OpenLink / Runtime

Run where your work belongs.

OpenLink runs projects in self-hosted infrastructure you control, with durable Project VMs, explicit service boundaries and observable lifecycle state.

Inspect runtime controls See Projects

Runtime control planeLocal ready

Project VM

/workspace

durable project and Git root

ZOKERBASE

authoritative

identity and application state

Owned services

scoped

agent, browser and knowledge boundaries

Capabilities

default deny

network and credentials require policy

Illustrative runtime surface. It describes the product boundary; it is not a live status console.

Runtime controls

Deployment primitives, made inspectable.

The Runtime keeps preparation, execution, service health and deployment history visible without moving project data out of your infrastructure.

Runtime units

Details

3scoped

Project VM28%

durable

Services78%

owned

Data32%

local

/workspace stays durable while workers run independently.

Runtime ownership

Project execution, owned services and local data retain distinct boundaries.

HostLocal dataPolicyScoped

Self-hosted by design

Local operation is self-contained by default. Cloud remains a separate future integration surface.

Set project resource profile60%

40%80%

Explicit resource choices

Runtime resources are project configuration, not an invisible shared pool.

Runtime units

Details

3scoped

Project VM baseready

ZOKERBASE imageready

Zero imageready

Prepared before serving

Startup consumes local product artifacts instead of building images on demand.

01Validate host

Tracked lifecycle changes

Provisioning, ready, stopped and error are explicit runtime states.

policy requiredNetwork capability

scopedCredential access

checkedRuntime health

persistentWorkspace storage

policy requiredNetwork capability

scopedCredential access

checkedRuntime health

persistentWorkspace storage

policy requiredNetwork capability

scopedCredential access

checkedRuntime health

persistentWorkspace storage

policy requiredNetwork capability

scopedCredential access

checkedRuntime health

persistentWorkspace storage

Capability boundaries

Network and credentials are default-deny capabilities granted through explicit policy.

Execution boundary

The web interface is not the privileged runtime.

Browser requests enter through the product web and BFF. Project execution, browser access, service credentials and vector authority stay in independently owned services and scoped capabilities.

Browser / BFF

product requests

Owned services

authorization + lifecycle

Project VM

workspace + Git

A project is only represented as ready after its runtime reaches the ready state; unavailable services are not presented as healthy.