← All modules — full architecture

Meridian Logistics — OpenZiti 2.0 architecture

High-level design — click any component to drill into its low-level design
Module 08: Tunnelers — Docker patterns · verified against OpenZiti v2.0.3 (field build 2026-09-28)
Read the guide: Docker
M08 · Tunnelers — Docker
✕ Close
Tunneler (ziti-host · host-gateway) Edge router · sidecar Controller (M03) · service Policy (M06) fabric — dials out enroll / hosting policy grant
token → enroll → volume Bind: #pp-hosts grants Dial edge :3022 Identity contract token: ZITI_ENROLL_TOKEN identity: named volume Control plane (M03) ctrl1 · ctrl2 · ctrl3 — mints OTTs Docker Desktop · local M08 compose is the IaC · dials out ziti-host-pp-01 #pp-hosts · Bind: portal er-sc-dispatch-01 tproxy · id #employee docker-host-01 optional · Linux host Re-platform — the Bind flip ADD → VERIFY → REMOVE → VERIFY terminator → ziti-host-pp-01 Sidecar — its identity dials enrolls as an edge router identity #employee · system ERP M06 model — two policy edits Bind flip + ERP every Dial policy byte-identical er-pub-01/02 public edge · M04 partner-portal portal.meridian.internal meridian-yard yard.meridian.internal · #yard chooser · privilege · blast · owner whose identity? whoever intercepts tunneler 1.x · router 2.0.3
Tip: click the identity contract, the Docker host or any of its patterns, the re-platform, the sidecar's way in, the M06 model, the public edge, either service, the M03 control plane, or a concept chip.
From the course Enterprise Zero Trust Architecture with OpenZiti 2.0 · cawachlabs.com · Guides Meridian Logistics is a fictional company. © 2026 CawachLabs · by Girish Reddy. All rights reserved. Not affiliated with or endorsed by the OpenZiti project. Icons adapted from Lucide (ISC, parts MIT).
TrademarksMicrosoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies. Docker is a trademark or registered trademark of Docker, Inc. in the United States and/or other countries. Kubernetes, Helm and SPIFFE are registered trademarks of The Linux Foundation in the United States and/or other countries. OpenTofu is a registered trademark of LF Projects, LLC. Ubuntu is a registered trademark of Canonical Ltd. Linux is the registered trademark of Linus Torvalds in the U.S. and other countries. Elasticsearch and Kibana are trademarks of Elasticsearch B.V., registered in the U.S. and in other countries. Grafana is a trademark of Raintank, Inc. dba Grafana Labs. Other names belong to their owners. CawachLabs is independent and not affiliated with or endorsed by these companies.