internal/

Package build is the bex build plane: turn a git repo @ ref into an OCI image pushed to the in-cluster registry (Zot), built ENTIRELY IN-CLUSTER by a Kubernetes workload — no docker daemon and no host tools, so it works on containerd app nodes (w1/m5, w6/m22).

Package disksnapshot is the byte pipeline behind persistent-disk snapshots (docs/ADR082-persistent-disks.md D5): a directory tree in, one encrypted stream out, and back again.

Package egressmeter owns bex's direct App egress byte counter.

Package execution owns the common identity and pod-level defaults for every short-lived workload that executes tenant-controlled source or images.

Package hostingdomain validates the browser trust boundary used for shared tenant application hostnames.

Package httpclient owns the operator's bounded, pooled HTTP dependency policy.

Package identity is the one derivation for workspace-scoped shared-sink names (w2/m75, docs/ADR074-workspace-scoped-artifact-identity.md): Zot repository, htpasswd user, pull Secret, static-site prefix, and the future build-cache repository.

Package imagecheck verifies cosign private-key signatures on OCI images.

Package migrate copies one App's legacy registry tags and static objects onto the workspace-scoped identity (w2/m75, docs/ADR074).

Package predeploy is the bex pre-deploy plane: run App.spec.preDeployCommand to completion against the new revision's image BEFORE that revision serves traffic (Render's Pre-Deploy Command — typically a database migration).

Package publish is the static-site publish plane: take the OCI image a static_site build produced (build plane, in-cluster BuildKit) and copy its PublishPath directory to the object-store origin, keyed by <bucket>/<appID>/<revision>/.

Package registry manages per-App Zot repository credentials (w7/m36, docs/ADR022-tenant-isolation.md).

Package runtime is a client for the OpenSandbox Lifecycle API (the Docker-runtime server).

Package selfimage answers "which image am I running?" for the manager.

Package staticserver is the shared static-site origin proxy (w1/m21): one always-on HTTP server, behind Traefik, that serves every static_site App's built output from the object-store origin.

Package webhook implements the operator's admission webhook handlers.