People

Youbrowser

Youterminal · docker compose exec

Files on the host

deploy/secrets/providers.yaml → providers
slack.env → ui · not in git or images

Data and knowledgemyorch-data/ · myorch-knowledge/
channels.yaml · ~/orca/kb (bind mount)

docker compose · network default · services reach each other by service name

uiconsole · channel layer · Slack · Watchdog

One-shot services · exit when done

initmyorch init: volume, tools
runs on every up

providersreads credential files → gateway

gateway-initcreates the sandbox signing key (Ed25519) if missing

temporalgRPC :7233 · UI :8233

workermyorch worker · runs steps

gatewayofficial OpenShell image · :17671credentials · policy · sandbox records

Host Docker · via /var/run/docker.sock mounted into containers

Docker daemon/var/run/docker.sock

helper containers--network none · read/write volume

volume myorch-artifactsworkspaces of all runs

sandbox · two containers per step instance

supervisor containerbridge networkpolicy · swaps in real credentials

workload containeragent or script · network none

volume gateway-statesigning key · gateway database

Third partiesGitHub · api.anthropic.com, etc. · policy-allowed hosts

HTTP 127.0.0.1:8800

myorch commands
openshell commands

read-only mount /secrets

gRPC temporal:7233
start · reply · approve

gRPC: tasks

openshell CLI: profiles, providers

openshell CLI: create/delete sandbox

http://gateway:17671

key

docker CLI: helper containers
(ui, init too)

docker API: creates
two containers

read/write

mounts a subpath

calls host.docker.internal:17671
via the port published on the host

Unix
socket

policy-allowed egress · real credentials swapped in

call

egress request

data read/write

Connections not drawn: ui connects out to Slack (Socket Mode, outbound, no open port);
the local Claude Code session connects to ui at 127.0.0.1:8800; uv run myorch on the host connects to temporal at 127.0.0.1:7233 and reads events via ui.