Boundary nodes are the entry points to the Internet Computer; every user request passes through one of these nodes before reaching the target container. This article delves into the new boundary node architecture, a key outcome of the Solenoid milestone, and explores its unlocked capabilities.
Postal Workers of the Internet Computer
At a high level, boundary nodes can be viewed as the postal workers of the Internet Computer; they receive requests from clients and ensure they are delivered to the correct destination. To better understand their role, it is first important to grasp the core structure of the Internet Computer.
The core of the Internet Computer is divided into multiple subnets, each composed of multiple replicas. Containers (the smart contracts of the Internet Computer) are hosted on these subnets. For clients to interact with a container (for example, initiating a transfer on the ICP ledger), requests must be routed to one of the replicas in the corresponding subnet.
This is where boundary nodes come into play; clients simply send their requests to any boundary node, which then ensures the request is forwarded to the correct destination - a replica within the appropriate subnet. This design allows clients to operate without needing to understand or manage the complex internal workings of the Internet Computer.
Without boundary nodes, clients would face significant challenges: they would need to know which subnet the container is located in, identify the replicas within that subnet, and verify which replicas are running and ready to handle requests.
However, the role of boundary nodes goes far beyond routing requests; they enhance performance through caching, enforce limits and security rules to protect the Internet Computer's core, and act as converters, transforming HTTP requests into IC API calls, enabling browsers to access containers directly, which is one of the unique features of the Internet Computer protocol.
So far, boundary nodes have been operated by the DFINITY Foundation; however, this is changing with the completion of milestones in the Solenoid roadmap: the edge infrastructure of the Internet Computer is now fully decentralized.
New Edge Architecture
Boundary nodes used to be a single entity in the old edge architecture but have now been split into two distinct components - API boundary nodes and HTTP gateways, with each component taking on different tasks:
API boundary nodes serve as the public edge of the Internet Computer and expose IC API endpoints.
HTTP gateways act as a conversion layer for HTTP requests, positioned above API boundary nodes, allowing browsers to access containers.
Additionally, the discovery library can also assist IC native clients (like HTTP gateways) in discovering and connecting to API boundary nodes.
API Boundary Node - The Public Edge of IC
API boundary nodes serve as the postal workers described earlier, routing requests to the appropriate destination.
Since API boundary nodes run on node provider machines (just like replicas), and are entirely controlled via the NNS (added, removed, and upgraded through proposal management), the public edge of the Internet Computer is now fully decentralized.
Technical Details
The core of the API boundary node is the ic-boundary service, which handles all critical tasks from terminating TLS and parsing requests to forwarding them to the appropriate replicas.
In addition, it includes query response caching and several protective measures to safeguard itself and the IC core. The Internet Computer uses a single unified VM image for replicas and API boundary nodes.
Depending on the role of the node, the orchestrator only needs to start ic-replica for replica nodes or ic-boundary for API boundary nodes.
HTTP Gateway - Enable Direct Browser Access
HTTP gateways add an additional layer to the Internet Computer, converting HTTP requests into IC API calls and forwarding them to API boundary nodes. With these gateways, browsers and other HTTP clients can interact directly with containers on the Internet Computer.
That’s why you can access the Internet Computer website internetcomputer.org from your browser without any additional software, even though the site is fully hosted on-chain.
Since the HTTP gateway acts as a conversion layer, it is not part of the IC core and can be deployed by anyone.
Technical Details
The core of the HTTP gateway is the ic-gateway service, which handles tasks such as terminating TLS, HTTP caching, converting HTTP requests into IC API calls, and converting responses back to HTTP format.
HTTP gateways come in multiple encapsulation formats and can run as a single instance or scale to clusters like the DFINITY Foundation.
Discovery Library - Facilitating Connection with IC
The discovery library helps IC native clients (such as HTTP gateways) find and connect to available API boundary nodes, routing requests to the appropriate destination. It provides various strategies, from simple methods (like randomly selecting an API boundary node) to more advanced ones (continuously monitoring node health and latency), ensuring requests are routed to the best node.
Technical Details
The discovery library is packaged in agent-rs, with documentation available here:
internetcomputer.org/docs/current/developer-docs/developer-tools/off-chain/agents/rust-agent#using-dynamic-routing
Transformation
The goal of transitioning from the old architecture to the new one is to provide a seamless experience for end users while allowing developers to build new services and innovate.
DFINITY will continue to operate a series of HTTP gateways, servicing the familiar domains ic0.app, icp0.io, and icp-api.io.
Developers can start using the discovery library to connect directly to API boundary nodes, effectively bypassing the HTTP gateway and taking full advantage of the new architecture.
Current Status
All components (ic-boundary, ic-gateway, and discovery library) have been extensively tested and have been running in production for some time.
With the passage of proposal #134902, there are now 20 API boundary nodes constituting the public edge of the Internet Computer. Additionally, the DFINITY Foundation has been running several HTTP gateways for testing and validation and is systematically replacing the remaining boundary nodes with HTTP gateways.
Please let us know your feedback. You can share your thoughts at any time in the DFINITY Developers X channel and the developer forum, and stay tuned for more technical roadmap updates to come.
IC Content You Care About
Technical Progress | Project Information | Global Events
Follow IC Binance Channel
Stay Updated