Core concepts

Tabbify is a managed application infrastructure platform with a web console and selected REST, CLI, and MCP operations. This page ties the pieces together: what a tenant owns, how source becomes a running workload, and how private and public traffic reaches it.

Tenant environments and apps

A tenant is the boundary an organisation owns: its applications, network, data resources, secrets, and access rules. Tenant-private addresses are not a shared service catalogue and do not authorize access from another tenant.

An application is a CPU workload identified by a stable UUID. The GitHub workflow and manual tcli deploy --remote command both submit an asynchronous deployment. Tabbify clones the selected revision, builds an OCI image, and boots it in a Firecracker microVM.

A tabbify.toml describes application metadata, the OCI build, workload resources, lifecycle, routes, environment, and optionally one selected deployment target.

The runtime

There is one public workload runtime: a Firecracker microVM built from an OCI image. The current service provides CPU and memory allocation on one selected target:

[build]
kind = "docker"          # build the Dockerfile into an OCI image

[runtime]
lifecycle        = "on_request"   # start on first visit, sleep when idle
memory_mb        = 256
vcpus            = 1

Supervisors advertise whether they can build images and run Firecracker. The node validates the selected target before dispatch. Additional target entries do not form a highly available workload group. See Workload lifecycle and Runtime.

The private mesh

Each running application receives a deterministic address on its tenant-private WireGuard network:

fd5a:1f02:<blake3(uuid)>::1

Applications in the same tenant can call one another over HTTP at their private addresses. In production, workload traffic currently passes through the managed relay. Public ingress is a separate edge route with TLS; it can use the standard application URL or a configured custom domain. See Private Mesh and Routing.

Control and evidence

The web console, generated REST API, tcli, and MCP server expose overlapping but not identical operation sets. Use the generated OpenAPI document, tcli --help, or MCP tool discovery as the authority for what is available now.

Deployment status reports the current stage and lifecycle state. It can include a bounded local application-log tail for diagnosis. It is not a durable release record or a central telemetry service. Secrets remain outside repositories and are resolved into workload environment variables from the tenant's encrypted store. See Services and The Node API.