Setup

Under the hood, playrooms are Kubernetes sandboxes with SSH access over Tailscale. Here's how it all fits together.

Alpha

Playrooms are in active development. Commands, flags, and output may change between releases.

Kubernetes objects

When you create a playroom, the CLI deploys a few Kubernetes objects into the Playhouse cluster to make it all work. The exact details may change, but the current setup looks something like this:

Initialization

Create command

Runs acloud playroom create my-room -p playhouse-demo and it creates a playroom

What it creates

StatefulSet

the playroom pod (your box)

PVC / emptyDir

/home/playroom storage

Secret

SSH keys + forwarded env vars

Service

SSH endpoint via Tailscale

Namespace + RoleBinding

sandbox to deploy

What it results in

Tailscale hostname

Tailscale gives the playroom a hostname on your tailnet.

Pinned SSH key

The CLI pins its SSH host key, then connects you over SSH.

Important details

One pod per playroom. It's a StatefulSet scaled to 1, so you can stop it (scale to 0) and start it again later without losing data.

SSH over Tailscale. The SSH port is exposed through a Tailscale LoadBalancer. Tailscale assigns a private hostname; you connect to that. No public IP, no open ports on the internet.

A sandbox to deploy into. Each playroom gets its own Kubernetes namespace (e.g. playroom-my-room) where the agent has edit rights. It can create Pods, Services, ConfigMaps, and so on there, but it can't escape that namespace or grant itself more access.

Storage

Persistent (default)

/home/playroom lives on a PVC and survives stop/start. Use this for ongoing work.

Ephemeral (--ephemeral)

Home lives in pod-local scratch and is wiped on any restart. Faster to start, nothing persists. Pairs naturally with --rm for true one-shot sandboxes.