On-premises (Docker)
Draft: this page is being written, and what it says is not yet complete.
On your own servers, or a single virtual machine in any cloud, the engine’s services run as Docker containers beside your product’s own Compose stack. Nothing listens for Atlantic: every connection to LightHouse is outbound.
The one-click stack
Section titled “The one-click stack”In LightHouse, Setup and admin → Where agents run, choose On-premises, then Get my stack. LightHouse gives you a compose.yaml. There is no cloud bootstrap and no console link: your own pipeline, or a person, runs it.
What it creates
Section titled “What it creates”| Container | Compose profile | What it does |
|---|---|---|
front-door |
always | Signs people in through your own OIDC identity provider (Entra ID, Okta, Google, Keycloak or any other) before a request reaches the product, with PKCE, sessions of at most 12 hours and TLS 1.2 or later. The product’s own port stays on 127.0.0.1 |
aal-relay |
always | The one place that signs and buffers telemetry to LightHouse (512 MiB buffer by default). Publishes no port |
aal-content-reader |
reader |
The read-only content reader, dialling out to LightHouse |
aal-handler |
commands |
The command channel, dialling out to LightHouse |
aal-content-reader-ondemand, aal-handler-ondemand |
ephemeral, ephemeral-commands |
The same, run for a 50-second window and then stopped |
aal-scheduler, aal-scheduler-proxy |
the ephemeral profiles | Starts the on-demand containers every minute. It reaches Docker only through a proxy that allows listing, starting and waiting on the deployment’s own containers, and nothing else |
The gateway runs as your product’s own container, so a job never holds the model credentials.
Every container runs with a read-only root file system, all capabilities dropped, no new privileges, and as user 10001.
Permissions
Section titled “Permissions”There is no cloud identity. What each container may reach is its network and its secrets:
- Secrets are files in a
secrets/directory (mode 700): the deployment’s Ed25519 private key (openssl genpkey -algorithm ed25519), Atlantic’s reader public key, the sign-in app’s client secret, the front door’s cookie secret and its TLS certificate and key. - Networks:
edge, for outbound traffic; your product’s existing network; and an internal-only network for the scheduler. - To stop Atlantic reading content, empty the reader’s public key file; to stop commands, empty the command key or leave the
commandsprofile off.
Hardware and network requirements
Section titled “Hardware and network requirements”- Network: outbound HTTPS and WebSocket on port 443 to LightHouse’s intake address, which onboarding gives you.
HTTPS_PROXYandNO_PROXYare honoured. - Hardware: not yet published Coming.
Air-gapped operation
Section titled “Air-gapped operation”Not supported Coming. The relay, the content reader and the command channel all need an outbound path to LightHouse; through a proxy is enough.
Regions
Section titled “Regions”Your servers’ location is the region. LightHouse records it as onprem.
Deployment profiles
Section titled “Deployment profiles”On your own servers an idle container costs memory, not a bill, so always-on (reader and commands) is a fine default. Ephemeral (ephemeral, and ephemeral-commands) frees memory and keeps nothing connected to Atlantic between runs; a portal read then waits up to about a minute while the reader wakes. There is no cloud bill to compare, so LightHouse shows no saving. See Deployment profiles.
Upgrading and removing the stack
Section titled “Upgrading and removing the stack”- Upgrade: pin each image by digest, change it in a reviewed change, and
docker compose up -d. See Upgrades. - Remove:
docker compose down, then delete thesecrets/directory and the volumes you no longer need.