Docker deployment
Deploy the API-only edge runtime
The default Compose profile contains no UI. API access, capture, inference, event persistence, and the webhook outbox run in the independent runtime service.
Deployment kit
deploy/api/
├── docker-compose.yml
├── .env.example
├── bootstrap.sh
├── quickstart.sh
├── quickstart.ps1
├── recovery/
├── README.md
└── smoke-test.shThe kit currently ships with the source tree. A public immutable container-registry URL is a release gate; do not invent a docker pull command before a registry and digest are published.
Start
macOS, Linux, or Ubuntu/WSL
cd deploy/api
./quickstart.shWindows PowerShell
Set-Location .\deploy\api
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\quickstart.ps1This command creates secrets when needed, starts the headless node, waits for readiness, runs the first-Event example, and leaves the runtime running; it does not start the UI.
Windows 11 first run and recovery
Persistence
Persist the database, source/monitor desired state, events, webhook outbox, and image evidence in the /data volume. Use the separate /models volume for the model cache. Removing a container must not remove this data.
Binding and TLS
The default bind is 127.0.0.1. A same-host TLS reverse proxy should keep loopback and use 127.0.0.1:8000 upstream. Set SENTINEL_ALLOW_LAN=1 only for a proxy on another machine, bind the Edge host's exact private management IP (not 0.0.0.0), and firewall port 8000 to the proxy IP/CIDR. Wildcard CORS is rejected; clients must never reach port 8000 directly.
Where the UI fits
The optional console previews the first source, tunes and tests monitors, inspects events and delivery failures, and checks host fit. It is an API client, not the runtime supervisor. API-only deployments may never install it.