Skip to content
Back to

Deployment environments

Fontana runs on more than one class of host. SOC 2-aligned control narratives and evidence collection apply to production-class deployments where regulated customer data lives. Integration and local environments support engineering velocity on hosts outside that scope.

Environment classes

Section titled “Environment classes”
Class Typical use Customer / regulated data Change control
Production-class Managed cloud production, customer VPC, dedicated self-hosted production In scope Pinned immutable releases, approval before promotion, registry-only artifacts in the cluster
Integration Shared engineering cluster, pre-release validation Out of scope for regulated workloads Pre-release validation; may build images on the machine that deploys them
Local Developer laptop, *.localhost installs Out of scope Local integration testing and hybrid dev workflows

What production-class means

Section titled “What production-class means”

Production-class clusters share these properties:

  • Immutable deploy artifacts only: pre-built OCI images and signed charts from your registry (typically GHCR), pulled by digest. No source checkout or build toolchain on the data plane.
  • Pinned upgrades via the Fontana CLI using immutable sha-<git> release tags declared in fontana.yaml.
  • Rolling upgrades with readiness gating, so a release that never becomes healthy leaves the previous version serving and rolls back automatically.
  • Online backups and volume snapshots, taken without stopping the workspace.
  • Namespace-per-workspace isolation with default-deny network policy, per-workspace Vault, and WORM audit as documented in Security.

Managed cloud production and customer VPC deployments Fontana operates follow this model. Self-hosted customers adopt the same pinned-release pattern on their own clusters.

Integration and local (out of scope)

Section titled “Integration and local (out of scope)”

Integration environments may build images on the machine that deploys them, for teams that ship many times a day. Local development may consume shared platform services remotely while running application code locally.

Those environments help your team ship features. They do not replace production controls for:

  • Supply chain integrity (pinned digest tags, bundle checksum verification)
  • Formal change records (pinned release trail, approval gates before promotion)
  • Regulated data residency and audit evidence export
Section titled “Related documentation”