Blekline separates control plane (tenant policy + audit) from ingress edge (low-latency mask/enforce near agents).
Target regions (Daytona-aligned)
| Region code | Location | Edge URL (example) |
|---|---|---|
us-west-2 | US West (Oregon) | https://ingress-us-west.blekline.com |
us-east-1 | US East (Washington DC) | https://ingress-us-east.blekline.com |
eu-west-2 | EU West (London) | https://ingress-eu-west.blekline.com |
eu-central-1 | EU Central (Frankfurt) | https://ingress-eu-central.blekline.com |
ap-south-1 | Asia-South (Mumbai) | https://ingress-ap-south.blekline.com |
Architecture
Agent (Cursor/Codex) in Mumbai
→ ingress-ap-south sidecar (local enforce <10ms)
→ policy cache (SSE from control plane)
→ async audit events → app.blekline.com (or EU tenant)
→ approved tool calls → Daytona MCP (same region)
Deploy edge sidecar
pnpm build:packages
docker build -t blekline-ingress -f packages/ingress-proxy/Dockerfile .
docker run -d -p 8787:8787 \
-e BLEKLINE_INGRESS_REGION=ap-south-1 \
-e BLEKLINE_INGRESS_TARGET=https://app.blekline.com \
-e BLEKLINE_WORKSPACE_TOKEN=blw_... \
-e BLEKLINE_WORKSPACE_ID=ws_... \
-e BLEKLINE_EDGE_LOCAL_MASK=true \
blekline-ingress
Helm: packages/ingress-proxy/helm/blekline-ingress/
Sidecar endpoints
| Route | Purpose |
|---|---|
GET /health | Region + local mask latency p50/p95 |
POST /v1/enforce-tool-call | Edge-local tool policy (<10ms p99 target) |
POST /v1/chat/completions | OpenAI-compatible with edge pre-mask |
POST /v1/messages | Anthropic-compatible with edge pre-mask |
Control plane env (webapp)
BLEKLINE_MASK_FAST_PATH=local_first # skip Azure when local pass is clean
BLEKLINE_INGRESS_REGION=eu-central-1 # reported in x-blekline-ingress-region
Latency SLOs
See Latency SLO.
Stack with Daytona
Same region for both layers:
| Layer | Product | Typical latency |
|---|---|---|
| Ingress | Blekline edge | p99 tool enforce <10ms |
| Ingress | Blekline fast mask | p95 <20ms |
| Runtime | Daytona sandbox | <80ms create (Daytona SLO) |
Do not compare Blekline Azure mask to Daytona sandbox boot — different layers.
Next steps: AI Enablement Stack · Ingress proxy · Daytona stack · Open workspace · Report issue