Multi-tenant Architecture

Vibe Coding platforms usually need to provide isolated environments for each end user. This document describes CloudBase's multi-tenant isolation solution.

---

Tenant Isolation Model

CloudBase adopts a one-tenant-one-environment model: every user corresponds to an independent CloudBase environment, so compute, data, storage, and networking are naturally isolated.

Key design points:

Dimension	Design
Agent and Sandbox separation	The Agent runs in the production environment (with credentials), while the Sandbox runs without credentials and is invoked remotely over RPC. This separation reduces security risk.
Multi-tenant isolation	The one-tenant-one-environment model gives each user a dedicated CloudBase environment with natural isolation of compute, data, storage, and network.
Elastic scaling	The Agent service layer is stateless and can scale horizontally. Sandboxes can be created and destroyed on demand. CloudBase environments use pay-as-you-go billing.
Cold-start optimization	Preheated Sandbox snapshots + template environment cloning reduce the wait time for first use.
Cost optimization	Idle Sandbox instances can be reclaimed automatically and restored on demand, with environment-level resource quota control.

---

Permission Isolation Options

CloudBase provides two permission-isolation approaches that you can choose from according to your needs (see the comparison document for details):

Dimension	Option 1: Based on CAM sub-accounts	Option 2: No CAM sub-accounts (white-label)
Core idea	Create one CAM sub-account for each user	Use the platform's own identity system as the authorization layer
User account	Tencent Cloud CAM sub-account	Platform-owned account (can integrate with SSO / LDAP)
Brand visibility	Users can perceive Tencent Cloud	Fully white-label, invisible to end users
Manual management	✅ Users can log in to the console for management and review	❌ Only management through APIs and logs
SSO integration	Not supported	✅ Supports enterprise SSO
Suitable scenarios	Fast launch, internal platforms	ToC products, white-label / OEM requirements

Recommendation: start with Option 1 to validate the business quickly, then evolve to Option 2 when you need deeper white-label control.

Credential security:

Holder	Credential	Purpose
Agent Runtime	LLM API Key	Call large models
	CloudBase SecretId / SecretKey	Call management APIs and authenticate Sandbox RPC
Sandbox	Environment-level temporary credential (for MCP only)	Can operate only on the current user's own CloudBase environment

---

Environment Management (Automation)

// Use the management SDK to create an environment for a new user
const cloudbaseManager = require('@cloudbase/manager-node');

async function createUserEnv(userId) {
  // 1. Create the environment
  const result = await tcbApi.CreateEnv({
    Alias: `user-${userId}`,
    PackageId: 'baas_personal',
    Resources: ['flexdb', 'storage', 'function'],
    Tags: [{ Key: 'userId', Value: userId }]
  });

  // 2. Poll until the environment is ready
  await waitForEnvReady(result.EnvId);

  // 3. Persist the mapping between the user and the environment
  await saveUserEnvMapping(userId, result.EnvId);

  return result.EnvId;
}

---

Cost Estimation

Item	Unit Price	Quantity	Monthly Cost
Management environment (CloudBase Personal Edition)	¥39.9 / month	1	¥39.9
User environment (CloudBase Personal Edition)	¥39.9 / month	N	¥39.9 × N

• 10 users: ¥39.9 × 11 = ¥439 / month
• 50 users: ¥39.9 × 51 = ¥2,035 / month
• 100 users: ¥39.9 × 101 = ¥4,030 / month