Three models. Same architecture.
Most vendors have one answer to "where does it run?" and defend it. We built all three, so the question becomes yours to answer rather than ours.
On the box
The application runs natively inside your existing IBM i partition, in PASE. Db2 is reached locally, so the data never crosses a network, not even an internal one.
No new partition. No new operating system. No new licence. Nothing to add to what you already own and already secure.
This is the tightest posture available, and the hardest of the three to build, which is why almost nobody offers it.
IBM i partition +--------------------------+ | PASE web tier | | | | | local connection | | | | | Db2 for i RPG | +--------------------------+
Beside the box
The application runs on a Linux partition on the same Power hardware, alongside your IBM i partition. Traffic between them goes over internal virtual networking, inside the same machine.
Standard Linux operations, ordinary tooling, anyone competent can run it. Data still never leaves your own hardware.
The pragmatic default for most shops.
In the cloud
The application runs on a cloud VM and reaches your on-premise Db2 over a secured connection. Your IBM i stays exactly where it is.
The right answer when a cloud-first decision has already been taken elsewhere in the organisation and the modernization has to fit inside it.
Which one should you pick?
On the box if the answer to "can the data leave the machine?" is no, or if adding anything to the environment triggers a governance process you'd rather avoid.
Beside the box if you want conventional Linux operations and the data still inside your own four walls. Most shops land here.
Cloud if the decision has effectively been made for you already.