Operate the application containers
| Container / artifact | Responsibility | Network exposure |
|---|---|---|
| Next.js web | Server-rendered shopper UI and client cart | Internal ingress to shoppers |
| Thin BFF routes | Validate requests; create/capture PayPal Sandbox orders | Server egress to PayPal; never exposes credentials |
| Static catalog snapshot | Versioned product records and local permitted assets | No runtime vendor call |
| Internal reverse proxy / ingress | Route the home-lab demo | Corp v1 internal boundary |
The MVP does not require a database. Any persisted Sandbox references must wait for the retention question to be resolved.