests| AI
  API -->|HTTPS + bearer token| RunnerProxy
  RunnerProxy -->|Loopback| Runner
  Runner -->|Fixed command, no network, quotas| Docker

Keep the runner VM separate from MySQL and application secrets. The runner’s Docker daemon is a host-level trust boundary; the execution container is defense in depth, not a hardened microVM.