> ## Documentation Index
> Fetch the complete documentation index at: https://p-bitm-2269ecee.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Architecture

> Understand the P-BitM control plane, campaign services, browser sessions, and Docker boundaries.

P-BitM separates the trusted administrative control plane from per-campaign
and per-session workloads.

```text theme={"system"}
                         ADMINISTRATIVE CONTROL PLANE

  Operator browser
         |
         | HTTPS on the loopback interface
         v
  Frontend nginx  ------ authenticated API ------>  Admin backend
                                                        |       |
                                                        |       +--> SQLite
                                                        |            and storage
                                                        |
                                                        +--> Restricted Docker proxy
                                                                  |
                                                                  v
                                                             Docker Engine
                                                                  |
                           provisions and manages                 |
                           campaign services and   <--------------+
                           browser containers


                           CAMPAIGN AND BROWSER PLANE

  Victim browser
         |
         | HTTPS and WebSocket
         v
      Traefik
         |
         v
  Per-campaign service  <---- authenticated internal API ---->  Send Data to Admin backend
         |
         | private, victim-scoped route
         v
  Assigned Selkies or VNC browser container
```

This documentation normally uses **target** for a person or system inside the
authorized assessment scope. It uses **victim** for P-BitM's runtime entity and
where the operator interface or implementation uses that name, including a
victim session, `Victim`, `victim_id`, and the CLI `victim` subcommand. The term
does not imply authorization; P-BitM must only be used with explicit written
authorization.

## Control plane

The Vue frontend serves the dashboard and proxies authenticated API requests
to the FastAPI admin backend. The admin backend owns users, resources,
campaign state, storage, and Docker orchestration.

## Campaign plane

Each campaign runs a dedicated FastAPI/nginx service behind Traefik. It handles
the campaign entry flow, target WebSockets, authenticated communication with
the admin backend, and private routing to the assigned browser container.

## Browser plane

Each active victim—the authorized target represented by the runtime
record—receives an isolated VNC or Selkies container. Browser
containers do not receive direct access to the Docker socket or admin
credentials.

## Docker mediation

Traefik and the admin backend use separate socket-proxy services and internal
networks. Traefik receives read-only discovery capabilities. The admin backend
receives the limited mutation capabilities required to manage application
workloads.