Overview
What an app is, where it runs, and what it can reach.
What an app is
A set of files an agent wrote, built into a container and served at
/apps/{slug} behind your LensHub login. Its owner decides whether everyone
in the org can open it or only they can; nobody outside the workspace can.
People find apps on Home, in the sidebar's recent apps and under
Manage → Apps — see Using apps.
Agents build these with lenshub_app_deploy. You do not have to write one
by hand, and there is no separate hosting account to manage.
What it can reach
Nothing, at first. A newly deployed app has no network access at all. Not to the internet, not to your database, not to LensHub itself.
It asks for access one destination at a time with lenshub_app_request, and
an administrator approves or refuses each request. Anything not approved is
refused by the egress proxy and recorded in the app's logs — so a blocked call
shows up as a diagnosable line rather than a silent hang.
This is the whole point of the feature. An agent writing code you have not read is only safe if the code cannot reach anything you did not agree to.
Builds are different. While a release is being built, it can install its dependencies from public hosts (PyPI, npm, OS package mirrors) through the same egress proxy — never an internal address — and every host it contacts is recorded on the app. The running app still starts with nothing. See Deploying.
The pieces
| Piece | What it is |
|---|---|
appd | The runtime. Builds releases, runs containers, and proxies every outbound call. |
| Release | One build of one app. Deploying again creates a new release; the old one stays in history. |
| Connection | One approved host:port an app may reach. |
| Secret | An environment variable holding the credential for an approved connection. |
appd runs under the apps compose profile — start it with make up-apps.