Concepts

Behavior is the contract

A spec describes an environment from the outside: which machines exist, which networks they sit on, which network may reach which, and which services answer on which ports. Anyone using the environment (a person, a test, another program) only ever sees that.

How each machine is built is a separate concern. Two environments that expose the same machines, networks and services behave the same, whether one runs in containers and the other in VMs.

Two shapes, per machine

Every machine can have up to two implementations:

Implementation	What it is	Built by
`docker:`	A container: a published image, or a build folder	Docker
`vm:`	A virtual machine: an OS plus provisioning steps run inside it	Vagrant, Proxmox, the cloud

A VM implementation installs its services natively. There is no Docker inside an Isoloom VM: a "VM target" means real machines.

You don't have to write both. Write the one you need; add the other when you want the environment to run there too.

Targets are derived

Isoloom works out the possible targets from the implementations:

Docker targets (docker, hosted, cloud-docker): every machine has docker:.
VM targets (vagrant, proxmox, cloud-vm): every machine has vm:.

It's all or nothing. An environment with one Windows machine (which has no container form) can't run on Docker, even if every other machine could: a copy missing a machine doesn't behave like the original.

The targets: field can only narrow the list, for example to leave out a target you haven't tested yet. Asking for an impossible target is an error that names the machines missing an implementation.

The access machine

One machine may be marked access: true: the machine a user lands on to work in the environment (a workstation, a jump host, a security tester's box). It may have no implementation of its own, because whatever runs the environment supplies it.

Inputs

Some values only exist at launch time: a token, an API address, a license key. Declare them once in inputs:, then list them on the machines that need them. Isoloom guarantees they reach those machines' setup, and only those, and are never baked into an image.

Checks prove the behavior

The spec lists checks:, scripts that test the environment from the outside: a service answers, a login works, a network is blocked. The same checks run against every target that is built. A target whose checks fail isn't offered. That's how "same behavior everywhere" stays true when two implementations of a machine are written differently.