Boundary nodes are the entry points to the Internet Computer; each user request passes through one of these nodes before reaching the target container. This article delves into the new boundary node architecture, a key outcome of the Solenoid milestone, and explores the functionalities it unlocks.
Mail Carriers of the Internet Computer
From a high-level perspective, boundary nodes can be seen as the mail carriers of the Internet Computer; they receive requests from clients and ensure they reach the correct destination. To better understand their role, it is essential to first understand the core structure of the Internet Computer.
The core of the Internet Computer is divided into multiple subnets, each comprising several replicas, with containers (smart contracts of the Internet Computer) hosted on these subnets. Clients must route requests to one of the replicas within the appropriate subnet to interact with containers (e.g., initiating transfers on the ICP ledger).
This is where boundary nodes come into play; clients simply send their requests to any boundary node, which then ensures that the requests are delivered to the correct destination - a replica within the appropriate subnet. This design allows clients to avoid needing to understand or manage the complex inner workings of the Internet Computer.
Without boundary nodes, clients would face significant challenges: they would need to know which subnet the container is in, identify the replicas within that subnet, and verify which replicas are operational and ready to handle requests.
However, the role of boundary nodes goes beyond routing requests; they enhance performance through caching, enforce limits and security rules to protect the core of the Internet Computer, and act as converters that transform HTTP requests into IC API calls, enabling browsers to access containers directly, which is one of the unique features of the Internet Computer Protocol.
So far, boundary nodes have been operated by the DFINITY Foundation; however, this is changing with the completion of milestones in the Solenoid roadmap: the edge infrastructure of the Internet Computer is now fully decentralized.
New Edge Architecture
Boundary nodes were once a single entity in the old edge architecture; now they have been split into two distinct components - API boundary nodes and HTTP gateways, each handling different tasks:
API Boundary Nodes serve as the public edge of the Internet Computer and expose IC API endpoints.
HTTP gateways act as a conversion layer for HTTP requests, positioned above API boundary nodes, allowing browsers to access containers.
Additionally, the discovery library can also help IC native clients (such as the HTTP gateway) discover and connect to API boundary nodes.
API Boundary Node - Public Edge of IC
API boundary nodes serve as the mail carriers described earlier, routing requests to the appropriate destination.
Since API boundary nodes run on node provider machines (just like replicas) and are entirely controlled through NNS (adding, removing, and upgrading through proposal management), the public edge of the Internet Computer is now fully decentralized.
Technical Details
The core of the API boundary node is the ic-boundary service, which handles all key tasks, from terminating TLS and parsing requests to forwarding them to the appropriate replica.
Additionally, it includes query response caching and several protective measures to safeguard itself and the IC core. The Internet Computer uses a single unified VM image for replicas and API boundary nodes.
Depending on the role of the node, the orchestrator simply starts ic-replica for replica nodes or ic-boundary for API boundary nodes.
HTTP Gateway - Enable Direct Browser Access
HTTP gateways add an extra layer to the Internet Computer, converting HTTP requests into IC API calls and forwarding them to API boundary nodes. With these gateways, browsers and other HTTP clients can interact directly with containers on the Internet Computer.
This is why you can access the Internet Computer website internetcomputer.org from your browser without any additional software, even though the site is fully hosted on-chain.
Since the HTTP gateway acts as a conversion layer, it is not part of the IC core and can be deployed by anyone.
Technical Details
The core of the HTTP gateway is the ic-gateway service, which handles tasks such as terminating TLS, HTTP caching, converting HTTP requests to IC API calls, and converting responses back to HTTP format.
The HTTP gateway has multiple encapsulation formats and can run as a single instance or scale into a cluster, like the DFINITY Foundation.
Discovery Library - Facilitates Connection to IC
The discovery library helps IC native clients (such as the HTTP gateway) find and connect to available API boundary nodes, routing requests to the appropriate destination. It offers various strategies, from simple methods (such as randomly selecting an API boundary node) to more advanced methods (continuously monitoring node health and latency), ensuring requests are routed to the best node.
Technical Details
The discovery library is packaged in agent-rs, and documentation can be found here:
internetcomputer.org/docs/current/developer-docs/developer-tools/off-chain/agents/rust-agent#using-dynamic-routing
Transformation
The goal of transitioning from the old architecture to the new architecture is to provide a seamless experience for end users while enabling developers to build new services and innovate.
DFINITY will continue to operate a series of HTTP gateways serving familiar domains like ic0.app, icp0.io, and icp-api.io.
Developers can start using the discovery library to connect directly to API boundary nodes, effectively bypassing the HTTP gateway and fully leveraging the new architecture.
Current Status
All components (ic-boundary, ic-gateway, and discovery library) have been extensively tested and have been running in production for some time.
With the passage of proposal #134902, there are now 20 API boundary nodes constituting the public edge of the Internet Computer. Additionally, the DFINITY Foundation has been running several HTTP gateways for testing and validation and is gradually replacing the remaining boundary nodes with HTTP gateways.
Please let us know your feedback. You can share your thoughts anytime on the DFINITY Developers X channel and developer forums, and continue to stay tuned for more technical roadmap updates.
IC Content You Care About
Technical Progress | Project Information | Global Events
Follow the IC Binance Channel
Stay Updated
