Skip to main content

The provisioner

Source: shared/api-core/src/lib/provisioner.ts.

Not every state machine is equal. Free machines share the main zeq.dev api-core. A paid spin-up is provisioned as its own isolated Docker container. The provisioner is what does that.

What a paid spin-up gets​

  • its own Postgres database,
  • its own Redis instance,
  • its own audit clock (a private per-machine Zeqond ticker),
  • its own state explorer at <slug>.zeqstate.com.

The steps​

When provisionMachine(...) runs it:

  1. generates unique secrets via the same bootstrap logic as the air-gapped bootstrap.sh;
  2. renders a docker-compose.yml from the air-gapped template;
  3. starts the container on a dynamically assigned port;
  4. registers it in the provisioned_machines registry;
  5. updates nginx to route <slug>.zeqstate.com → the container port.

getMachineStatus, listProvisionedMachines, stopMachine, and isProvisioned manage the lifecycle; assertSafeSlug guards the slug before it ever reaches a shell or a compose file.

Why isolation​

A paid machine's data, clock, and explorer are its own — nothing is co-tenanted with the shared node. That is what lets the seal spine and the entangled-state chain make per-machine guarantees.