For AI agents: the complete documentation index is available at https://docs.flezise.com/llms.txt, the full documentation bundle is available at https://docs.flezise.com/llms-full.txt, and this page is available as Markdown at https://docs.flezise.com/deployment/overview.md.
Docs

Deployment overview

Flezise runs as a set of containerised services, deployed on Kubernetes with the Helm chart at deploy/helm. The same images run under Docker Compose for local development, but a real deployment uses the chart.

Services

ServiceRolePort
nginxReverse proxy; routes all ingress80
frontendWeb UI5173
backendFastAPI application server8000
marketplacePack catalog and content server8100
ai-gatewayLLM routing8080 / 20128
workflow-workerPipeline orchestration (Celery)(none)
knowledge-workerRepository scan and knowledge ingestion (Celery)(none)
generation-workerArtifact generation and agent execution (Celery)(none)
logtoOIDC authentication provider3001 / 3002
PostgreSQLPrimary database with pgvector5433
pgbouncerConnection pooler (transaction mode)5434
RedisCelery broker and sandbox session registry6380
VaultRuntime secrets8200
SeaweedFSS3-compatible object storage8333

Supporting services run alongside these: Gotenberg for PDF conversion, PlantUML for diagrams, a headless Chrome browser for agent web browsing, an injection-guard sidecar for prompt screening, a code graph service, and an OpenTelemetry collector.

Kubernetes

The Helm chart installs every service as Deployments and StatefulSets. Agent sandboxes run through the opensandbox operator. The chart supports KEDA-driven Celery worker autoscaling and a CloudNativePG-managed PostgreSQL cluster for high availability. See Kubernetes with Helm for the install.

Sandbox isolation

A sandbox can run in hardened mode, an opt-in that is off by default. A hardened sandbox runs on a restricted network with no outbound internet and reaches the platform only through backend, ai-gateway, and marketplace. Sandboxes that are not hardened run alongside the platform with internet access.

Restricted network · no internetPlatform network

Browser / CLI

nginx

frontend · backend
ai-gateway · marketplace
workers

PostgreSQL · Redis
SeaweedFS · Vault

hardened agent sandbox

Hardened sandboxes are opt-in and off by default; ordinary sandboxes run alongside the platform with internet access.

Data stores

StorePurpose
PostgreSQL + pgvectorAll platform data across two databases: sdlc_platform for the application and ai_gateway for the LLM gateway
RedisCelery message broker (database 1) and sandbox session registry (database 0)
SeaweedFSObject storage for uploads, repositories, RAG index, packs, and staging; six named buckets (sdlc-uploads, sdlc-repos, sdlc-rag, sdlc-projects, sdlc-staging, sdlc-packs)
VaultRuntime secrets injected into services at startup

Logto runs its own postgres:17-alpine container (logto-db) that it owns entirely. Its state is separate from the application database.

Next steps