Yes, this is a really important question, and it's something that I believe
that the Forge architecture supports out-of-the-box. Every interaction with
the UI API (the Forge commands, per say) is stored in a request-scoped
UIContext object that is initialized when a command is invoked and
destroyed when the command finishes executing. That means that you can
execute multiple concurrent commands in a single Forge instance and they
will not affect each other.
When it comes to security, as a good practice, it is important to restrict
the commands that the exposed REST service can execute.
That's why in the Obsidian backend we only expose a REST endpoint
consuming the Forge API to execute a limited number of commands (more
specifically, the ones exposed by the obsidian-addon)
Last but not least, as the Forge Online app is just a PoC illustrating how
Forge can work in a web environment, it does not impose restrictions to the
supported commands, therefore it shouldn't be a web app to be used in
PS: It would be nice to ping the Fabric8 team for this matter as they are
already using Forge as their project generator solution for a long time now.
I hope this helps. Looking forward to this list of requirements and happy
to discuss about this anytime.
 - https://github.com/obsidian-toaster/generator-backend
 - https://github.com/obsidian-toaster/obsidian-addon
On Tue, Jan 31, 2017 at 9:27 PM, Andrew Lee Rubinger <alr(a)redhat.com> wrote:
We have some requests coming down the pike from the Developer Group with
regards to running Forge as a Service (which is great!).
Additionally, I'm suspecting this will soon be very important for us as
well, as we continue to build out what's currently known as the "Obsidian
Generator", using Forge as a backend.
I'm hoping the Forge team will kindly advise as to our preparedness for
running Forge in a multitenant environment. Concerns may include resource
consumption (not running an instance-per-user), security, etc. Have we yet
broached this subject specifically in the prototypes I've seen thus far
using Forge Online?
I've requested of the Developer Group a list of requirements they've
devised; will send those along here when I have them. In the meantime,
mind describing where we currently stand?
Red Hat Developer Group Architecture
forge-dev mailing list