SkyKoiSKYKOIDocs
Docs/Architecture/Instance Isolation

Instance Isolation

How each user gets complete isolation with a dedicated EC2 instance.

Every SkyKoi user gets their own dedicated EC2 instance. This provides the strongest possible isolation — separate process, filesystem, network, and IAM scope.

Isolation Model

text
User A                    User B                    User C
  │                          │                          │
  ▼                          ▼                          ▼
┌──────────┐            ┌──────────┐            ┌──────────┐
│ EC2 #1   │            │ EC2 #2   │            │ EC2 #3   │
│ t3.small │            │ t3.small │            │ t3.small │
│          │            │          │            │          │
│ Gateway  │            │ Gateway  │            │ Gateway  │
│ Agent    │            │ Agent    │            │ Agent    │
│ Workspace│            │ Workspace│            │ Workspace│
│ Sessions │            │ Sessions │            │ Sessions │
└──────────┘            └──────────┘            └──────────┘
     │                       │                       │
     └───────── No cross-talk between instances ─────┘

What's Isolated

  • •Process isolation — Each user's Koi Gateway runs as its own systemd service on a separate EC2 instance
  • •Filesystem isolation — Own workspace (/home/ubuntu/koi/), sessions, config, and all files
  • •Network isolation — Separate EC2 instance with its own security group and IP address
  • •IAM isolation — Instance profile skykoi-tenant-agent-profile scopes AWS access (Bedrock, etc.)
  • •Memory isolation — Separate RAM and CPU — no shared resources between users
  • •Auth isolation — Each Gateway has its own unique auth token

Security Group

Each EC2 instance uses a security group with the following ports open:

  • •Port 22 — SSH (for maintenance)
  • •Port 80 — HTTP (redirect to HTTPS)
  • •Port 443 — HTTPS/WSS (nginx with self-signed TLS → Gateway)
  • •Port 8080 — Reserved
  • •Port 18789 — Gateway WebSocket API (localhost only, proxied via nginx)

💡Dedicated EC2 instances provide stronger isolation than container-based multi-tenant architectures. Each user's data, processes, and network traffic are completely separate.

NextAWS Integration →