Three planes, and only three
A self-hosted estate grows into a tangle one exception at a time. OpenKuai holds the line with three network planes, and only three:
- The bridge — container-to-container, 100% of local traffic. Every service listens; every consumer calls.
- The tailnet — host-to-host only, TLS, device identity. Never an ordinary container.
- The internet — egress-only, behind the host’s allowlist. The only inbound is the operator.
The registry is the only thing a caller knows
One name per service: db, llm, rag, kb, agent-<name>. One name, one port, one auth per service. A new service is a line in one file — never a new listener, never a second path to an existing service.
Agents: clients of everything, servers of one thing
The agent tier talks to internal services over the bridge by registry name, reaches LLM providers through the host’s egress allowlist, and serves exactly one authenticated endpoint per agent for peer messaging. Authorization is by credential, never by source address.
What this rules out: host port-forwarding, a second path to any service, per-container VPN daemons, and database credentials outside the tier that needs them. The refusals are the design — a default refusal is a rule somebody will relax.