Skip to content

SchemaDock

SchemaDock extends SchemAlign network reach to systems that are not directly reachable from the SchemAlign cloud environment.

Use SchemaDock when a pipeline needs to connect to a private SFTP server, internal HTTPS endpoint, LDAPS directory, or another authorized TCP destination inside a customer-controlled network.

The short version

SchemaDock is a connectivity plane, not a remote execution worker.

SchemAlign
    = pipeline execution
    = scheduling
    = expressions
    = credentials
    = artifacts
    = retries
    = RBAC

SchemaDock
    = enrolled agent identity
    = secure outbound gateway connection
    = destination authorization
    = authorized TCP streams
    = health and version reporting
    = reconnect and service lifecycle

Pipeline logic remains in SchemAlign. SchemaDock does not execute pipeline DAGs, SQL transformations, Python connector code, expressions, retries, or artifact logic on the customer network.

How traffic flows

SchemAlign node or connector
        |
        | application protocol over TCP
        v
SchemaDock gateway
        ||
        || encrypted SchemaDock connection
        || outbound from the customer network
        v
SchemaDock agent
        |
        | authorized private-network TCP connection
        v
Private destination

The SchemaDock agent initiates its connection outbound to SchemAlign. A normal deployment does not require an inbound Internet-facing listener on the SchemaDock host.

When to use SchemaDock

Use SchemaDock when all of the following are true:

  • the destination is not directly reachable from SchemAlign
  • the destination can be reached from the network where SchemaDock is installed
  • the node or connector supports a Connection Route
  • the selected Dock is authorized for the pipeline organization
  • the destination is permitted by the Dock destination policy

Common examples include:

Workload Example
SFTP Retrieve or upload files on an internal SFTP server.
HTTPS Call an internal REST API that is not publicly reachable.
LDAPS Query an internal Active Directory or LDAP service over TLS.
Extend source connector Allow an approved outbound connector to reach a private TCP destination while connector execution remains isolated in SchemAlign.

What SchemaDock does not do

SchemaDock does not:

  • execute pipeline nodes
  • receive or execute a pipeline graph
  • run SQL Loader or SQL Transform work
  • execute Extend connector Python on the customer host
  • resolve expressions or runtime values
  • manage SchemAlign credentials or accounts
  • orchestrate retries, artifacts, or job state
  • silently fall back to Direct when a selected Dock is unavailable

Connectivity only

SchemaDock should remain boring infrastructure: a secure, policy-controlled connectivity layer that gives SchemAlign authorized network reach without moving SchemAlign execution into the customer network.

Supported routing model

SchemaDock is intended for outbound network activity.

Node or capability SchemaDock support
File Get Yes
HTTP Get Yes
Ethos Get Yes
File Put Yes
Installed outbound Extend Source connectors Yes, when the connector exposes Connection Route support
SQL Loader No
SQL Transform No
Inbound HTTP Request / API trigger No
HTTP Response No

A node that selects SchemaDock fails closed if the Dock cannot be used. SchemAlign does not silently reroute the node through Direct.

Administration lifecycle

A typical lifecycle is:

Register Dock
    -> choose ownership and availability
    -> download platform install bundle
    -> install SchemaDock
    -> consume one-time bootstrap
    -> persistent identity created
    -> Dock Online
    -> configure destination policy
    -> select Dock as Connection Route

After enrollment, normal upgrades preserve the existing identity and do not require a new bootstrap.

Next steps