The whole stack, one command
Run the platform inside your own environment — a laptop-sized Compose stack, a k3s cluster, or a site with no path to a registry at all.
Get the deployment bundle from the licensing portal's Downloads page — not by cloning this repository. The air-gapped bundle needs no registry access at all; extract it and bring the stack up:
tar -xzf dsh-stack-0.1.0-airgap.tar.gz && cd dsh-stack-0.1.0-airgap
for t in images/*.tar; do docker load -i "$t"; done
docker compose up -d --wait
docker compose logs control-plane | grep -A6 'FIRST-BOOT ADMIN'The whole stack self-hosts with one command; an air-gap bundle ships every image.
The same images also deploy to a k3s cluster from a manifest set, and the bundle script packs the compose file, the operator CLI and every image into one tarball for a site with no path to a registry.
The public URLs the control plane hands to agents and uses for the identity-provider callback are changed from the console's Settings page, not by redeploying.
A guided enrollment wizard and a site view that shows exactly where data is allowed to cross the boundary are part of the hosted control plane rather than of a self-hosted install.
Administrators sign in with their own identity provider from first boot — there is no shipped default password to rotate.
Sign in with your own identity provider (OIDC with PKCE); no shipped default administrator password.
A self-hosted deployment brings its own model the same way a SaaS one does.
Bring your own model — OpenAI-compatible endpoints, Ollama, Anthropic, or Cloudflare AI Gateway / Workers AI — with keys envelope-encrypted at rest.
- Sovereign — fully self-hosted
- SaaS — multi-tenant control plane
- Hybrid — self-hosted execution, hosted control plane
The whole stack, one command
Request a demo