[{"data":1,"prerenderedAt":6010},["ShallowReactive",2],{"page-\u002Fbyodt-cloud\u002Finstallation":3,"navigation":5692},{"id":4,"title":5,"body":6,"description":5677,"extension":5678,"meta":5679,"navigation":183,"path":5688,"seo":5689,"stem":5690,"__hash__":5691},"docs\u002F02.byodt-cloud\u002F01.installation.md","Installing the BYODt Deployment",{"type":7,"value":8,"toc":5616},"minimark",[9,13,17,48,54,57,62,78,89,103,119,128,144,158,164,295,320,334,337,339,343,347,575,590,594,601,610,619,622,637,641,655,756,759,762,891,894,937,940,951,954,969,971,974,977,980,1085,1093,1100,1104,1110,1116,1250,1253,1273,1292,1312,1325,1335,1427,1432,1451,1472,1482,1497,1507,1511,1526,1535,1540,1547,1567,1577,1598,1610,1618,1622,1651,1663,1672,1684,1690,1733,1745,1754,1779,1785,1788,1798,1818,1830,1842,1846,1855,1861,1891,1899,1903,1911,1926,1939,1945,1948,1950,1953,1971,1974,2033,2036,2039,2045,2054,2069,2142,2147,2150,2162,2168,2177,2205,2208,2250,2254,2260,2405,2413,2417,2549,2567,2571,2574,2630,2656,2659,2670,2738,2757,2773,2779,2782,2831,2834,2844,2931,2941,2944,2965,2971,2977,2979,2984,3000,3009,3020,3024,3031,3229,3235,3241,3247,3251,3347,3366,3369,3375,3386,3416,3420,3438,3444,3447,3451,3465,3471,3477,3480,3514,3522,3527,3533,3536,3538,3541,3547,3553,3562,3566,3582,3586,3606,3614,3620,3624,3641,3651,3704,3706,3709,3716,3928,3940,3942,3945,3962,4010,4022,4036,4044,4056,4065,4080,4088,4126,4128,4132,4145,4153,4156,4162,4180,4205,4222,4225,4228,4264,4270,4272,4276,4279,4287,4299,4305,4317,4328,4345,4347,4351,4354,4358,4478,4484,4488,4585,4638,4642,4645,4648,4652,4672,4677,4681,4687,4730,4741,4743,4746,4749,4753,4762,4790,4796,4806,4815,4824,4830,4839,4843,4852,4859,4862,4866,4875,4891,5054,5057,5127,5142,5160,5163,5172,5178,5207,5211,5214,5222,5233,5240,5243,5357,5369,5371,5375,5386,5402,5408,5421,5423,5427,5438,5543,5545,5549,5612],[10,11,5],"h1",{"id":12},"installing-the-byodt-deployment",[14,15,16],"p",{},"This guide takes you from an empty machine to a running Dethernety deployment that you control. When you finish, you have:",[18,19,20,33,42],"ul",{},[21,22,23,27,28,32],"li",{},[24,25,26],"strong",{},"The platform"," at ",[29,30,31],"code",{},"http:\u002F\u002F127.0.0.1:3000",", where you build and analyse threat models.",[21,34,35,27,38,41],{},[24,36,37],{},"The operator console",[29,39,40],{},"http:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002F",", which reports the deployment's health.",[21,43,44,47],{},[24,45,46],{},"A graph database"," (Memgraph by default, or Neo4j) holding your models, with the MITRE ATT&CK, ATLAS and D3FEND reference data already loaded.",[14,49,50,53],{},[24,51,52],{},"Time to allow:"," 30 minutes to an hour for the first install, most of it unattended download time. The first start pulls four container images, installs the signed modules, loads the reference data, and downloads the embedding model's weights (about 1.26 GB). Every later start takes well under a minute.",[55,56],"hr",{},[58,59,61],"h2",{"id":60},"at-a-glance","At a glance",[14,63,64,65,70,71,77],{},"If your machine already meets the ",[66,67,69],"a",{"href":68},"#requirements","requirements",", there are three ways to install. The commands below use the current release; newer releases are listed on the ",[66,72,76],{"href":73,"rel":74},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases",[75],"nofollow","releases page",".",[14,79,80,81,84,85,88],{},"From the first release that ships it, each release has an installer, ",[29,82,83],{},"get-byodt.sh",". One command downloads the bundle, checks it, unpacks it into ",[29,86,87],{},".\u002Fbyodt",", and asks you a few questions. The first two ways run that installer; they differ only in how it reaches you.",[14,90,91,94,95,97,98,102],{},[24,92,93],{},"With npx (recommended if you have Node.js)."," The npm package carries the release's own ",[29,96,83],{}," and runs it. Use it if Node.js 18 or later is already installed, or you are happy to install it. Node.js runs the installer only: the deployment itself never needs it. If you will run the Dethereal Claude Code plugin on the same machine, you have Node.js already: its MCP server is launched with npx and needs Node.js 20 or later, which also meets the installer's 18 (see ",[66,99,101],{"href":100},"\u002Fdethereal\u002Fgetting-started#prerequisites","Getting started with Dethereal",").",[104,105,110],"pre",{"className":106,"code":107,"language":108,"meta":109,"style":109},"language-sh shiki shiki-themes github-light github-dark-dimmed","npx @dether.net\u002Fbyodt@0.14.0\n","sh","",[29,111,112],{"__ignoreMap":109},[113,114,117],"span",{"class":115,"line":116},"line",1,[113,118,107],{},[14,120,121,127],{},[24,122,123,124,126],{},"With ",[29,125,83],{}," from the release."," The same installer, with no Node.js at all:",[104,129,131],{"className":106,"code":130,"language":108,"meta":109,"style":109},"VERSION=0.14.0\ncurl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" | sh\n",[29,132,133,138],{"__ignoreMap":109},[113,134,135],{"class":115,"line":116},[113,136,137],{},"VERSION=0.14.0\n",[113,139,141],{"class":115,"line":140},2,[113,142,143],{},"curl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" | sh\n",[14,145,146,147,149,150,154,155,157],{},"A release reaches npm in a separate step after it is published on GitHub; for a version that is not on npm yet, use ",[29,148,83],{},". See ",[66,151,153],{"href":152},"#install-with-the-installer","Install with the installer"," for what it checks, its options, and how to run it without a terminal. A release without ",[29,156,83],{}," installs by hand.",[14,159,160,163],{},[24,161,162],{},"By hand."," These commands are the whole installation:",[104,165,167],{"className":106,"code":166,"language":108,"meta":109,"style":109},"VERSION=0.14.0\nBASE=\"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\"\n\n# 1. Download the bundle and its signature\ncurl -fsSLO \"${BASE}\u002Fbyodt-${VERSION}.tar.gz\"\ncurl -fsSLO \"${BASE}\u002Fbyodt-${VERSION}.tar.gz.bundle\"\n\n# 2. Verify the signature (needs cosign)\ncosign verify-blob \"byodt-${VERSION}.tar.gz\" \\\n  --bundle \"byodt-${VERSION}.tar.gz.bundle\" \\\n  --certificate-identity \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Ftags\u002Fv${VERSION}\" \\\n  --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com\n\n# 3. Extract it somewhere durable, and enter the directory\ntar xzf \"byodt-${VERSION}.tar.gz\"\ncd \"byodt-${VERSION}\"\n\n# 4. Start it (first-run setup included)\n.\u002Fbyodt up\n\n# 5. Open the console and check for a Healthy verdict\n.\u002Fbyodt console\n",[29,168,169,173,178,185,191,197,203,208,214,220,226,232,238,243,249,255,261,266,272,278,283,289],{"__ignoreMap":109},[113,170,171],{"class":115,"line":116},[113,172,137],{},[113,174,175],{"class":115,"line":140},[113,176,177],{},"BASE=\"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\"\n",[113,179,181],{"class":115,"line":180},3,[113,182,184],{"emptyLinePlaceholder":183},true,"\n",[113,186,188],{"class":115,"line":187},4,[113,189,190],{},"# 1. Download the bundle and its signature\n",[113,192,194],{"class":115,"line":193},5,[113,195,196],{},"curl -fsSLO \"${BASE}\u002Fbyodt-${VERSION}.tar.gz\"\n",[113,198,200],{"class":115,"line":199},6,[113,201,202],{},"curl -fsSLO \"${BASE}\u002Fbyodt-${VERSION}.tar.gz.bundle\"\n",[113,204,206],{"class":115,"line":205},7,[113,207,184],{"emptyLinePlaceholder":183},[113,209,211],{"class":115,"line":210},8,[113,212,213],{},"# 2. Verify the signature (needs cosign)\n",[113,215,217],{"class":115,"line":216},9,[113,218,219],{},"cosign verify-blob \"byodt-${VERSION}.tar.gz\" \\\n",[113,221,223],{"class":115,"line":222},10,[113,224,225],{},"  --bundle \"byodt-${VERSION}.tar.gz.bundle\" \\\n",[113,227,229],{"class":115,"line":228},11,[113,230,231],{},"  --certificate-identity \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Ftags\u002Fv${VERSION}\" \\\n",[113,233,235],{"class":115,"line":234},12,[113,236,237],{},"  --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com\n",[113,239,241],{"class":115,"line":240},13,[113,242,184],{"emptyLinePlaceholder":183},[113,244,246],{"class":115,"line":245},14,[113,247,248],{},"# 3. Extract it somewhere durable, and enter the directory\n",[113,250,252],{"class":115,"line":251},15,[113,253,254],{},"tar xzf \"byodt-${VERSION}.tar.gz\"\n",[113,256,258],{"class":115,"line":257},16,[113,259,260],{},"cd \"byodt-${VERSION}\"\n",[113,262,264],{"class":115,"line":263},17,[113,265,184],{"emptyLinePlaceholder":183},[113,267,269],{"class":115,"line":268},18,[113,270,271],{},"# 4. Start it (first-run setup included)\n",[113,273,275],{"class":115,"line":274},19,[113,276,277],{},".\u002Fbyodt up\n",[113,279,281],{"class":115,"line":280},20,[113,282,184],{"emptyLinePlaceholder":183},[113,284,286],{"class":115,"line":285},21,[113,287,288],{},"# 5. Open the console and check for a Healthy verdict\n",[113,290,292],{"class":115,"line":291},22,[113,293,294],{},".\u002Fbyodt console\n",[296,297,301],"blockquote",{"className":298},[299,300],"callout","callout-note",[14,302,303,306,307,310,311,314,315,319],{},[24,304,305],{},"Important:"," Two choices cannot easily be changed after the first start: the ",[24,308,309],{},"database engine"," (Memgraph or Neo4j) and, on a VM-backed runtime, ",[24,312,313],{},"where the database stores its data",". A VM-backed runtime is one that runs containers in a virtual machine, such as Docker Desktop, or a Podman machine on macOS or Windows; Docker Engine or Podman running directly on Linux is not. If either choice applies to you, read ",[66,316,318],{"href":317},"#optional-choose-your-settings-first","Optional: choose your settings first"," before step 4.",[296,321,323],{"className":322},[299,300],[14,324,325,328,329,333],{},[24,326,327],{},"Note:"," If the machine reaches the internet only through an outbound proxy, these commands are not enough on their own. Follow ",[66,330,332],{"href":331},"#behind-an-outbound-proxy","Behind an outbound proxy"," instead.",[14,335,336],{},"The rest of this guide walks through each step, explains what the first start does, and shows what a healthy deployment looks like.",[55,338],{},[58,340,342],{"id":341},"before-you-start","Before you start",[344,345,346],"h3",{"id":69},"Requirements",[348,349,355],"div",{"className":350,"tabIndex":352,"role":353,"ariaLabel":354},[351],"table-frame",0,"region","Table: Requirements",[356,357,358,371],"table",{},[359,360,361],"thead",{},[362,363,364,368],"tr",{},[365,366,367],"th",{},"Requirement",[365,369,370],{},"What you need",[372,373,374,399,413,435,453,467,499,513,553],"tbody",{},[362,375,376,382],{},[377,378,379],"td",{},[24,380,381],{},"Container engine",[377,383,384,387,388,391,392,395,396,77],{},[24,385,386],{},"Docker"," with the Compose plugin, ",[24,389,390],{},"or"," ",[24,393,394],{},"Podman 4.1+"," with a Compose provider. Podman brokers to Docker Compose v2 when it is present, otherwise to ",[29,397,398],{},"podman-compose",[362,400,401,406],{},[377,402,403],{},[24,404,405],{},"Disk",[377,407,408,409,412],{},"Several gigabytes free in the directory you extract the bundle into: four container images, the embedding model's weights (about 1.26 GB in ",[29,410,411],{},"data\u002Fmodels","), the database's data, and the reference data.",[362,414,415,420],{},[377,416,417],{},[24,418,419],{},"Memory",[377,421,422,423,426,427,430,431,434],{},"Enough for the database plus the platform. Memgraph runs with a ",[24,424,425],{},"4096 MiB"," memory limit — the measured floor for the reference-data ingest. Neo4j runs with a ",[24,428,429],{},"2 GB"," heap and a ",[24,432,433],{},"1 GB"," page cache, plus what the JVM needs beyond those. The platform holds the embedding model in memory, which adds roughly 0.8–0.9 GiB.",[362,436,437,442],{},[377,438,439],{},[24,440,441],{},"CPU",[377,443,444,445,448,449,102],{},"No fixed minimum. The timings in this guide are for a 4-vCPU host, which matches the embedder's default of 4 inference threads (",[29,446,447],{},"EMBEDDING_THREADS","; see ",[66,450,452],{"href":451},"\u002Fbyodt-cloud\u002Fconfiguration#embedding","Configuration → Embedding",[362,454,455,460],{},[377,456,457],{},[24,458,459],{},"Network (first start and upgrades)",[377,461,462,463,77],{},"Access to the container registries, GitHub release assets, and Hugging Face, directly or through an outbound proxy. See ",[66,464,466],{"href":465},"#network-access-for-the-first-start","Network access for the first start",[362,468,469,474],{},[377,470,471],{},[24,472,473],{},"For the installer",[377,475,476,477,479,480,479,483,486,487,490,491,494,495,498],{},"Linux or macOS (on Windows, inside WSL), with ",[29,478,108],{},", ",[29,481,482],{},"tar",[29,484,485],{},"curl"," (or ",[29,488,489],{},"wget","), and ",[29,492,493],{},"sha256sum"," or ",[29,496,497],{},"shasum",". Through npx, Node.js 18 or later too, to run the installer only.",[362,500,501,506],{},[377,502,503],{},[24,504,505],{},"Node.js",[377,507,508,509,512],{},"Not needed by the deployment: its services run in containers, and ",[29,510,511],{},"byodt"," is a shell script. Only the npx way of running the installer needs Node.js on the host.",[362,514,515,522],{},[377,516,517],{},[24,518,519,520],{},"For ",[29,521,511],{},[377,523,524,494,526,528,529,531,532,479,535,479,538,494,541,544,545,548,549,77],{},[29,525,493],{},[29,527,497],{}," too. ",[29,530,511],{}," needs one to record your confirmation of the third-party notice, and to upgrade; other commands do not. Without one, the notice counts as not yet confirmed, so a first start, and any ",[29,533,534],{},"up",[29,536,537],{},"update",[29,539,540],{},"restart",[29,542,543],{},"models pull"," run at a terminal or with ",[29,546,547],{},"--yes",", asks for it and then stops. See ",[66,550,552],{"href":551},"\u002Fbyodt-cloud\u002Ftroubleshooting#neither-sha256sum-nor-shasum-is-installed","Troubleshooting",[362,554,555,560],{},[377,556,557],{},[24,558,559],{},"Optional tools",[377,561,562,567,568,571,572,574],{},[66,563,566],{"href":564,"rel":565},"https:\u002F\u002Fgithub.com\u002Fsigstore\u002Fcosign",[75],"cosign"," to verify the bundle's signature; the installer and ",[29,569,570],{},".\u002Fbyodt upgrade"," use it when it is installed. ",[29,573,485],{}," for the health checks.",[296,576,579],{"className":577},[299,578],"callout-warning",[14,580,581,584,585,589],{},[24,582,583],{},"Warning:"," If you run a VM-backed runtime — one that runs containers in a virtual machine, such as Docker Desktop, or a Podman machine on macOS or Windows — the memory that counts is the memory the ",[586,587,588],"em",{},"virtual machine"," is allowed, not the host's. If the VM is capped at 4 GB or less, raise it in the runtime's settings before you start. The reference-data ingest is deliberately not retried when the database runs out of memory. Docker Engine on Linux runs containers directly on the host, so the host's memory is what counts there.",[344,591,593],{"id":592},"check-your-container-engine","Check your container engine",[14,595,596,597,600],{},"The control script runs ",[29,598,599],{},"\u003Cengine> compose",", so that exact command must work. Check whichever engine you have:",[104,602,604],{"className":106,"code":603,"language":108,"meta":109,"style":109},"docker compose version\n",[29,605,606],{"__ignoreMap":109},[113,607,608],{"class":115,"line":116},[113,609,603],{},[104,611,613],{"className":106,"code":612,"language":108,"meta":109,"style":109},"podman compose version\n",[29,614,615],{"__ignoreMap":109},[113,616,617],{"class":115,"line":116},[113,618,612],{},[14,620,621],{},"Use whichever prints a version. If neither does, install the missing piece: a bare engine without a Compose provider is not enough.",[14,623,624,625,628,629,632,633,77],{},"On the first start, the script detects the engine (Docker first, then Podman) and records the choice in ",[29,626,627],{},".env"," as ",[29,630,631],{},"CONTAINER_ENGINE",", so every later command uses the same one. To force a specific engine, see ",[66,634,636],{"href":635},"\u002Fbyodt-cloud\u002Fconfiguration#container-engine","Configuration → Container engine",[344,638,640],{"id":639},"podman-specifics","Podman specifics",[14,642,643,644,646,647,649,650,654],{},"Podman works fully, with Docker Compose v2 or with ",[29,645,398],{},": installing, backing up, restoring and upgrading included. (An upgrade from 0.12.x or 0.13.0 on Memgraph and ",[29,648,398],{}," needs one step by hand; see ",[66,651,653],{"href":652},"\u002Fbyodt-cloud\u002Foperations#upgrading-on-podman","Operations → Upgrading on Podman",".) Four things to know:",[656,657,658,683,691,697],"ol",{},[21,659,660,663,664,673,676,677,679,680,77],{},[24,661,662],{},"On macOS, start the machine first."," Podman runs containers inside a virtual machine that is not started for you:",[104,665,667],{"className":106,"code":666,"language":108,"meta":109,"style":109},"podman machine start\n",[29,668,669],{"__ignoreMap":109},[113,670,671],{"class":115,"line":116},[113,672,666],{},[674,675],"br",{},"Without it, every ",[29,678,511],{}," command stops with an error saying that the engine's compose is not usable. See ",[66,681,552],{"href":682},"\u002Fbyodt-cloud\u002Ftroubleshooting#no-usable-container-engine",[21,684,685,688,689,77],{},[24,686,687],{},"Use the named volume for database storage on a VM-backed runtime."," On macOS or Windows, a Podman machine is one; see the warning in ",[66,690,318],{"href":317},[21,692,693,696],{},[24,694,695],{},"Rootless is expected."," The containers write into the bundle's runtime directories under an unprivileged user id that does not match yours, so the control script creates those directories world-writable on every start. You do not need to do anything. Do not tighten them by hand: the next start widens them again.",[21,698,699,702,703,705,706,709,710,713,714,716,717,720,721,724,725,727,728,731,732,734,735,737,738,747,749,750,752,753,77],{},[24,700,701],{},"On a host that also has Docker, choose the Compose provider."," This applies when ",[29,704,511],{}," runs Podman: with ",[29,707,708],{},"CONTAINER_ENGINE=podman",", or when Docker's ",[29,711,712],{},"docker compose"," does not work, since ",[29,715,511],{}," tries Docker first. ",[29,718,719],{},"podman compose"," runs Docker's ",[29,722,723],{},"docker-compose"," when it finds it, and ",[29,726,723],{}," reaches Podman only through the Podman API socket. Without the socket running, the first start fails with a message such as ",[29,729,730],{},"failed to connect to the docker API at unix:\u002F\u002F\u002Frun\u002Fuser\u002F\u003Cuid>\u002Fpodman\u002Fpodman.sock",". To have Podman use ",[29,733,398],{},", set this in the shell you run ",[29,736,511],{}," from, and in your shell profile so that it stays set:",[104,739,741],{"className":106,"code":740,"language":108,"meta":109,"style":109},"export PODMAN_COMPOSE_PROVIDER=podman-compose\n",[29,742,743],{"__ignoreMap":109},[113,744,745],{"class":115,"line":116},[113,746,740],{},[674,748],{},"Or keep ",[29,751,723],{}," and start the socket: ",[29,754,755],{},"systemctl --user start podman.socket",[344,757,466],{"id":758},"network-access-for-the-first-start",[14,760,761],{},"The first start needs to reach these destinations, directly or through an outbound proxy. Behind a proxy, the proxy must allow the hosts in the second column. They are the hosts seen at the time of writing; the services behind them can change them.",[348,763,766],{"className":764,"tabIndex":352,"role":353,"ariaLabel":765},[351],"Table: Network access for the first start",[356,767,768,781],{},[359,769,770],{},[362,771,772,775,778],{},[365,773,774],{},"Destination",[365,776,777],{},"Hosts the proxy must allow",[365,779,780],{},"What for",[372,782,783,801,820,840,856,877],{},[362,784,785,790,798],{},[377,786,787],{},[24,788,789],{},"GitHub's container registry",[377,791,792,479,795],{},[29,793,794],{},"ghcr.io",[29,796,797],{},"pkg-containers.githubusercontent.com",[377,799,800],{},"The platform and console images.",[362,802,803,809,817],{},[377,804,805,808],{},[24,806,807],{},"The publishers' registries"," (Docker Hub by default)",[377,810,811,479,814],{},[29,812,813],{},"registry-1.docker.io",[29,815,816],{},"auth.docker.io",[377,818,819],{},"The database and front-door images.",[362,821,822,830,837],{},[377,823,824,829],{},[24,825,826],{},[29,827,828],{},"github.com"," and its release-asset host",[377,831,832,479,834],{},[29,833,828],{},[29,835,836],{},"release-assets.githubusercontent.com",[377,838,839],{},"The bundle and its signature, and the signed module payloads for the release you are installing.",[362,841,842,848,853],{},[377,843,844,847],{},[24,845,846],{},"The npm registry",", only when you install with npx",[377,849,850],{},[29,851,852],{},"registry.npmjs.org",[377,854,855],{},"The installer's npm package.",[362,857,858,866,874],{},[377,859,860,865],{},[24,861,862],{},[29,863,864],{},"huggingface.co"," and the host it redirects downloads to",[377,867,868,870,871],{},[29,869,864],{},", and its download host, for example ",[29,872,873],{},"us.aws.cdn.hf.co",[377,875,876],{},"The embedding model's weights. The platform verifies each file's sha256 before it uses it.",[362,878,879,885,888],{},[377,880,881,884],{},[24,882,883],{},"In cloud mode:"," the content service and identity provider your cloud connection names",[377,886,887],{},"Their hosts",[377,889,890],{},"Sign-in, content packages, and the knowledge graph. Needed in use, not only on the first start.",[14,892,893],{},"About the second column:",[18,895,896,906,912,931],{},[21,897,898,901,902,905],{},[24,899,900],{},"The model's download host can vary."," The hub redirects each download to a CDN host, and a machine elsewhere can be sent to another one. Allow the one your machine is sent to; ",[29,903,904],{},".\u002Fbyodt models pull"," names it when it is blocked.",[21,907,908,911],{},[24,909,910],{},"Docker Hub layers."," The host Docker Hub downloads image layers from is not listed here. Check your registry's documentation, or your mirror's, for the hosts a first pull needs.",[21,913,914,917,918,479,921,479,924,479,927,930],{},[24,915,916],{},"A mirror replaces the registry."," An image you repoint at a registry you operate (",[29,919,920],{},"DB_IMAGE",[29,922,923],{},"NEO4J_IMAGE",[29,925,926],{},"PROXY_IMAGE",[29,928,929],{},"CONSOLE_IMAGE",") comes from that registry's host instead.",[21,932,933,936],{},[24,934,935],{},"cosign runs in your shell, not in the deployment."," It may need to reach Sigstore's public services on first use.",[14,938,939],{},"Module signatures are verified offline: the trusted root is embedded in the console image, so no signing service is contacted.",[14,941,942,943,946,947,950],{},"Later starts need none of this until the next upgrade, which pulls new images, fetches the new release's modules, and may download new weights. ",[29,944,945],{},"console-init"," still asks the release host on every start. When it cannot reach it, the console reports ",[24,948,949],{},"Module Fetch Failed",", and the modules already on disk stay in use. In cloud mode, the content service and the identity provider are needed all along.",[14,952,953],{},"If the machine sits behind an allowlist, open these destinations before the first start rather than debugging a half-finished one.",[296,955,957],{"className":956},[299,300],[14,958,959,961,962,964,965,77],{},[24,960,327],{}," If the machine reaches the internet only through an outbound proxy, follow ",[66,963,332],{"href":331}," before you start. If it has no internet access at all, place the weights by hand; see ",[66,966,968],{"href":967},"#hosts-without-internet-access","Hosts without internet access",[55,970],{},[58,972,332],{"id":973},"behind-an-outbound-proxy",[14,975,976],{},"Skip this section if the machine reaches the internet directly.",[14,978,979],{},"If its only way out is an HTTP proxy, set the proxy up in the order below. Three different places hold the setting, and each step checks one path through the proxy before the next step depends on it.",[348,981,984],{"className":982,"tabIndex":352,"role":353,"ariaLabel":983},[351],"Table: Behind an outbound proxy",[356,985,986,999],{},[359,987,988],{},[362,989,990,993,996],{},[365,991,992],{},"Step",[365,994,995],{},"What goes through the proxy",[365,997,998],{},"Where the setting lives",[372,1000,1001,1015,1032,1057,1071],{},[362,1002,1003,1009,1012],{},[377,1004,1005],{},[66,1006,1008],{"href":1007},"#_1-give-the-container-engine-the-proxy","1",[377,1010,1011],{},"Image pulls",[377,1013,1014],{},"The container engine's own configuration",[362,1016,1017,1023,1026],{},[377,1018,1019],{},[66,1020,1022],{"href":1021},"#_2-get-the-bundle-through-the-proxy","2",[377,1024,1025],{},"Downloading and verifying the bundle",[377,1027,1028,1031],{},[29,1029,1030],{},"HTTPS_PROXY"," in your shell",[362,1033,1034,1040,1045],{},[377,1035,1036],{},[66,1037,1039],{"href":1038},"#_3-set-the-proxy-for-the-deployment","3",[377,1041,1042,1044],{},[29,1043,945],{},", the platform and the console",[377,1046,1047,479,1049,1052,1053,1056],{},[29,1048,627],{},[29,1050,1051],{},".env.secrets"," and ",[29,1054,1055],{},"proxy-ca\u002F"," in the bundle",[362,1058,1059,1065,1068],{},[377,1060,1061],{},[66,1062,1064],{"href":1063},"#_4-test-it-with-the-model-download","4",[377,1066,1067],{},"The model download, as a test",[377,1069,1070],{},"Step 3's setting",[362,1072,1073,1079,1082],{},[377,1074,1075],{},[66,1076,1078],{"href":1077},"#_5-start-the-deployment","5",[377,1080,1081],{},"The first start",[377,1083,1084],{},"Steps 1 and 3",[296,1086,1088],{"className":1087},[299,300],[14,1089,1090,1092],{},[24,1091,327],{}," Proxies that need NTLM or Kerberos login are not supported: Go and Node, which the deployment's services run on, support neither.",[14,1094,1095,1096,77],{},"The full reference for the deployment's own setting is ",[66,1097,1099],{"href":1098},"\u002Fbyodt-cloud\u002Fconfiguration#outbound-proxy","Configuration → Outbound proxy",[344,1101,1103],{"id":1102},"_1-give-the-container-engine-the-proxy","1. Give the container engine the proxy",[14,1105,1106,1107,1109],{},"Your container engine pulls the images itself. It never reads the deployment's ",[29,1108,627],{},", so it needs a proxy setting of its own.",[14,1111,1112,1115],{},[24,1113,1114],{},"Docker."," The Docker daemon pulls, and it reads only its own proxy setting, never your shell's. Set it in one of two places:",[18,1117,1118,1183],{},[21,1119,1120,1123,1124,1127,1128,1164,1166,1167,1170,1171,1174,1175,1178,1179,1182],{},[24,1121,1122],{},"A systemd drop-in",", for example ",[29,1125,1126],{},"\u002Fetc\u002Fsystemd\u002Fsystem\u002Fdocker.service.d\u002Fhttp-proxy.conf",":",[104,1129,1133],{"className":1130,"code":1131,"language":1132,"meta":109,"style":109},"language-ini shiki shiki-themes github-light github-dark-dimmed","[Service]\nEnvironment=\"HTTPS_PROXY=http:\u002F\u002Fproxy.example.internal:3128\"\nEnvironment=\"NO_PROXY=localhost,127.0.0.1\"\n","ini",[29,1134,1135,1141,1155],{"__ignoreMap":109},[113,1136,1137],{"class":115,"line":116},[113,1138,1140],{"class":1139},"sOLd2","[Service]\n",[113,1142,1143,1147,1151],{"class":115,"line":140},[113,1144,1146],{"class":1145},"s7YZ4","Environment",[113,1148,1150],{"class":1149},"sYgZi","=",[113,1152,1154],{"class":1153},"s-HuK","\"HTTPS_PROXY=http:\u002F\u002Fproxy.example.internal:3128\"\n",[113,1156,1157,1159,1161],{"class":115,"line":180},[113,1158,1146],{"class":1145},[113,1160,1150],{"class":1149},[113,1162,1163],{"class":1153},"\"NO_PROXY=localhost,127.0.0.1\"\n",[674,1165],{},"A ",[29,1168,1169],{},"%"," in a unit file is written ",[29,1172,1173],{},"%%",". A login percent-encoded as ",[29,1176,1177],{},"user:pa%23ss"," is therefore written ",[29,1180,1181],{},"user:pa%%23ss"," in the drop-in.",[21,1184,1185,1194,1195],{},[24,1186,1187,1190,1191],{},[29,1188,1189],{},"proxies"," in ",[29,1192,1193],{},"\u002Fetc\u002Fdocker\u002Fdaemon.json",", on Docker Engine 23.0 or later:",[104,1196,1200],{"className":1197,"code":1198,"language":1199,"meta":109,"style":109},"language-json shiki shiki-themes github-light github-dark-dimmed","{\n  \"proxies\": {\n    \"https-proxy\": \"http:\u002F\u002Fproxy.example.internal:3128\",\n    \"no-proxy\": \"localhost,127.0.0.1\"\n  }\n}\n","json",[29,1201,1202,1207,1216,1230,1240,1245],{"__ignoreMap":109},[113,1203,1204],{"class":115,"line":116},[113,1205,1206],{"class":1149},"{\n",[113,1208,1209,1213],{"class":115,"line":140},[113,1210,1212],{"class":1211},"snmFh","  \"proxies\"",[113,1214,1215],{"class":1149},": {\n",[113,1217,1218,1221,1224,1227],{"class":115,"line":180},[113,1219,1220],{"class":1211},"    \"https-proxy\"",[113,1222,1223],{"class":1149},": ",[113,1225,1226],{"class":1153},"\"http:\u002F\u002Fproxy.example.internal:3128\"",[113,1228,1229],{"class":1149},",\n",[113,1231,1232,1235,1237],{"class":115,"line":187},[113,1233,1234],{"class":1211},"    \"no-proxy\"",[113,1236,1223],{"class":1149},[113,1238,1239],{"class":1153},"\"localhost,127.0.0.1\"\n",[113,1241,1242],{"class":115,"line":193},[113,1243,1244],{"class":1149},"  }\n",[113,1246,1247],{"class":115,"line":199},[113,1248,1249],{"class":1149},"}\n",[14,1251,1252],{},"Then reload systemd, restart the daemon, and check what it reports:",[104,1254,1256],{"className":106,"code":1255,"language":108,"meta":109,"style":109},"sudo systemctl daemon-reload\nsudo systemctl restart docker\ndocker info --format '{{.HTTPSProxy}}'    # the proxy, with any login masked\n",[29,1257,1258,1263,1268],{"__ignoreMap":109},[113,1259,1260],{"class":115,"line":116},[113,1261,1262],{},"sudo systemctl daemon-reload\n",[113,1264,1265],{"class":115,"line":140},[113,1266,1267],{},"sudo systemctl restart docker\n",[113,1269,1270],{"class":115,"line":180},[113,1271,1272],{},"docker info --format '{{.HTTPSProxy}}'    # the proxy, with any login masked\n",[296,1274,1276],{"className":1275},[299,578],[14,1277,1278,1280,1281,1284,1285,494,1288,1291],{},[24,1279,583],{}," Restarting the Docker daemon stops every container on the host, unless ",[29,1282,1283],{},"live-restore"," is enabled. Containers set to restart ",[29,1286,1287],{},"always",[29,1289,1290],{},"unless-stopped",", as the deployment's services are, start again on their own. Restart any others yourself.",[296,1293,1295],{"className":1294},[299,300],[14,1296,1297,1299,1300,1303,1304,1307,1308,1311],{},[24,1298,327],{}," systemd shows a unit's environment to every local account (",[29,1301,1302],{},"systemctl show docker","). If the proxy needs a login, put it in ",[29,1305,1306],{},"daemon.json"," with mode ",[29,1309,1310],{},"0600"," rather than in a drop-in.",[14,1313,1314,1315,1317,1318,1320,1321,1324],{},"If you run Docker Desktop rather than Docker Engine, the systemd drop-in and ",[29,1316,1306],{}," above do not apply: set and check the proxy in Docker Desktop's own settings instead. ",[29,1319,511],{},"'s daemon check reads ",[29,1322,1323],{},"docker info",", which may not reflect that setting.",[14,1326,1327,1330,1331,1334],{},[24,1328,1329],{},"Podman."," Which process pulls depends on the Compose provider (see ",[66,1332,593],{"href":1333},"#check-your-container-engine","):",[18,1336,1337,1394],{},[21,1338,1339,1343,1344,1347,1348,1350,1351,1354,1355,1190,1358,1361,1362,1365,1366],{},[24,1340,123,1341],{},[29,1342,398],{},", the ",[29,1345,1346],{},"podman"," command pulls, under your account. It follows ",[29,1349,1030],{}," in your shell, or ",[29,1352,1353],{},"env"," under ",[29,1356,1357],{},"[engine]",[29,1359,1360],{},"containers.conf"," (",[29,1363,1364],{},"~\u002F.config\u002Fcontainers\u002Fcontainers.conf"," for rootless Podman):",[104,1367,1371],{"className":1368,"code":1369,"language":1370,"meta":109,"style":109},"language-toml shiki shiki-themes github-light github-dark-dimmed","[engine]\nenv = [\"https_proxy=http:\u002F\u002Fproxy.example.internal:3128\"]\n","toml",[29,1372,1373,1384],{"__ignoreMap":109},[113,1374,1375,1378,1381],{"class":115,"line":116},[113,1376,1377],{"class":1149},"[",[113,1379,1380],{"class":1139},"engine",[113,1382,1383],{"class":1149},"]\n",[113,1385,1386,1389,1392],{"class":115,"line":140},[113,1387,1388],{"class":1149},"env = [",[113,1390,1391],{"class":1153},"\"https_proxy=http:\u002F\u002Fproxy.example.internal:3128\"",[113,1393,1383],{"class":1149},[21,1395,1396,1399,1400,1403,1404,1407,1408,1411,1412],{},[24,1397,1398],{},"With Docker Compose v2",", the Podman API service (",[29,1401,1402],{},"podman.service",", started by ",[29,1405,1406],{},"podman.socket",") pulls. It follows its systemd unit's environment. Add the same ",[29,1409,1410],{},"[Service]"," lines as for Docker, then restart it:",[104,1413,1415],{"className":106,"code":1414,"language":108,"meta":109,"style":109},"systemctl --user edit podman.service      # rootless Podman; add the [Service] lines\nsystemctl --user restart podman.service\n",[29,1416,1417,1422],{"__ignoreMap":109},[113,1418,1419],{"class":115,"line":116},[113,1420,1421],{},"systemctl --user edit podman.service      # rootless Podman; add the [Service] lines\n",[113,1423,1424],{"class":115,"line":140},[113,1425,1426],{},"systemctl --user restart podman.service\n",[14,1428,1429,1431],{},[29,1430,511],{}," checks the Docker daemon's setting, and warns when it is missing (step 5). It does not check Podman's.",[14,1433,1434,1441,1442,1444,1445,1190,1448,1450],{},[24,1435,1436,1437,1440],{},"Do not use ",[29,1438,1439],{},"~\u002F.docker\u002Fconfig.json"," for this."," Its ",[29,1443,1189],{}," setting does not configure pulls. Instead, the Docker client copies it into every container it creates. The deployment sets every proxy variable of its own containers explicitly, so the copy no longer reaches them, but it still reaches any other container you run. Podman copies your shell's proxy variables into containers by default (",[29,1446,1447],{},"http_proxy = true",[29,1449,1360],{},"); the same explicit values keep them out of the deployment's containers.",[14,1452,1453,1456,1457,1460,1461,1464,1465,1468,1469,1471],{},[24,1454,1455],{},"If the proxy inspects TLS",", the engine must trust the proxy's CA as well. Add the CA to the host's trust store (on Debian or Ubuntu, copy it into ",[29,1458,1459],{},"\u002Fusr\u002Flocal\u002Fshare\u002Fca-certificates\u002F"," as a ",[29,1462,1463],{},".crt"," file and run ",[29,1466,1467],{},"sudo update-ca-certificates","), then restart the Docker daemon or the Podman API service. The deployment's own ",[29,1470,1055],{}," (step 3) does not reach the engine.",[14,1473,1474,1477,1478,1481],{},[24,1475,1476],{},"Check it"," with a plain pull of two images the deployment uses. The console's tag is the release's version, as in the commands above; use ",[29,1479,1480],{},"podman pull"," on Podman:",[104,1483,1485],{"className":106,"code":1484,"language":108,"meta":109,"style":109},"docker pull ghcr.io\u002Fdether-net\u002Fbyodt-console:0.14.0\ndocker pull docker.io\u002Fnginx:1.27-alpine\n",[29,1486,1487,1492],{"__ignoreMap":109},[113,1488,1489],{"class":115,"line":116},[113,1490,1491],{},"docker pull ghcr.io\u002Fdether-net\u002Fbyodt-console:0.14.0\n",[113,1493,1494],{"class":115,"line":140},[113,1495,1496],{},"docker pull docker.io\u002Fnginx:1.27-alpine\n",[14,1498,1499,1500,1502,1503,1506],{},"The second is the front-door image. ",[29,1501,926],{}," in the release's ",[29,1504,1505],{},".env.example"," names the tag it uses.",[344,1508,1510],{"id":1509},"_2-get-the-bundle-through-the-proxy","2. Get the bundle through the proxy",[14,1512,1513,1052,1515,1517,1518,1520,1521,1525],{},[29,1514,485],{},[29,1516,566],{}," run in your shell and follow ",[29,1519,1030],{}," there. Export it, then follow ",[66,1522,1524],{"href":1523},"#get-the-bundle","Get the bundle"," as written:",[104,1527,1529],{"className":106,"code":1528,"language":108,"meta":109,"style":109},"export HTTPS_PROXY=http:\u002F\u002Fproxy.example.internal:3128\n",[29,1530,1531],{"__ignoreMap":109},[113,1532,1533],{"class":115,"line":116},[113,1534,1528],{},[14,1536,1537,1539],{},[29,1538,566],{}," may need to reach Sigstore's public services on first use.",[14,1541,1542,1543,1546],{},"If the proxy needs a login, put it in the URL, percent-encoded: ",[29,1544,1545],{},"http:\u002F\u002Fuser:password@proxy.example.internal:3128",". Typed on the command line, it lands in your shell's history. To keep it out, read the login into a variable without echoing it, then build the URL from it:",[104,1548,1550],{"className":106,"code":1549,"language":108,"meta":109,"style":109},"read -rs PROXY_LOGIN    # type user:password, percent-encoded, then Enter\nexport HTTPS_PROXY=\"http:\u002F\u002F${PROXY_LOGIN}@proxy.example.internal:3128\"\nunset PROXY_LOGIN\n",[29,1551,1552,1557,1562],{"__ignoreMap":109},[113,1553,1554],{"class":115,"line":116},[113,1555,1556],{},"read -rs PROXY_LOGIN    # type user:password, percent-encoded, then Enter\n",[113,1558,1559],{"class":115,"line":140},[113,1560,1561],{},"export HTTPS_PROXY=\"http:\u002F\u002F${PROXY_LOGIN}@proxy.example.internal:3128\"\n",[113,1563,1564],{"class":115,"line":180},[113,1565,1566],{},"unset PROXY_LOGIN\n",[14,1568,1569,1570,1573,1574,1576],{},"The login then sits in your shell's environment. Run ",[29,1571,1572],{},"unset HTTPS_PROXY"," when you are done, unless ",[29,1575,398],{}," pulls with it (step 1).",[14,1578,1579,1580,1582,1583,1586,1587,1590,1591,1593,1594,77],{},"The installer follows the same ",[29,1581,1030],{},", login included, and hands the proxy URL to ",[29,1584,1585],{},".\u002Fbyodt setup"," as its ",[29,1588,1589],{},"--https-proxy",", so setup writes it into ",[29,1592,627],{}," without asking for it; of the login, setup only offers to save it (step 3). See ",[66,1595,1597],{"href":1596},"#through-an-outbound-proxy","Install with the installer → Through an outbound proxy",[14,1599,1600,1601,1603,1604,1606,1607,1609],{},"The deployment does not use this shell value. It uses only the proxy ",[29,1602,627],{}," names (step 3). When your shell sets a different one, ",[29,1605,511],{}," prints a notice, with any login masked, and goes on with ",[29,1608,627],{},"'s:",[104,1611,1616],{"className":1612,"code":1614,"language":1615},[1613],"language-text","==> Your shell sets HTTPS_PROXY (…); the stack uses only the one in .env (…). Set HTTPS_PROXY in .env to change it.\n","text",[29,1617,1614],{"__ignoreMap":109},[344,1619,1621],{"id":1620},"_3-set-the-proxy-for-the-deployment","3. Set the proxy for the deployment",[14,1623,1624,1628,1629,1052,1631,1634,1635,1637,1638,1640,1641,1643,1644,1650],{},[24,1625,123,1626],{},[29,1627,1585],{}," (the installer runs it for you), answer its proxy questions, or give its proxy flags: it writes ",[29,1630,1030],{},[29,1632,1633],{},"NO_PROXY"," into ",[29,1636,627],{},", the login into ",[29,1639,1051],{},", and the CA into ",[29,1642,1055],{},", and checks them as every later command does. See ",[66,1645,1647,1648],{"href":1646},"#set-up-with-byodt-setup","Set up with ",[29,1649,1585],{},". Then go on with step 4. The rest of this step does the same by hand.",[14,1652,1653,1654,1656,1657,1659,1660,1662],{},"From the bundle directory, create ",[29,1655,627],{}," first. The first start creates it from ",[29,1658,1505],{}," only when it is missing, and a ",[29,1661,627],{}," without the proxy sends everything direct:",[104,1664,1666],{"className":106,"code":1665,"language":108,"meta":109,"style":109},"cp .env.example .env\n",[29,1667,1668],{"__ignoreMap":109},[113,1669,1670],{"class":115,"line":116},[113,1671,1665],{},[14,1673,1674,1677,1678,1680,1681,1683],{},[24,1675,1676],{},"The proxy."," In ",[29,1679,627],{},", set ",[29,1682,1030],{},". The \"Outbound proxy\" section of the file has the line commented out:",[104,1685,1688],{"className":1686,"code":1687,"language":1615},[1613],"HTTPS_PROXY=http:\u002F\u002Fproxy.example.internal:3128\n",[29,1689,1687],{"__ignoreMap":109},[18,1691,1692,1703,1712,1721],{},[21,1693,1694,1695,1698,1699,1702],{},"Write it as ",[29,1696,1697],{},"http:\u002F\u002Fhost:port",". Most proxies take ",[29,1700,1701],{},"http:\u002F\u002F"," here. The scheme is only how the services talk to the proxy; the HTTPS connections they make through it stay HTTPS.",[21,1704,1436,1705,494,1708,1711],{},[29,1706,1707],{},"localhost",[29,1709,1710],{},"127.0.0.1",": inside a container, that is the container itself. For a proxy on this host, use the host's address on the network the proxy listens on. The name must resolve inside the containers.",[21,1713,1714,1715,1717,1718,1720],{},"Leave the login out. ",[29,1716,511],{}," refuses a ",[29,1719,627],{}," proxy URL that carries one.",[21,1722,1723,1724,1726,1727,1730,1731,77],{},"Add ",[29,1725,1633],{}," only for hosts the deployment calls that must bypass the proxy, such as a LangGraph server on ",[29,1728,1729],{},"https:\u002F\u002F",". List exact host names: an entry does not cover its subdomains. See ",[66,1732,1099],{"href":1098},[14,1734,1735,1738,1739,1741,1742,1744],{},[24,1736,1737],{},"The login",", if the proxy needs one, goes in ",[29,1740,1051],{},", never in ",[29,1743,627],{},". Create the file readable by you only, if it does not exist yet:",[104,1746,1748],{"className":106,"code":1747,"language":108,"meta":109,"style":109},"touch .env.secrets && chmod 0600 .env.secrets\n",[29,1749,1750],{"__ignoreMap":109},[113,1751,1752],{"class":115,"line":116},[113,1753,1747],{},[14,1755,1756,1757,628,1760,479,1763,628,1766,479,1769,628,1771,1774,1775,1334],{},"Then add this line with an editor, with the user name and the password percent-encoded (",[29,1758,1759],{},"#",[29,1761,1762],{},"%23",[29,1764,1765],{},"@",[29,1767,1768],{},"%40",[29,1770,1127],{},[29,1772,1773],{},"%3A","; the full list is in ",[66,1776,1778],{"href":1777},"\u002Fbyodt-cloud\u002Fconfiguration#the-outbound-proxys-login","Configuration → The outbound proxy's login",[104,1780,1783],{"className":1781,"code":1782,"language":1615},[1613],"HTTPS_PROXY_USERINFO=user:password\n",[29,1784,1782],{"__ignoreMap":109},[14,1786,1787],{},"The first start adds the database password to the same file and keeps your line.",[14,1789,1790,1793,1794,1797],{},[24,1791,1792],{},"The CA",", if the proxy inspects TLS (it re-signs every HTTPS connection with a CA of its own). Put the CA certificate in ",[29,1795,1796],{},"proxy-ca\u002Fproxy-ca.pem",", the only file in that directory:",[104,1799,1801],{"className":106,"code":1800,"language":108,"meta":109,"style":109},"mkdir -p -m 0755 proxy-ca\ncp \u002Fpath\u002Fto\u002Fthe-proxy-ca.pem proxy-ca\u002Fproxy-ca.pem\nchmod 0644 proxy-ca\u002Fproxy-ca.pem\n",[29,1802,1803,1808,1813],{"__ignoreMap":109},[113,1804,1805],{"class":115,"line":116},[113,1806,1807],{},"mkdir -p -m 0755 proxy-ca\n",[113,1809,1810],{"class":115,"line":140},[113,1811,1812],{},"cp \u002Fpath\u002Fto\u002Fthe-proxy-ca.pem proxy-ca\u002Fproxy-ca.pem\n",[113,1814,1815],{"class":115,"line":180},[113,1816,1817],{},"chmod 0644 proxy-ca\u002Fproxy-ca.pem\n",[14,1819,1820,1822,1823,1825,1826,1829],{},[29,1821,511],{}," creates ",[29,1824,1055],{}," on the first run anyway; ",[29,1827,1828],{},"mkdir -p"," lets you place the file before that, and changes nothing when the directory is already there.",[296,1831,1833],{"className":1832},[299,578],[14,1834,1835,1837,1838,77],{},[24,1836,583],{}," Trusting that CA lets whoever holds its key read and change everything the deployment sends over TLS. That includes the signing keys sign-ins are checked against, so they can sign anyone in. First ask the proxy's operators to pass the identity provider and the content service through uninspected; use the CA file only if they cannot. See ",[66,1839,1841],{"href":1840},"\u002Fbyodt-cloud\u002Fconfiguration#a-proxy-that-inspects-tls","Configuration → A proxy that inspects TLS",[344,1843,1845],{"id":1844},"_4-test-it-with-the-model-download","4. Test it with the model download",[104,1847,1849],{"className":106,"code":1848,"language":108,"meta":109,"style":109},".\u002Fbyodt models pull\n",[29,1850,1851],{"__ignoreMap":109},[113,1852,1853],{"class":115,"line":116},[113,1854,1848],{},[14,1856,1857,1858,1860],{},"This is the first call through the deployment's proxy setting, before anything else starts. It runs the platform's own download code with the platform's environment: the proxy, its login, ",[29,1859,1633],{}," and the CA file. It downloads the embedding model's weights (about 1.26 GB) from the model hub and its download host, so the first start then skips that step.",[14,1862,1863,1866,1867,1870,1871,1874,1875,1878,1879,1882,1883,1886,1887,77],{},[24,1864,1865],{},"Result:"," it ends with ",[29,1868,1869],{},"Ready: the platform loads the model from there without downloading it."," On a failure, the message names the host that failed, for example ",[29,1872,1873],{},"The weights could not be placed: …: request to \u003Chost> failed: fetch failed",". That is all its own output shows of a network failure. The underlying cause appears only when the platform downloads the model itself, on a start: ",[29,1876,1877],{},".\u002Fbyodt logs platform"," then shows it as the ",[29,1880,1881],{},"cause"," of each ",[29,1884,1885],{},"weight acquisition failed, retrying"," entry. See ",[66,1888,1890],{"href":1889},"\u002Fbyodt-cloud\u002Ftroubleshooting#behind-an-outbound-proxy","Troubleshooting → Behind an outbound proxy",[14,1892,1893,1895,1896,1898],{},[29,1894,543],{}," also performs first-run setup, so ",[29,1897,627],{}," must hold the proxy before you run it (step 3).",[344,1900,1902],{"id":1901},"_5-start-the-deployment","5. Start the deployment",[104,1904,1905],{"className":106,"code":277,"language":108,"meta":109,"style":109},[29,1906,1907],{"__ignoreMap":109},[113,1908,1909],{"class":115,"line":116},[113,1910,277],{},[14,1912,1913,1914,1918,1919,1922,1923,1925],{},"Then check the deployment as in ",[66,1915,1917],{"href":1916},"#verify-the-deployment-is-healthy","Verify the deployment is healthy",". Every module reading ",[29,1920,1921],{},"placed"," in the console shows that ",[29,1924,945],{}," reached the release host through the proxy.",[14,1927,1928,1929,1931,1932,1052,1935,1938],{},"On Docker, when ",[29,1930,627],{}," names a proxy and the daemon has none, ",[29,1933,1934],{},".\u002Fbyodt up",[29,1936,1937],{},".\u002Fbyodt update"," warn before they pull:",[104,1940,1943],{"className":1941,"code":1942,"language":1615},[1613],"warning: HTTPS_PROXY is set in .env, but the Docker daemon has no proxy of its own, so image pulls go direct. If this host has no direct route out, set the daemon's proxy (a systemd drop-in, or \"proxies\" in daemon.json), restart it, and run the command again.\n",[29,1944,1942],{"__ignoreMap":109},[14,1946,1947],{},"The warning does not stop the start: a registry mirror on your own network pulls without a proxy. If yours does not, go back to step 1.",[55,1949],{},[58,1951,153],{"id":1952},"install-with-the-installer",[14,1954,1955,1956,1958,1959,1961,1962,1966,1967,77],{},"From the first release that ships it, each release publishes an installer, ",[29,1957,83],{},", beside its bundle; a release without one installs by hand (see ",[66,1960,1524],{"href":1523},"). It downloads that release's bundle, checks it, unpacks it into a new folder, and hands over to the bundle's own ",[66,1963,1964],{"href":1646},[29,1965,1585],{},". It also upgrades an existing deployment to its release; see ",[66,1968,1970],{"href":1969},"\u002Fbyodt-cloud\u002Foperations#upgrading-to-a-new-release","Operations → Upgrading to a new release",[14,1972,1973],{},"There are two ways to run it, and both run the same script, with the same options and the same questions:",[348,1975,1978],{"className":1976,"tabIndex":352,"role":353,"ariaLabel":1977},[351],"Table: Install with the installer",[356,1979,1980,1996],{},[359,1981,1982],{},[362,1983,1984,1987,1990],{},[365,1985,1986],{},"Way",[365,1988,1989],{},"Use it when",[365,1991,1992,1993],{},"Needs, beyond the ",[66,1994,1995],{"href":68},"installer's tools",[372,1997,1998,2017],{},[362,1999,2000,2007,2014],{},[377,2001,2002,2006],{},[66,2003,2005],{"href":2004},"#with-npx","With npx"," (recommended)",[377,2008,2009,2010,2013],{},"Node.js is already installed, for example for ",[66,2011,2012],{"href":100},"Dethereal"," (20 or later), or you are happy to install it",[377,2015,2016],{},"Node.js 18 or later, to run the installer only. The deployment does not need it.",[362,2018,2019,2027,2030],{},[377,2020,2021],{},[66,2022,123,2024,2026],{"href":2023},"#with-get-byodtsh-from-the-release",[29,2025,83],{}," from the release",[377,2028,2029],{},"You would rather not have Node.js",[377,2031,2032],{},"Nothing more",[14,2034,2035],{},"Everything after these two sections applies to both.",[344,2037,2005],{"id":2038},"with-npx",[14,2040,2041,2042,2044],{},"The npm package runs the release's own installer. Each package version is the release of the same version, and carries that release's ",[29,2043,83],{}," with the same pins written in. The package's name:",[104,2046,2048],{"className":106,"code":2047,"language":108,"meta":109,"style":109},"PKG=@dether.net\u002Fbyodt\n",[29,2049,2050],{"__ignoreMap":109},[113,2051,2052],{"class":115,"line":116},[113,2053,2047],{},[104,2055,2057],{"className":106,"code":2056,"language":108,"meta":109,"style":109},"npx \"$PKG@0.14.0\"\nnpx \"$PKG@0.14.0\" --dir ~\u002Fdethernety --yes\n",[29,2058,2059,2064],{"__ignoreMap":109},[113,2060,2061],{"class":115,"line":116},[113,2062,2063],{},"npx \"$PKG@0.14.0\"\n",[113,2065,2066],{"class":115,"line":140},[113,2067,2068],{},"npx \"$PKG@0.14.0\" --dir ~\u002Fdethernety --yes\n",[18,2070,2071,2084,2098,2108,2114,2132],{},[21,2072,2073,2076,2077,479,2080,2083],{},[24,2074,2075],{},"Name the version."," Without ",[29,2078,2079],{},"@X.Y.Z",[29,2081,2082],{},"npx"," runs the latest release.",[21,2085,2086,2089,2090,2093,2094,2097],{},[24,2087,2088],{},"Options go after the package name",", and reach the installer. An option before it is one of npx's own: npx asks ",[29,2091,2092],{},"Ok to proceed?"," before it downloads a package it has not cached, and ",[29,2095,2096],{},"npx --yes \"$PKG@0.14.0\""," skips that question. Without a terminal, npx does not ask.",[21,2099,2100,2101,2103,2104,2107],{},"It runs the package's ",[29,2102,83],{}," with ",[29,2105,2106],{},"\u002Fbin\u002Fsh",", and nothing else. It takes the same options, and asks at the terminal the same way.",[21,2109,2110,2111],{},"It needs Node.js 18 or later, to run the installer only: the deployment it installs does not use Node.js. On Windows it stops with ",[29,2112,2113],{},"Dethernety's self-hosted deployment runs on Linux or macOS. On Windows, run this inside WSL.",[21,2115,2116,2117,2120,2121,2124,2125,479,2127,479,2129,2131],{},"It takes npm's ",[29,2118,2119],{},"node_modules\u002F.bin"," folders out of ",[29,2122,2123],{},"PATH"," before it starts the installer, so ",[29,2126,485],{},[29,2128,566],{},[29,2130,482],{}," and the container engine are always the system's.",[21,2133,2134,2137,2138,77],{},[24,2135,2136],{},"A release reaches npm separately."," Publishing to npm is a separate step after the release is published on GitHub. For a version that is not on npm yet, use ",[66,2139,2140,2026],{"href":2023},[29,2141,83],{},[344,2143,123,2145,2026],{"id":2144},"with-get-byodtsh-from-the-release",[29,2146,83],{},[14,2148,2149],{},"Without Node.js, download the installer straight from the release and run it:",[104,2151,2152],{"className":106,"code":130,"language":108,"meta":109,"style":109},[29,2153,2154,2158],{"__ignoreMap":109},[113,2155,2156],{"class":115,"line":116},[113,2157,137],{},[113,2159,2160],{"class":115,"line":140},[113,2161,143],{},[14,2163,2164,2165,1127],{},"Options go after ",[29,2166,2167],{},"sh -s --",[104,2169,2171],{"className":106,"code":2170,"language":108,"meta":109,"style":109},"curl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" | sh -s -- --dir ~\u002Fdethernety\n",[29,2172,2173],{"__ignoreMap":109},[113,2174,2175],{"class":115,"line":116},[113,2176,2170],{},[18,2178,2179,2185,2199],{},[21,2180,2181,2184],{},[24,2182,2183],{},"Use the URL with the version in it."," The script carries its release's version and the SHA-256 of that release's bundle, written in when the release was published, so the URL decides exactly what is installed.",[21,2186,2187,2192,2193,2196,2197,102],{},[24,2188,2189,2190],{},"It installs into ",[29,2191,87],{},", in the directory you run it from, unless you name another folder with ",[29,2194,2195],{},"--dir",". The folder must not exist yet. It becomes the deployment, so put it somewhere durable (see the warning in ",[66,2198,1524],{"href":1523},[21,2200,2201,2204],{},[24,2202,2203],{},"The questions come from the terminal",", even when the script itself arrives through a pipe.",[14,2206,2207],{},"To check the installer itself before you run it, download it with its signature and verify it as you would the bundle:",[104,2209,2211],{"className":106,"code":2210,"language":108,"meta":109,"style":109},"BASE=\"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\"\ncurl --proto '=https' --tlsv1.2 -fsSLO \"${BASE}\u002Fget-byodt.sh\"\ncurl --proto '=https' --tlsv1.2 -fsSLO \"${BASE}\u002Fget-byodt.sh.bundle\"\ncosign verify-blob get-byodt.sh \\\n  --bundle get-byodt.sh.bundle \\\n  --certificate-identity \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Ftags\u002Fv${VERSION}\" \\\n  --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com\nsh get-byodt.sh\n",[29,2212,2213,2217,2222,2227,2232,2237,2241,2245],{"__ignoreMap":109},[113,2214,2215],{"class":115,"line":116},[113,2216,177],{},[113,2218,2219],{"class":115,"line":140},[113,2220,2221],{},"curl --proto '=https' --tlsv1.2 -fsSLO \"${BASE}\u002Fget-byodt.sh\"\n",[113,2223,2224],{"class":115,"line":180},[113,2225,2226],{},"curl --proto '=https' --tlsv1.2 -fsSLO \"${BASE}\u002Fget-byodt.sh.bundle\"\n",[113,2228,2229],{"class":115,"line":187},[113,2230,2231],{},"cosign verify-blob get-byodt.sh \\\n",[113,2233,2234],{"class":115,"line":193},[113,2235,2236],{},"  --bundle get-byodt.sh.bundle \\\n",[113,2238,2239],{"class":115,"line":199},[113,2240,231],{},[113,2242,2243],{"class":115,"line":205},[113,2244,237],{},[113,2246,2247],{"class":115,"line":210},[113,2248,2249],{},"sh get-byodt.sh\n",[344,2251,2253],{"id":2252},"what-it-checks","What it checks",[14,2255,2256,2257,1334],{},"For a new install, in this order, stopping at the first check that fails (an upgrade is described in ",[66,2258,2259],{"href":1969},"Operations",[656,2261,2262,2271,2281,2291,2307,2324,2341,2381],{},[21,2263,2264,2267,2268,2270],{},[24,2265,2266],{},"The machine."," Linux or macOS, with ",[29,2269,482],{},". On Windows, run it inside WSL.",[21,2272,2273,2276,2277,77],{},[24,2274,2275],{},"An existing deployment."," It never installs over one; see ",[66,2278,2280],{"href":2279},"#when-a-deployment-is-already-there","When a deployment is already there",[21,2282,2283,2286,2287,102],{},[24,2284,2285],{},"The target folder."," It must not exist yet, and its parent must be a directory no other account can change (see ",[66,2288,2290],{"href":2289},"#folders-other-accounts-can-change","Folders other accounts can change",[21,2292,2293,2296,2297,1334,2301],{},[24,2294,2295],{},"The third-party notice."," It is shown before anything is downloaded, and you confirm it (see ",[66,2298,2300],{"href":2299},"#the-third-party-notice","The third-party notice",[104,2302,2305],{"className":2303,"code":2304,"language":1615},[1613],"Nothing has been downloaded yet.\nContinue? [y\u002FN]\n",[29,2306,2304],{"__ignoreMap":109},[21,2308,2309,391,2312,2315,2316,494,2318,2320,2321],{},[24,2310,2311],{},"The download.",[29,2313,2314],{},"byodt-X.Y.Z.tar.gz",", over HTTPS only, and at most 50 MiB: a larger file is not a release's. It needs ",[29,2317,485],{},[29,2319,489],{},"; with neither, it stops here: ",[29,2322,2323],{},"Neither curl nor wget is installed.",[21,2325,2326,2329,2330,494,2332,2334,2335],{},[24,2327,2328],{},"The SHA-256."," It must equal the one written into the installer. It needs ",[29,2331,493],{},[29,2333,497],{},"; with neither, it stops here.",[104,2336,2339],{"className":2337,"code":2338,"language":1615},[1613],"==> SHA-256 matches the release (…).\n",[29,2340,2338],{"__ignoreMap":109},[21,2342,2343,2346,2347,2350,2351,2354,2355,479,2358,2361,2362,2365,2366,2372,2374,2375],{},[24,2344,2345],{},"The signature, when cosign is installed."," The installer downloads ",[29,2348,2349],{},"byodt-X.Y.Z.tar.gz.bundle"," and verifies it against the exact signing identity: the release workflow of ",[29,2352,2353],{},"dether-net\u002Fdethernety-oss"," at the tag ",[29,2356,2357],{},"vX.Y.Z",[29,2359,2360],{},"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Ftags\u002FvX.Y.Z",", issued by ",[29,2363,2364],{},"https:\u002F\u002Ftoken.actions.githubusercontent.com",". An asset from any other release, or signed by anything else, does not pass.",[104,2367,2370],{"className":2368,"code":2369,"language":1615},[1613],"==> Signature verified: the release workflow of dether-net\u002Fdethernety-oss at vX.Y.Z signed it.\n",[29,2371,2369],{"__ignoreMap":109},[674,2373],{},"Without cosign it goes on, and says so:",[104,2376,2379],{"className":2377,"code":2378,"language":1615},[1613],"warning: cosign is not installed: the bundle's integrity was checked, its authenticity was not. Install cosign to verify the signature too.\n",[29,2380,2378],{"__ignoreMap":109},[21,2382,2383,2386,2387,2390,2391,479,2393,494,2395,2398,2399],{},[24,2384,2385],{},"What is inside."," Every entry must sit under ",[29,2388,2389],{},"byodt-X.Y.Z\u002F",", be a plain file or directory, and not be something that belongs to a deployment rather than a release, such as ",[29,2392,627],{},[29,2394,1051],{},[29,2396,2397],{},"data\u002F",". It is unpacked in a private working folder beside the target, with nothing writable by other accounts, and moved into place:",[104,2400,2403],{"className":2401,"code":2402,"language":1615},[1613],"==> Unpacked release X.Y.Z into .\u002Fbyodt.\n",[29,2404,2402],{"__ignoreMap":109},[14,2406,2407,2408,2410,2411,102],{},"Then it runs ",[29,2409,1585],{}," in the new folder, at your terminal, with the options you gave it. Setup does not show the notice again, unless an image it names points at a mirror of your own (see ",[66,2412,2300],{"href":2299},[344,2414,2416],{"id":2415},"options","Options",[348,2418,2421],{"className":2419,"tabIndex":352,"role":353,"ariaLabel":2420},[351],"Table: Options",[356,2422,2423,2433],{},[359,2424,2425],{},[362,2426,2427,2430],{},[365,2428,2429],{},"Option",[365,2431,2432],{},"What it does",[372,2434,2435,2448,2460,2469,2487,2501,2511,2536],{},[362,2436,2437,2442],{},[377,2438,2439],{},[29,2440,2441],{},"--dir DIR",[377,2443,2444,2445,2447],{},"The folder to install into (default ",[29,2446,87],{},"), or the deployment to upgrade.",[362,2449,2450,2455],{},[377,2451,2452],{},[29,2453,2454],{},"--upgrade",[377,2456,2457,2458,77],{},"Upgrade the deployment found. Needed when there is no terminal to ask, and with ",[29,2459,547],{},[362,2461,2462,2466],{},[377,2463,2464],{},[29,2465,547],{},[377,2467,2468],{},"Ask nothing: take the defaults, and count the third-party notice as confirmed. The notice is printed either way.",[362,2470,2471,2476],{},[377,2472,2473],{},[29,2474,2475],{},"--https-proxy URL",[377,2477,2478,2479,2481,2482,149,2484,77],{},"The proxy for this download, as ",[29,2480,1697],{},", with no login in it. Default: your shell's ",[29,2483,1030],{},[66,2485,2486],{"href":1596},"Through an outbound proxy",[362,2488,2489,2494],{},[377,2490,2491],{},[29,2492,2493],{},"--tarball FILE",[377,2495,2496,2497,2500],{},"Install from this bundle file instead of downloading it. It is checked all the same; its signature only from ",[29,2498,2499],{},"FILE.bundle"," beside it.",[362,2502,2503,2508],{},[377,2504,2505],{},[29,2506,2507],{},"--require-signature",[377,2509,2510],{},"Refuse unless cosign is installed and verifies the bundle.",[362,2512,2513,2518],{},[377,2514,2515],{},[29,2516,2517],{},"--allow-unsigned",[377,2519,2520,2521,2524,2525,2528,2529,2531,2532,2535],{},"Go ahead without a signature check when cosign is not installed, or a ",[29,2522,2523],{},"--tarball"," has no ",[29,2526,2527],{},".bundle"," beside it, without asking about the signature. The SHA-256 is still checked, but it comes from the same release, so it shows the download is intact, not who made it. A signature cosign rejects always stops the upgrade. Refused when ",[29,2530,627],{}," sets ",[29,2533,2534],{},"UPGRADE_REQUIRE_SIGNATURE=true",". A new install ignores it.",[362,2537,2538,2546],{},[377,2539,2540,479,2543],{},[29,2541,2542],{},"-h",[29,2544,2545],{},"--help",[377,2547,2548],{},"Print the options.",[14,2550,2551,2556,2557,2559,2560,2563,2564,77],{},[24,2552,2553,2554],{},"Any other option goes to the bundle's own ",[29,2555,1585],{}," (on a new install) or ",[29,2558,570],{}," (on an upgrade). For example, ",[29,2561,2562],{},"--db neo4j --start"," reaches setup. The installer passes on only values made of letters, digits and ",[29,2565,2566],{},". _ : \u002F @ % + , = ~ ! & ' ( ) * ; -",[344,2568,2570],{"id":2569},"without-a-terminal","Without a terminal",[14,2572,2573],{},"From a script or a provisioning tool, nobody can answer the questions. Then:",[18,2575,2576,2590],{},[21,2577,2578,2583,2584],{},[24,2579,2580,2581],{},"Without ",[29,2582,547],{},", the installer prints the notice and stops before it downloads anything:",[104,2585,2588],{"className":2586,"code":2587,"language":1615},[1613],"error: There is no terminal to confirm the notice above on. Run this at a terminal, or add --yes.\n",[29,2589,2587],{"__ignoreMap":109},[21,2591,2592,2596,2597,2612,2614,2615,2624],{},[24,2593,123,2594],{},[29,2595,547],{},", it prints the notice, counts it as confirmed, and setup takes its defaults and your flags:",[104,2598,2600],{"className":106,"code":2599,"language":108,"meta":109,"style":109},"curl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" \\\n  | sh -s -- --yes --dir ~\u002Fdethernety --db neo4j --start\n",[29,2601,2602,2607],{"__ignoreMap":109},[113,2603,2604],{"class":115,"line":116},[113,2605,2606],{},"curl --proto '=https' --tlsv1.2 -fsSL \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fget-byodt.sh\" \\\n",[113,2608,2609],{"class":115,"line":140},[113,2610,2611],{},"  | sh -s -- --yes --dir ~\u002Fdethernety --db neo4j --start\n",[674,2613],{},"Through npx, the same options follow the package name:",[104,2616,2618],{"className":106,"code":2617,"language":108,"meta":109,"style":109},"npx \"$PKG@0.14.0\" --yes --dir ~\u002Fdethernety --db neo4j --start\n",[29,2619,2620],{"__ignoreMap":109},[113,2621,2622],{"class":115,"line":116},[113,2623,2617],{},[104,2625,2628],{"className":2626,"code":2627,"language":1615},[1613],"==> --yes: counted as the confirmation of the notice above.\n",[29,2629,2627],{"__ignoreMap":109},[14,2631,2632,2634,2635,2637,2638,2640,2641,2643,2644,2646,2647,2649,2650,2652,2653,2655],{},[29,2633,547],{}," means unattended at a terminal too: nothing is asked. With ",[29,2636,547],{},", or without a terminal, an existing deployment is upgraded only with ",[29,2639,2454],{}," (at a terminal without ",[29,2642,547],{},", the installer asks), and an upgrade goes ahead without a signature check (cosign not installed, or a ",[29,2645,2523],{}," with no ",[29,2648,2527],{}," beside it) only with ",[29,2651,2517],{},". ",[29,2654,547],{}," never implies either.",[344,2657,2486],{"id":2658},"through-an-outbound-proxy",[14,2660,2661,2662,486,2664,2667,2668,1127],{},"The installer's own downloads (the bundle and its signature, and cosign's calls) go through the proxy in your shell's ",[29,2663,1030],{},[29,2665,2666],{},"https_proxy","), or through ",[29,2669,1589],{},[18,2671,2672,2693,2704,2723],{},[21,2673,2674,2677,2678,2680,2681,2652,2684,2686,2687],{},[24,2675,2676],{},"A login comes only from the environment."," Put it in ",[29,2679,1030],{},", percent-encoded, as in ",[66,2682,2683],{"href":1021},"Behind an outbound proxy → 2",[29,2685,1589],{}," refuses one, because an argument shows in the process list:",[104,2688,2691],{"className":2689,"code":2690,"language":1615},[1613],"error: Give --https-proxy without a login (http:\u002F\u002Fhost:port): an argument shows in the process list. A login comes only from HTTPS_PROXY in the environment.\n",[29,2692,2690],{"__ignoreMap":109},[21,2694,2695,486,2700,2703],{},[24,2696,2697,2698],{},"The proxy is ",[29,2699,1697],{},[29,2701,2702],{},"https:\u002F\u002Fhost:port","), with nothing after the port.",[21,2705,2706,2709,2710,479,2712,1052,2714,2716,2717],{},[24,2707,2708],{},"The login never reaches a command line."," The proxy reaches ",[29,2711,485],{},[29,2713,489],{},[29,2715,566],{}," through their environment, and the installer prints it masked:",[104,2718,2721],{"className":2719,"code":2720,"language":1615},[1613],"==> Downloading byodt-X.Y.Z.tar.gz from the dether-net\u002Fdethernety-oss release (through http:\u002F\u002F***@proxy.example.internal:3128)…\n",[29,2722,2720],{"__ignoreMap":109},[21,2724,2725,2728,2729,2731,2732,2734,2735,2737],{},[24,2726,2727],{},"Through npx",", npm downloads the package through the same ",[29,2730,1030],{}," from your shell, and the installer inherits it. The proxy must then allow npm's registry, ",[29,2733,852],{},", too. ",[29,2736,1589],{}," reaches the installer only, not npm.",[14,2739,2740,2747,2748,2750,2751,2753,2754,2756],{},[24,2741,2742,2744,2745,77],{},[29,2743,485],{},", else ",[29,2746,489],{}," The installer uses ",[29,2749,485],{}," when it is installed, held to HTTPS and TLS 1.2 or later. ",[29,2752,489],{}," is the fallback, and it cannot refuse a redirect to plain HTTP, so a ",[29,2755,489],{}," download counts as transport that is not guaranteed HTTPS. That changes nothing about what is used: the SHA-256 written into the installer decides, and with cosign the signature is checked the same way.",[14,2758,2759,2762,2763,2765,2766,2769,2770,2772],{},[24,2760,2761],{},"The 50 MiB cap"," holds on both. ",[29,2764,485],{}," refuses a larger file up front, and the installer stops with ",[29,2767,2768],{},"error: Could not download the bundle.","; ",[29,2771,489],{}," stops at the cap:",[104,2774,2777],{"className":2775,"code":2776,"language":1615},[1613],"error: https:\u002F\u002F… is larger than a release's file is.\n",[29,2778,2776],{"__ignoreMap":109},[14,2780,2781],{},"Nothing is left behind either way.",[14,2783,2784,2787,2788,1586,2790,1590,2792,628,2794,2796,2797,2799,2800,2803,2804,2807,2808,2811,2812,2814,2815,2817,2818,2820,2821,2823,2824,2827,2828,2830],{},[24,2785,2786],{},"The deployment's own proxy."," The installer hands the proxy to ",[29,2789,1585],{},[29,2791,1589],{},[29,2793,627],{},[29,2795,1030],{},", and, at a terminal, asks for the hosts to reach directly and a TLS-inspecting proxy's CA. A login from your shell is saved into ",[29,2798,1051],{}," only after you answer ",[29,2801,2802],{},"y"," to ",[29,2805,2806],{},"Save the proxy login for user '…' that the installer was given? [y\u002FN]",", or with ",[29,2809,2810],{},"--proxy-login-from-env"," on the installer's command line; with ",[29,2813,547],{}," and without that flag, setup says it did not save it. The containers must be able to use that proxy: setup refuses one they cannot, such as ",[29,2816,1710],{}," (see ",[66,2819,1099],{"href":1098},"). At a terminal it asks again; with ",[29,2822,547],{}," it stops with ",[29,2825,2826],{},"The proxy settings were refused (see above). Nothing was changed.",", and the unpacked folder stays. Run ",[29,2829,1585],{}," in it yourself, with the deployment's own proxy settings.",[344,2832,2280],{"id":2833},"when-a-deployment-is-already-there",[14,2835,2836,2837,2839,2840,2843],{},"An existing deployment is upgraded, never installed over. With ",[29,2838,2195],{},", the installer looks only in that folder. Without it, it looks in the folders the container engine has started this bundle's deployment from, and in the ",[29,2841,2842],{},"byodt*"," folders of the directory you run it from.",[348,2845,2848],{"className":2846,"tabIndex":352,"role":353,"ariaLabel":2847},[351],"Table: When a deployment is already there",[356,2849,2850,2860],{},[359,2851,2852],{},[362,2853,2854,2857],{},[365,2855,2856],{},"What it finds",[365,2858,2859],{},"What happens",[372,2861,2862,2880,2890,2900,2910,2921],{},[362,2863,2864,2867],{},[377,2865,2866],{},"One deployment, on another release",[377,2868,2869,2870,2873,2874,1223,2877],{},"At a terminal, it asks ",[29,2871,2872],{},"Upgrade the deployment in … from A to B? [y\u002FN]",". Without one, or after ",[29,2875,2876],{},"n",[29,2878,2879],{},"There is a deployment in …. Upgrade it (--upgrade), or name another folder for a new one with --dir. Nothing was changed.",[362,2881,2882,2885],{},[377,2883,2884],{},"One deployment, already on this release",[377,2886,2887],{},[29,2888,2889],{},"The deployment in … already runs release X.Y.Z; '…\u002Fbyodt update' applies it again. To install another one, name its folder with --dir. Nothing was changed.",[362,2891,2892,2895],{},[377,2893,2894],{},"One deployment, on this release, set up but never started",[377,2896,2897],{},[29,2898,2899],{},"The deployment in … already holds release X.Y.Z, and has not been started yet; '…\u002Fbyodt up' starts it. To install another one, name its folder with --dir. Nothing was changed.",[362,2901,2902,2905],{},[377,2903,2904],{},"An upgrade to this release half done there",[377,2906,2907],{},[29,2908,2909],{},"An upgrade is half done in …. '…\u002Fbyodt upgrade' goes on with it, or '…\u002Fbyodt upgrade --abandon' undoes it. Nothing was changed.",[362,2911,2912,2915],{},[377,2913,2914],{},"More than one",[377,2916,2917,2918],{},"It lists them: ",[29,2919,2920],{},"More than one deployment was found (above). Name the one to upgrade with --dir.",[362,2922,2923,2926],{},[377,2924,2925],{},"The target folder exists, and is not a deployment",[377,2927,2928],{},[29,2929,2930],{},"… already exists. Choose another folder with --dir, or upgrade the deployment in it (--upgrade); a folder a refused setup left behind holds nothing yet, and can be removed.",[14,2932,2933,2934,2936,2937,77],{},"An upgrade started by the installer is described in ",[66,2935,1970],{"href":1969},". Every refusal is in ",[66,2938,2940],{"href":2939},"\u002Fbyodt-cloud\u002Ftroubleshooting#installing-and-upgrading","Troubleshooting → Installing and upgrading",[344,2942,2290],{"id":2943},"folders-other-accounts-can-change",[14,2945,2946,2947,2949,2950,2952,2953,2956,2957,2960,2961,2964],{},"The installer, ",[29,2948,1585],{},", and ",[29,2951,570],{}," act only on folders that are yours (or root's) and that no other account can write to. The deployment holds its own data and secrets, and runs code from its folder. A folder whose group may write counts as one other accounts can change, unless the group is your own private group: the group named after you, which many Linux distributions give every user, and which makes new folders group-writable by default (a ",[29,2954,2955],{},"umask"," of ",[29,2958,2959],{},"002","). A shared folder such as ",[29,2962,2963],{},"\u002Ftmp"," is refused:",[104,2966,2969],{"className":2967,"code":2968,"language":1615},[1613],"error: Other accounts can change \u002Ftmp; install where only you can (--dir). The deployment holds its own data and secrets, so a shared folder such as \u002Ftmp is the wrong place for it anyway.\n",[29,2970,2968],{"__ignoreMap":109},[14,2972,2973,2974,77],{},"To fix a folder of your own: ",[29,2975,2976],{},"chmod go-w \u003Cfolder>",[55,2978],{},[58,2980,1647,2982],{"id":2981},"set-up-with-byodt-setup",[29,2983,1585],{},[14,2985,2986,2988,2989,2992,2993,2995,2996,2999],{},[29,2987,1585],{}," is a bundle's first run: it asks for the settings that are hard to change later, shows the ",[66,2990,2991],{"href":2299},"third-party notice",", and writes ",[29,2994,627],{},". The installer runs it for you. After a ",[66,2997,2998],{"href":1523},"manual download",", run it yourself from the bundle directory:",[104,3001,3003],{"className":106,"code":3002,"language":108,"meta":109,"style":109},".\u002Fbyodt setup\n",[29,3004,3005],{"__ignoreMap":109},[113,3006,3007],{"class":115,"line":116},[113,3008,3002],{},[14,3010,3011,3012,3014,3015,3017,3018,102],{},"You can skip it: ",[29,3013,1934],{}," on a fresh bundle still creates ",[29,3016,627],{}," with the defaults (see ",[66,3019,318],{"href":317},[344,3021,3023],{"id":3022},"the-questions","The questions",[14,3025,3026,3027,3030],{},"It asks only at a terminal, and only what no flag answered. ",[29,3028,3029],{},".\u002Fbyodt setup --help"," lists the flags.",[348,3032,3035],{"className":3033,"tabIndex":352,"role":353,"ariaLabel":3034},[351],"Table: The questions",[356,3036,3037,3050],{},[359,3038,3039],{},[362,3040,3041,3044,3047],{},[365,3042,3043],{},"Question",[365,3045,3046],{},"Flag",[365,3048,3049],{},"Default",[372,3051,3052,3069,3084,3110,3127,3144,3163,3177,3197,3211],{},[362,3053,3054,3059,3064],{},[377,3055,3056],{},[29,3057,3058],{},"Graph database, memgraph or neo4j [memgraph]:",[377,3060,3061],{},[29,3062,3063],{},"--db memgraph|neo4j",[377,3065,3066],{},[29,3067,3068],{},"memgraph",[362,3070,3071,3077,3081],{},[377,3072,3073,3074],{},"The third-party notice, then ",[29,3075,3076],{},"Continue? [y\u002FN]",[377,3078,3079],{},[29,3080,547],{},[377,3082,3083],{},"—",[362,3085,3086,3092,3097],{},[377,3087,3088,3091],{},[29,3089,3090],{},"Keep the database in the engine's named volume? [Y\u002Fn]",", asked only on a VM-backed runtime",[377,3093,3094],{},[29,3095,3096],{},"--db-data bind|volume",[377,3098,3099,3102,3103,3106,3107],{},[29,3100,3101],{},"volume"," there; elsewhere ",[29,3104,3105],{},"bind",", in ",[29,3108,3109],{},".\u002Fdata\u002F\u003Cengine>",[362,3111,3112,3117,3122],{},[377,3113,3114],{},[29,3115,3116],{},"Reach the console and the platform from other machines too (binds 0.0.0.0)? [y\u002FN]",[377,3118,3119],{},[29,3120,3121],{},"--bind 127.0.0.1|0.0.0.0",[377,3123,3124,3126],{},[29,3125,1710],{},", this machine only",[362,3128,3129,3134,3139],{},[377,3130,3131],{},[29,3132,3133],{},"Port [3000]:",[377,3135,3136],{},[29,3137,3138],{},"--port N",[377,3140,3141],{},[29,3142,3143],{},"3000",[362,3145,3146,3155,3160],{},[377,3147,3148,3151,3152],{},[29,3149,3150],{},"Does this machine reach the internet only through an HTTPS proxy? [y\u002FN]",", then ",[29,3153,3154],{},"The proxy, as http:\u002F\u002Fhost:port:",[377,3156,3157,3159],{},[29,3158,2475],{},", with no login in it",[377,3161,3162],{},"none",[362,3164,3165,3170,3175],{},[377,3166,3167],{},[29,3168,3169],{},"More hosts to reach directly, comma-separated (empty for none):",[377,3171,3172],{},[29,3173,3174],{},"--no-proxy LIST",[377,3176,3162],{},[362,3178,3179,3185,3195],{},[377,3180,3181,3184],{},[29,3182,3183],{},"The proxy login as user:password, the password percent-encoded (empty for none):",", typed without echo",[377,3186,3187,3188,3190,3191,3194],{},"none: a login is never a flag. ",[29,3189,2810],{}," takes it from ",[29,3192,3193],{},"BYODT_SETUP_PROXY_USERINFO",", as the installer passes it",[377,3196,3162],{},[362,3198,3199,3204,3209],{},[377,3200,3201],{},[29,3202,3203],{},"The CA certificate file of a TLS-inspecting proxy (empty for none):",[377,3205,3206],{},[29,3207,3208],{},"--proxy-ca FILE",[377,3210,3162],{},[362,3212,3213,3218,3226],{},[377,3214,3215],{},[29,3216,3217],{},"Start the stack now? [y\u002FN]",[377,3219,3220,479,3223],{},[29,3221,3222],{},"--start",[29,3224,3225],{},"--no-start",[377,3227,3228],{},"no",[14,3230,3231,3232,3234],{},"The proxy's hosts, login and CA are asked only when there is a proxy. ",[29,3233,547],{}," asks nothing: every question no flag answered takes its default, and the notice counts as confirmed.",[14,3236,3237,3238,3240],{},"Without a terminal and without ",[29,3239,547],{},", setup refuses at once:",[104,3242,3245],{"className":3243,"code":3244,"language":1615},[1613],"error: setup asks its questions at a terminal. Without one, add --yes, with flags for anything other than the defaults ('.\u002Fbyodt setup --help'). Nothing was changed.\n",[29,3246,3244],{"__ignoreMap":109},[344,3248,3250],{"id":3249},"what-it-writes","What it writes",[348,3252,3255],{"className":3253,"tabIndex":352,"role":353,"ariaLabel":3254},[351],"Table: What it writes",[356,3256,3257,3267],{},[359,3258,3259],{},[362,3260,3261,3264],{},[365,3262,3263],{},"File",[365,3265,3266],{},"What",[372,3268,3269,3302,3318,3327,3337],{},[362,3270,3271,3275],{},[377,3272,3273],{},[29,3274,627],{},[377,3276,3277,3278,3280,3281,479,3284,479,3287,479,3290,494,3293,3296,3297,1052,3299,3301],{},"A copy of ",[29,3279,1505],{},", with your answers set where a hand edit would put them: ",[29,3282,3283],{},"DB_ENGINE",[29,3285,3286],{},"FRONT_DOOR_BIND",[29,3288,3289],{},"FRONT_DOOR_PORT",[29,3291,3292],{},"DB_DATA",[29,3294,3295],{},"NEO4J_DATA"," for the named volume, and ",[29,3298,1030],{},[29,3300,1633],{}," for a proxy.",[362,3303,3304,3308],{},[377,3305,3306],{},[29,3307,1051],{},[377,3309,3310,3311,3314,3315,3317],{},"Only for a proxy login: ",[29,3312,3313],{},"HTTPS_PROXY_USERINFO",", mode ",[29,3316,1310],{},". The database password is generated on the first start, not here.",[362,3319,3320,3324],{},[377,3321,3322],{},[29,3323,1796],{},[377,3325,3326],{},"A copy of the CA file you named.",[362,3328,3329,3334],{},[377,3330,3331],{},[29,3332,3333],{},".byodt-release",[377,3335,3336],{},"The release and the SHA-256 of every file it shipped. The first upgrade checks your local edits against it.",[362,3338,3339,3344],{},[377,3340,3341],{},[29,3342,3343],{},"third-party-acknowledgement.log",[377,3345,3346],{},"The record of your confirmation of the notice.",[14,3348,3349,3350,3352,3353,3356,3357,3359,3360,2817,3362,102],{},"It checks the proxy settings with the same checks every later command makes. Any refusal removes what it wrote, so a refused setup leaves the folder as it was. Setup runs once per folder: it refuses when ",[29,3351,627],{}," exists (",[29,3354,3355],{},".env exists: this folder is already set up. Edit .env, or move it aside to run setup again.","), or ",[29,3358,1051],{}," does (the folder has run before). Once setup has finished, change a setting by editing ",[29,3361,627],{},[66,3363,3365],{"href":3364},"\u002Fbyodt-cloud\u002Fconfiguration","Configuration",[14,3367,3368],{},"At the end it says what it wrote, and what to watch for:",[104,3370,3373],{"className":3371,"code":3372,"language":1615},[1613],"==> Wrote .env: DB_ENGINE=memgraph, FRONT_DOOR_BIND=127.0.0.1, FRONT_DOOR_PORT=3000.\n==> Ready. Start with: .\u002Fbyodt up\n",[29,3374,3372],{"__ignoreMap":109},[14,3376,3377,3379,3380,3383,3384,77],{},[29,3378,511],{}," names itself in its messages the way you ran it, so after the installer the line reads ",[29,3381,3382],{},".\u002Fbyodt\u002Fbyodt up",", or the path you gave with ",[29,3385,2195],{},[18,3387,3388,3396,3404],{},[21,3389,3390,391,3393],{},[24,3391,3392],{},"Another port than 3000:",[29,3394,3395],{},"Port N: 3000 is a pre-registered loopback address for cloud sign-in; another port may need the identity provider to know it.",[21,3397,3398,391,3401],{},[24,3399,3400],{},"A port already in use:",[29,3402,3403],{},"warning: Something already answers on 127.0.0.1:N; the start may fail until it is free.",[21,3405,3406,3412,3413,77],{},[24,3407,3408,3409,1127],{},"Bound to ",[29,3410,3411],{},"0.0.0.0"," a warning that anyone who can reach the port has full access, and, at a terminal, ",[29,3414,3415],{},"Generate a self-signed TLS certificate now ('.\u002Fbyodt tls generate')? [y\u002FN]",[344,3417,3419],{"id":3418},"starting-from-setup","Starting from setup",[14,3421,123,3422,486,3424,2803,3426,3429,3430,3434,3435,3437],{},[29,3423,3222],{},[29,3425,2802],{},[29,3427,3428],{},"Start the stack now?","), setup checks before it writes anything that no other folder runs this bundle's deployment (see ",[66,3431,3433],{"href":3432},"\u002Fbyodt-cloud\u002Foperations#a-deployment-in-another-folder","Operations → A deployment in another folder","), then starts it with ",[29,3436,1934],{},". It says what the first start downloads:",[104,3439,3442],{"className":3440,"code":3441,"language":1615},[1613],"==> Starting. It downloads the platform and console images, and docker.io\u002Fmemgraph\u002Fmemgraph:3.13.2 docker.io\u002Fnginx:1.27-alpine, then the embedding model (about 1.26 GB) on the first start.\n",[29,3443,3441],{"__ignoreMap":109},[14,3445,3446],{},"It names the database and front-door images that are not on the machine yet, and the model's size. It gives no total: the size of an image download depends on what your engine already holds.",[344,3448,3450],{"id":3449},"database-volumes-an-earlier-deployment-left","Database volumes an earlier deployment left",[14,3452,3453,3454,3457,3458,1052,3461,3464],{},"Every bundle's deployment uses the same compose project name, ",[29,3455,3456],{},"dethernety",", so the named volumes ",[29,3459,3460],{},"dethernety_memgraph-data",[29,3462,3463],{},"dethernety_neo4j-data"," outlive a deployment whose folder is gone. Setup looks for them before it writes anything, warns about each one it finds, and never removes one.",[14,3466,3467,3470],{},[24,3468,3469],{},"A volume this deployment would mount"," (you chose the named volume for that engine):",[104,3472,3475],{"className":3473,"code":3474,"language":1615},[1613],"warning: The volume dethernety_memgraph-data remains from an earlier deployment of this bundle, and this one would mount it: that graph's database users were made with another password, so its first start would be refused. Before it, set DB_DATA=.\u002Fdata\u002Fmemgraph in .env to keep the database in a folder instead (less robust on a VM-backed engine); if you no longer need that graph, remove it with 'docker volume rm dethernety_memgraph-data' (this deletes it for good).\n",[29,3476,3474],{"__ignoreMap":109},[14,3478,3479],{},"The first start would be refused, because the platform would be locked out of that graph. Choose one:",[18,3481,3482,3488,3494],{},[21,3483,3484,3487],{},[24,3485,3486],{},"You want that graph:"," do not start this folder. Start the deployment it belongs to, or restore a backup of it into this one once this one runs on a folder.",[21,3489,3490,3493],{},[24,3491,3492],{},"You do not need it:"," remove the volume with the command the warning gives. This deletes the graph for good.",[21,3495,3496,3499,3500,3503,3504,3507,3508,3510,3511,77],{},[24,3497,3498],{},"Keep both:"," set ",[29,3501,3502],{},"DB_DATA=.\u002Fdata\u002Fmemgraph"," (on Neo4j, ",[29,3505,3506],{},"NEO4J_DATA=.\u002Fdata\u002Fneo4j",") in ",[29,3509,627],{}," before the first start, or run setup with ",[29,3512,3513],{},"--db-data bind",[14,3515,123,3516,3518,3519,77],{},[29,3517,3222],{},", setup refuses before it writes anything, and says ",[29,3520,3521],{},"Run setup with --db-data bind to keep the database in a folder instead",[14,3523,3524],{},[24,3525,3526],{},"A volume this deployment does not use:",[104,3528,3531],{"className":3529,"code":3530,"language":1615},[1613],"warning: The volume dethernety_neo4j-data remains from an earlier deployment of this bundle; its graph may still be in it. This one does not use it. To use that graph, stop this one and start the deployment it belongs to ('.\u002Fbyodt up' in its folder); if you no longer need it, remove it with 'docker volume rm dethernety_neo4j-data' (this deletes it for good).\n",[29,3532,3530],{"__ignoreMap":109},[14,3534,3535],{},"Nothing stops the start. The volume only takes disk space.",[55,3537],{},[58,3539,2300],{"id":3540},"the-third-party-notice",[14,3542,3543,3544,3546],{},"Before your machine downloads any third-party software, the installer and ",[29,3545,511],{}," show a short notice. It is Dethernety's own statement of fact about the third-party software this deployment runs: the database image, the front door's nginx image, and the embedding model, where each comes from, and the licence each is published under. Dethernety does not distribute any of them. Your container engine pulls the images from the registries the notice lists, and the platform downloads the model's weights from Hugging Face.",[104,3548,3551],{"className":3549,"code":3550,"language":1615},[1613],"THIRD-PARTY SOFTWARE\n\nThis deployment runs the third-party software listed below. Dethernety does\nnot distribute it: your machine downloads it from the sources listed (your\ncontainer engine pulls the images, and the platform downloads the model on\nits first start or on '.\u002Fbyodt models pull').\n\n- Memgraph (graph database)\n  Image:    docker.io\u002Fmemgraph\u002Fmemgraph:3.13.2\n  Licence:  Memgraph Business Source License 1.1 (with an Additional Use Grant)\n  Terms:    https:\u002F\u002Fgithub.com\u002Fmemgraph\u002Fmemgraph\u002Fblob\u002Fmaster\u002Flicenses\u002FBSL.txt\n\n…the embedding model and nginx, in the same form…\n\nThe images also contain operating-system packages under their own licences.\n\nYou are responsible for using this software under its licence.\n\nNothing has been downloaded yet.\nContinue? [y\u002FN]\n",[29,3552,3550],{"__ignoreMap":109},[14,3554,3555,3556,1052,3558,3561],{},"The images it names are the ones this deployment will run, read from ",[29,3557,627],{},[29,3559,3560],{},"compose.override.yaml",". The installer, which runs before you choose, lists both databases. When an image points at another repository than the one the release was tested with, a mirror of your own, for example, the notice adds a paragraph that says so.",[344,3563,3565],{"id":3564},"what-confirming-means","What confirming means",[14,3567,3568,3569,3571,3572,3574,3575,3578,3579,3581],{},"Answering ",[29,3570,2802],{},", or passing ",[29,3573,547],{},", confirms that you have read the notice and that you are responsible for using that software under its licence. It is not a licence agreement, and the notice does not say it is: it does not accept any publisher's licence for you, and Dethernety grants no rights to software it does not distribute. The licences are the ones the ",[24,3576,3577],{},"Terms"," lines link to. ",[29,3580,547],{}," counts as the confirmation, and the notice is printed either way.",[344,3583,3585],{"id":3584},"the-record","The record",[14,3587,3588,3589,3591,3592,494,3595,3598,3599,494,3602,3605],{},"Each confirmation is one line in ",[29,3590,3343],{},", in the deployment's folder: the time (UTC), the notice's text version and SHA-256, the database image, the model, the front-door image, how it was confirmed (",[29,3593,3594],{},"tty",[29,3596,3597],{},"yes",", or ",[29,3600,3601],{},"handover-tty",[29,3603,3604],{},"handover-yes"," when the installer showed it), and the release. It shows that this text was shown and confirmed for this deployment, not who confirmed it.",[14,3607,3608,3610,3611,3613],{},[29,3609,511],{}," keeps the record only in a folder that is yours and that other accounts cannot change (see ",[66,3612,2290],{"href":2289},"), and counts a record another account could have written as no record. Otherwise it stops before the first download, with a message such as:",[104,3615,3618],{"className":3616,"code":3617,"language":1615},[1613],"error: Other accounts can change this directory (…), so byodt does not record the third-party notice here. Make it yours and not writable by others (chmod go-w .), and run the command again.\n",[29,3619,3617],{"__ignoreMap":109},[344,3621,3623],{"id":3622},"when-it-is-shown-again","When it is shown again",[14,3625,3626,3627,479,3629,479,3631,479,3633,479,3635,1052,3637,3640],{},"The notice is asked for again only when what you confirmed changes: a new version of its text, another database image (a new tag included), or another model. A new front-door image does not count. ",[29,3628,1585],{},[29,3630,534],{},[29,3632,537],{},[29,3634,540],{},[29,3636,543],{},[29,3638,3639],{},"upgrade"," show it when it is due, before they download or change anything.",[14,3642,3643,3644,3646,3647,3650],{},"On a deployment that has already run, with no terminal and no ",[29,3645,547],{},", a due notice never stops a command: it is printed, followed by ",[29,3648,3649],{},"warning: The notice above has not been confirmed for this deployment. Run '.\u002Fbyodt acknowledge' at a terminal, or with --yes, to record it."," On a deployment that has not run yet, the command stops instead, as setup does.",[348,3652,3655],{"className":3653,"tabIndex":352,"role":353,"ariaLabel":3654},[351],"Table: When it is shown again",[356,3656,3657,3666],{},[359,3658,3659],{},[362,3660,3661,3664],{},[365,3662,3663],{},"Command",[365,3665,2432],{},[372,3667,3668,3682,3694],{},[362,3669,3670,3675],{},[377,3671,3672],{},[29,3673,3674],{},".\u002Fbyodt notice",[377,3676,3677,3678,3681],{},"Prints the notice for this deployment, without asking. ",[29,3679,3680],{},"--all"," prints it for both databases, as the installer shows it.",[362,3683,3684,3689],{},[377,3685,3686],{},[29,3687,3688],{},".\u002Fbyodt acknowledge",[377,3690,3691,3692,77],{},"Shows the notice, asks, and records your confirmation. Takes ",[29,3693,547],{},[362,3695,3696,3701],{},[377,3697,3698],{},[29,3699,3700],{},".\u002Fbyodt compose …",[377,3702,3703],{},"The raw escape hatch. It never shows the notice, so a pull through it is not preceded by one.",[55,3705],{},[58,3707,1524],{"id":3708},"get-the-bundle",[14,3710,3711,3712,3715],{},"To install by hand rather than with ",[66,3713,3714],{"href":152},"the installer",": the deployment ships as a signed release asset, a tarball holding the control script, the compose files, and a configuration template.",[656,3717,3718,3731,3750,3799],{},[21,3719,3720,3723,3724,3727,3728,77],{},[24,3721,3722],{},"Pick the version."," The commands below use the current release. For another one, set ",[29,3725,3726],{},"VERSION"," to it in the next step; the releases are listed on the ",[66,3729,76],{"href":73,"rel":3730},[75],[21,3732,3733,3736],{},[24,3734,3735],{},"Download the bundle:",[104,3737,3739],{"className":106,"code":3738,"language":108,"meta":109,"style":109},"VERSION=0.14.0\ncurl -fsSLO \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fbyodt-${VERSION}.tar.gz\"\n",[29,3740,3741,3745],{"__ignoreMap":109},[113,3742,3743],{"class":115,"line":116},[113,3744,137],{},[113,3746,3747],{"class":115,"line":140},[113,3748,3749],{},"curl -fsSLO \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fbyodt-${VERSION}.tar.gz\"\n",[21,3751,3752,3755,3756,3759,3760,3790,3792,3794,3795,3798],{},[24,3753,3754],{},"Verify the signature (recommended)."," Every release asset is signed. With ",[66,3757,566],{"href":564,"rel":3758},[75]," installed, download the signature bundle and check it:",[104,3761,3763],{"className":106,"code":3762,"language":108,"meta":109,"style":109},"curl -fsSLO \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fbyodt-${VERSION}.tar.gz.bundle\"\n\ncosign verify-blob \"byodt-${VERSION}.tar.gz\" \\\n  --bundle \"byodt-${VERSION}.tar.gz.bundle\" \\\n  --certificate-identity \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002F.github\u002Fworkflows\u002Frelease.yml@refs\u002Ftags\u002Fv${VERSION}\" \\\n  --certificate-oidc-issuer https:\u002F\u002Ftoken.actions.githubusercontent.com\n",[29,3764,3765,3770,3774,3778,3782,3786],{"__ignoreMap":109},[113,3766,3767],{"class":115,"line":116},[113,3768,3769],{},"curl -fsSLO \"https:\u002F\u002Fgithub.com\u002Fdether-net\u002Fdethernety-oss\u002Freleases\u002Fdownload\u002Fv${VERSION}\u002Fbyodt-${VERSION}.tar.gz.bundle\"\n",[113,3771,3772],{"class":115,"line":140},[113,3773,184],{"emptyLinePlaceholder":183},[113,3775,3776],{"class":115,"line":180},[113,3777,219],{},[113,3779,3780],{"class":115,"line":187},[113,3781,225],{},[113,3783,3784],{"class":115,"line":193},[113,3785,231],{},[113,3787,3788],{"class":115,"line":199},[113,3789,237],{},[674,3791],{},[24,3793,1865],{}," cosign prints ",[29,3796,3797],{},"Verified OK",". The bundle is the published one, unmodified. The identity is pinned to this exact release tag, so an asset from a different release does not pass.",[21,3800,3801,3804,3817,3819,3821,3822,3825,3826],{},[24,3802,3803],{},"Extract it and enter the directory:",[104,3805,3807],{"className":106,"code":3806,"language":108,"meta":109,"style":109},"tar xzf \"byodt-${VERSION}.tar.gz\"\ncd \"byodt-${VERSION}\"\n",[29,3808,3809,3813],{"__ignoreMap":109},[113,3810,3811],{"class":115,"line":116},[113,3812,254],{},[113,3814,3815],{"class":115,"line":140},[113,3816,260],{},[674,3818],{},[24,3820,1865],{}," the directory holds these files (",[29,3823,3824],{},"ls -A"," shows the hidden ones):",[348,3827,3830],{"className":3828,"tabIndex":352,"role":353,"ariaLabel":3829},[351],"Table: Get the bundle",[356,3831,3832,3842],{},[359,3833,3834],{},[362,3835,3836,3839],{},[365,3837,3838],{},"Path",[365,3840,3841],{},"What it is",[372,3843,3844,3853,3863,3876,3885,3895,3905,3918],{},[362,3845,3846,3850],{},[377,3847,3848],{},[29,3849,511],{},[377,3851,3852],{},"The control script — your interface to the deployment.",[362,3854,3855,3860],{},[377,3856,3857],{},[29,3858,3859],{},"compose.yaml",[377,3861,3862],{},"The service definitions, except the database.",[362,3864,3865,3873],{},[377,3866,3867,479,3870],{},[29,3868,3869],{},"compose.memgraph.yaml",[29,3871,3872],{},"compose.neo4j.yaml",[377,3874,3875],{},"The database service, one file per engine.",[362,3877,3878,3882],{},[377,3879,3880],{},[29,3881,1505],{},[377,3883,3884],{},"The configuration template, and the manifest of the tested image set.",[362,3886,3887,3892],{},[377,3888,3889],{},[29,3890,3891],{},"proxy\u002F",[377,3893,3894],{},"The front-door configuration and its TLS entrypoint.",[362,3896,3897,3902],{},[377,3898,3899],{},[29,3900,3901],{},"README.md",[377,3903,3904],{},"A quick-start reference for the bundle.",[362,3906,3907,3915],{},[377,3908,3909,479,3912],{},[29,3910,3911],{},"LICENSE",[29,3913,3914],{},"NOTICE",[377,3916,3917],{},"The licence and the third-party notices.",[362,3919,3920,3925],{},[377,3921,3922],{},[29,3923,3924],{},".gitignore",[377,3926,3927],{},"Keeps the files the first start creates out of version control, if you track the directory with git.",[296,3929,3931],{"className":3930},[299,578],[14,3932,3933,3935,3936,3939],{},[24,3934,583],{}," Where you extract the bundle matters. This directory ",[24,3937,3938],{},"becomes the deployment",": your configuration, the database password, and — with the default storage setting — the graph itself all live inside it. Put it somewhere durable and backed up, never in a temporary directory.",[55,3941],{},[58,3943,318],{"id":3944},"optional-choose-your-settings-first",[14,3946,3947,3948,3952,3953,3955,3956,3958,3959,3961],{},"You can skip this section, and you do not need it after ",[66,3949,3950],{"href":1646},[29,3951,1585],{},", which asks for these settings and writes ",[29,3954,627],{}," for you. Without setup, the first start creates ",[29,3957,627],{}," from ",[29,3960,1505],{}," and starts straight away with defaults that suit a single operator on a trusted machine:",[348,3963,3966],{"className":3964,"tabIndex":352,"role":353,"ariaLabel":3965},[351],"Table: Optional: choose your settings first",[356,3967,3968,3977],{},[359,3969,3970],{},[362,3971,3972,3975],{},[365,3973,3974],{},"Setting",[365,3976,3049],{},[372,3978,3979,3991,3999],{},[362,3980,3981,3984],{},[377,3982,3983],{},"Front door",[377,3985,3986,3987,3990],{},"Plain HTTP on ",[29,3988,3989],{},"127.0.0.1:3000"," (loopback only)",[362,3992,3993,3996],{},[377,3994,3995],{},"Database engine",[377,3997,3998],{},"Memgraph",[362,4000,4001,4004],{},[377,4002,4003],{},"Database storage",[377,4005,4006,4007],{},"A host bind mount at ",[29,4008,4009],{},"data\u002Fmemgraph",[14,4011,4012,4013,391,4015,4018,4019,4021],{},"To change any of these, create ",[29,4014,627],{},[24,4016,4017],{},"before"," the first start — and before ",[29,4020,904],{},", which performs the same first-run setup:",[104,4023,4025],{"className":106,"code":4024,"language":108,"meta":109,"style":109},"cp .env.example .env\n# then edit .env\n",[29,4026,4027,4031],{"__ignoreMap":109},[113,4028,4029],{"class":115,"line":116},[113,4030,1665],{},[113,4032,4033],{"class":115,"line":140},[113,4034,4035],{},"# then edit .env\n",[14,4037,4038,4039,4041,4042,77],{},"The control script never overwrites an existing ",[29,4040,627],{},". Every setting is documented in ",[66,4043,3365],{"href":3364},[14,4045,4046,4049,4050,2803,4053,4055],{},[24,4047,4048],{},"To run Neo4j instead of Memgraph",", add ",[29,4051,4052],{},"DB_ENGINE=neo4j",[29,4054,627],{},", or start the first time with:",[104,4057,4059],{"className":106,"code":4058,"language":108,"meta":109,"style":109},"DB_ENGINE=neo4j .\u002Fbyodt up\n",[29,4060,4061],{"__ignoreMap":109},[113,4062,4063],{"class":115,"line":116},[113,4064,4058],{},[14,4066,4067,4068,628,4070,4072,4073,4075,4076,77],{},"The first start records the engine in ",[29,4069,627],{},[29,4071,3283],{}," (and on Neo4j, the image as ",[29,4074,923],{},"), so later commands need no export. See ",[66,4077,4079],{"href":4078},"\u002Fbyodt-cloud\u002Fconfiguration#the-database-engine","Configuration → The database engine",[296,4081,4083],{"className":4082},[299,578],[14,4084,4085,4087],{},[24,4086,583],{}," Choose the database engine before the first start. Each engine keeps its own data and nothing converts one into the other: switching later starts an empty graph, and a backup taken on one engine cannot be restored on the other.",[296,4089,4091,4102,4108],{"className":4090},[299,578],[14,4092,4093,4095,4096,4098,4099,4101],{},[24,4094,583],{}," On a VM-backed runtime (see ",[66,4097,346],{"href":68},"), store the database in the named volume, not a host bind mount. A bind mount that crosses the VM's file-sharing layer can corrupt a running database. Set this in ",[29,4100,627],{}," before the first start:",[104,4103,4106],{"className":4104,"code":4105,"language":1615},[1613],"DB_DATA=memgraph-data\n",[29,4107,4105],{"__ignoreMap":109},[14,4109,4110,4111,4114,4115,3598,4118,4121,4122,77],{},"On Neo4j, set ",[29,4112,4113],{},"NEO4J_DATA=neo4j-data"," instead. On native Linux the default bind mount (",[29,4116,4117],{},".\u002Fdata\u002Fmemgraph",[29,4119,4120],{},".\u002Fdata\u002Fneo4j",") is fine, and easier to inspect and copy. Switching later means a fresh, empty database. See ",[66,4123,4125],{"href":4124},"\u002Fbyodt-cloud\u002Fconfiguration#where-the-database-keeps-its-data","Configuration → Where the database keeps its data",[55,4127],{},[58,4129,4131],{"id":4130},"optional-download-the-embedding-model-ahead","Optional: download the embedding model ahead",[14,4133,4134,4135,1361,4138,4141,4142,4144],{},"The platform embeds in process with its built-in model, ",[24,4136,4137],{},"EmbeddingGemma 300m",[29,4139,4140],{},"embeddinggemma-300m-retrieval-v1",", by Google). The weights are not in any image: on the first start, the platform downloads them once from Hugging Face into ",[29,4143,411],{}," and verifies them. You can do that step ahead of time — for example while you still have a fast connection:",[104,4146,4147],{"className":106,"code":1848,"language":108,"meta":109,"style":109},[29,4148,4149],{"__ignoreMap":109},[113,4150,4151],{"class":115,"line":116},[113,4152,1848],{},[14,4154,4155],{},"It runs the platform's own download code in a one-off container and needs no database. Before it starts, it prints the model's size and its licence:",[104,4157,4160],{"className":4158,"code":4159,"language":1615},[1613],"Embedding model embeddinggemma-300m-retrieval-v1: 1.26 GB into \u002Fmodels, downloaded only where missing or wrong.\nThe model is licensed under the Gemma Terms of Use: https:\u002F\u002Fai.google.dev\u002Fgemma\u002Fterms.\n…\nReady: the platform loads the model from there without downloading it.\n",[29,4161,4159],{"__ignoreMap":109},[18,4163,4164,4167,4173],{},[21,4165,4166],{},"It is safe to run again: it downloads only what is missing or wrong.",[21,4168,4169,4172],{},[29,4170,4171],{},"Ctrl-C"," stops it and keeps nothing partial.",[21,4174,4175,4176,4179],{},"When it prints ",[29,4177,4178],{},"Ready",", the first start loads the model from disk instead of downloading it.",[296,4181,4183],{"className":4182},[299,300],[14,4184,4185,391,4187,4189,4190,4192,4193,4196,4197,4201,4202,4204],{},[24,4186,327],{},[29,4188,543],{}," performs first-run setup, so it creates ",[29,4191,627],{}," with the defaults if it does not exist yet. Make your ",[66,4194,4195],{"href":317},"settings choices"," first, or run ",[66,4198,4199],{"href":1646},[29,4200,1585],{},". On a bundle not set up yet, it shows the ",[66,4203,2991],{"href":2299}," first.",[296,4206,4208],{"className":4207},[299,300],[14,4209,4210,4212,4213,4218,4219,4221],{},[24,4211,327],{}," The model is licensed under the ",[66,4214,4217],{"href":4215,"rel":4216},"https:\u002F\u002Fai.google.dev\u002Fgemma\u002Fterms",[75],"Gemma Terms of Use",". The platform logs the licence before it downloads, and ",[29,4220,904],{}," prints it.",[344,4223,968],{"id":4224},"hosts-without-internet-access",[14,4226,4227],{},"For a host that cannot reach Hugging Face — no internet, or a proxy that does not let the download through:",[656,4229,4230,4238,4251,4259],{},[21,4231,4232,4235,4236,77],{},[24,4233,4234],{},"On a connected machine",", extract the same release and run ",[29,4237,904],{},[21,4239,4240,4246,4247,4250],{},[24,4241,4242,4243,4245],{},"Copy its ",[29,4244,411],{}," directory"," into the offline host's bundle directory, keeping the ",[29,4248,4249],{},"\u003Crepo>\u002F\u003Crevision>\u002F\u003Cfile>"," layout intact.",[21,4252,4253,4258],{},[24,4254,4255,4256],{},"Copy as the account that runs ",[29,4257,87],{}," on the offline host, not as root. Files owned by root pass only under rootful Docker; rootless Podman refuses them.",[21,4260,4261],{},[24,4262,4263],{},"Keep the files writable only by their owner.",[14,4265,4266,4267,77],{},"The platform verifies every file's sha256 at start and downloads only what is missing or wrong. It refuses a weight file when any file or directory on its path is owned by another account, or is writable by accounts other than its owner, and names that entry in its error. See ",[66,4268,552],{"href":4269},"\u002Fbyodt-cloud\u002Ftroubleshooting#in-the-models-directory-is-owned-by-uid-or-is-writable-by-accounts-other-than-its-owner",[55,4271],{},[58,4273,4275],{"id":4274},"start-it","Start it",[14,4277,4278],{},"From the bundle directory:",[104,4280,4281],{"className":106,"code":277,"language":108,"meta":109,"style":109},[29,4282,4283],{"__ignoreMap":109},[113,4284,4285],{"class":115,"line":116},[113,4286,277],{},[14,4288,4289,4290,4292,4293,4295,4296,4298],{},"That is the whole installation: the command performs first-run setup, then starts the stack. On a bundle that ",[29,4291,1585],{}," has not set up, it first shows the ",[66,4294,2991],{"href":2299}," and asks you to confirm it; without a terminal, add ",[29,4297,547],{},". Expect output like this:",[104,4300,4303],{"className":4301,"code":4302,"language":1615},[1613],"THIRD-PARTY SOFTWARE\n…the notice…\nNothing has been downloaded yet.\nContinue? [y\u002FN] y\n==> Created .env from .env.example — review it before starting.\n==> Container engine: docker (recorded CONTAINER_ENGINE in .env).\n==> Database engine: memgraph (recorded DB_ENGINE in .env).\n==> Seeded mode\u002Fmode.env with the pure open-source defaults.\n==> Wrote a new database password to .env.secrets (mode 0600).\n==> Starting the stack…\n    …your container engine's pull and start output…\n==> Up. Console: http:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002F\n==> First start downloads the embedding model once (about 1.26 GB; '.\u002Fbyodt models pull' does it ahead) and ingests reference data — '.\u002Fbyodt logs platform' and '.\u002Fbyodt logs console-init' to follow.\n",[29,4304,4302],{"__ignoreMap":109},[14,4306,4307,4308,4310,4311,1052,4314,4316],{},"After ",[29,4309,1585],{},", the notice and the ",[29,4312,4313],{},"Created .env",[29,4315,3995],{}," lines do not appear: setup did that part.",[14,4318,4319,4320,4322,4323,4325,4326,77],{},"The ",[29,4321,4313],{}," line asks you to review ",[29,4324,627],{},", but the start does not wait: it goes ahead with the defaults. If you meant to change a setting first, see ",[66,4327,318],{"href":317},[296,4329,4331],{"className":4330},[299,300],[14,4332,4333,391,4335,4337,4338,4341,4342,4344],{},[24,4334,305],{},[29,4336,1934],{}," returning does ",[24,4339,4340],{},"not"," mean the deployment is ready. It means the containers have started. The platform may still be downloading the embedding model and embedding classes in the background. Use the checks in ",[66,4343,1917],{"href":1916}," to know when it is done.",[55,4346],{},[58,4348,4350],{"id":4349},"what-happens-on-the-first-start","What happens on the first start",[14,4352,4353],{},"You do not need to follow this to install, but it explains what you see in the logs and why the first start is slower than later ones.",[344,4355,4357],{"id":4356},"setup-before-anything-starts","Setup, before anything starts",[348,4359,4362],{"className":4360,"tabIndex":352,"role":353,"ariaLabel":4361},[351],"Table: Setup, before anything starts",[356,4363,4364,4373],{},[359,4365,4366],{},[362,4367,4368,4370],{},[365,4369,992],{},[365,4371,4372],{},"What it creates",[372,4374,4375,4400,4446,4465],{},[362,4376,4377,4381],{},[377,4378,4379],{},[24,4380,3365],{},[377,4382,4383,4385,4386,4388,4389,4391,4392,4394,4395,4397,4398,77],{},[29,4384,627],{},", copied from ",[29,4387,1505],{},". The detected container engine is appended as ",[29,4390,631],{}," and the database engine as ",[29,4393,3283],{},", unless ",[29,4396,627],{}," already sets them. On Neo4j, the image is also recorded as ",[29,4399,923],{},[362,4401,4402,4407],{},[377,4403,4404],{},[24,4405,4406],{},"Runtime directories",[377,4408,4409,479,4412,479,4415,479,4417,479,4420,479,4423,479,4426,1052,4429,4431,4432,1052,4435,4438,4439,1052,4442,4445],{},[29,4410,4411],{},"modules\u002F",[29,4413,4414],{},"schema\u002F",[29,4416,2397],{},[29,4418,4419],{},"data\u002Fmodels\u002F",[29,4421,4422],{},"data\u002Fcontent-cache\u002F",[29,4424,4425],{},"mode\u002F",[29,4427,4428],{},"tls\u002F",[29,4430,1055],{}," (unless you created it already), plus the database's own: ",[29,4433,4434],{},"data\u002Fmemgraph-log\u002F",[29,4436,4437],{},"data\u002Fmemgraph\u002F"," on Memgraph, ",[29,4440,4441],{},"data\u002Fneo4j-logs\u002F",[29,4443,4444],{},"data\u002Fneo4j\u002F"," on Neo4j. The data directory is created only for a host bind mount.",[362,4447,4448,4453],{},[377,4449,4450],{},[24,4451,4452],{},"Database password",[377,4454,4455,4456,3314,4458,4460,4461,77],{},"A freshly generated password in ",[29,4457,1051],{},[29,4459,1310],{},". It is created once and never regenerated. See ",[66,4462,4464],{"href":4463},"\u002Fbyodt-cloud\u002Fconfiguration#the-generated-secret-file","Configuration → The generated secret file",[362,4466,4467,4472],{},[377,4468,4469],{},[24,4470,4471],{},"Mode layer",[377,4473,4474,4477],{},[29,4475,4476],{},"mode\u002Fmode.env",", seeded with the standalone defaults.",[14,4479,4480,4481,4483],{},"All of this is idempotent. Every later ",[29,4482,1934],{}," repeats the checks silently, so a deployment that lost a runtime directory repairs itself instead of failing.",[344,4485,4487],{"id":4486},"the-start-sequence","The start sequence",[104,4489,4493],{"className":4490,"code":4491,"language":4492,"meta":109,"style":109},"language-mermaid shiki shiki-themes github-light github-dark-dimmed","sequenceDiagram\n  autonumber\n  participant You\n  participant db\n  participant init as console-init\n  participant platform\n  participant proxy\n  participant console\n  You->>db: .\u002Fbyodt up starts the database\n  You->>console: starts the console (it depends on nothing)\n  db-->>init: healthy — answers a query\n  init->>init: check the embedding model, place the schema\n  init->>init: download, verify and install the signed modules\n  init->>init: ingest the MITRE reference data, then exit\n  init-->>platform: completed successfully\n  platform->>proxy: started\n  proxy-->>You: front door open on port 3000\n  Note over platform: In the background: download the model,\u003Cbr\u002F>load it, embed every class\n","mermaid",[29,4494,4495,4500,4505,4510,4515,4520,4525,4530,4535,4540,4545,4550,4555,4560,4565,4570,4575,4580],{"__ignoreMap":109},[113,4496,4497],{"class":115,"line":116},[113,4498,4499],{},"sequenceDiagram\n",[113,4501,4502],{"class":115,"line":140},[113,4503,4504],{},"  autonumber\n",[113,4506,4507],{"class":115,"line":180},[113,4508,4509],{},"  participant You\n",[113,4511,4512],{"class":115,"line":187},[113,4513,4514],{},"  participant db\n",[113,4516,4517],{"class":115,"line":193},[113,4518,4519],{},"  participant init as console-init\n",[113,4521,4522],{"class":115,"line":199},[113,4523,4524],{},"  participant platform\n",[113,4526,4527],{"class":115,"line":205},[113,4528,4529],{},"  participant proxy\n",[113,4531,4532],{"class":115,"line":210},[113,4533,4534],{},"  participant console\n",[113,4536,4537],{"class":115,"line":216},[113,4538,4539],{},"  You->>db: .\u002Fbyodt up starts the database\n",[113,4541,4542],{"class":115,"line":222},[113,4543,4544],{},"  You->>console: starts the console (it depends on nothing)\n",[113,4546,4547],{"class":115,"line":228},[113,4548,4549],{},"  db-->>init: healthy — answers a query\n",[113,4551,4552],{"class":115,"line":234},[113,4553,4554],{},"  init->>init: check the embedding model, place the schema\n",[113,4556,4557],{"class":115,"line":240},[113,4558,4559],{},"  init->>init: download, verify and install the signed modules\n",[113,4561,4562],{"class":115,"line":245},[113,4563,4564],{},"  init->>init: ingest the MITRE reference data, then exit\n",[113,4566,4567],{"class":115,"line":251},[113,4568,4569],{},"  init-->>platform: completed successfully\n",[113,4571,4572],{"class":115,"line":257},[113,4573,4574],{},"  platform->>proxy: started\n",[113,4576,4577],{"class":115,"line":263},[113,4578,4579],{},"  proxy-->>You: front door open on port 3000\n",[113,4581,4582],{"class":115,"line":268},[113,4583,4584],{},"  Note over platform: In the background: download the model,\u003Cbr\u002F>load it, embed every class\n",[656,4586,4587,4596,4604,4622,4630],{},[21,4588,4589,4595],{},[24,4590,4591,4594],{},[29,4592,4593],{},"db"," starts."," It counts as healthy only once it answers a query, not merely once its process is up.",[21,4597,4598,4603],{},[24,4599,4600,4602],{},[29,4601,945],{}," runs"," once the database is healthy. It checks that the platform's embedding model is the one this release's MITRE data was embedded with, and stops the start if it is not. It then places the schema, downloads the module payloads for this release, verifies every signature against the pinned release identity, checks each download's digest, installs the modules, and ingests the MITRE ATT&CK, ATLAS and D3FEND reference data. Then it exits.",[21,4605,4606,4612,4613,391,4616,4618,4619,4621],{},[24,4607,4608,4611],{},[29,4609,4610],{},"platform"," starts"," only after the database is healthy ",[586,4614,4615],{},"and",[29,4617,945],{}," has completed successfully. That dependency is declared, so the platform cannot start against an unseeded graph or a stale schema. In the background it then downloads the embedding model's weights (unless ",[29,4620,904],{}," placed them), loads the model, and embeds every class once — about 0.2 s per class on a 4-vCPU host: 15–20 seconds for the roughly 80 bundled classes, a few minutes with cloud content packages (about 1,200 classes). Matching uses names meanwhile.",[21,4623,4624,4629],{},[24,4625,4626,4611],{},[29,4627,4628],{},"proxy"," and publishes the front door.",[21,4631,4632,4637],{},[24,4633,4634],{},[29,4635,4636],{},"console"," has no dependency on any other service, so it starts straight away and can report on the deployment even while the rest is down.",[344,4639,4641],{"id":4640},"how-long-it-takes","How long it takes",[14,4643,4644],{},"There is no fixed figure: it depends on your connection and disk. As a reference point, on one fresh install the stack was serving within minutes, and the embedding model became ready in under half an hour. The health checks are deliberately patient, so a slow start is waited out rather than aborted. The model download does not hold the start: the platform serves throughout, matching by name until the model is ready.",[14,4646,4647],{},"Later starts skip nearly all of it. The images are cached, the weights are on disk, the classes are already embedded, module payloads whose digest already matches are skipped, and the ingest is skipped when the reference data has not changed. A normal start takes well under a minute.",[344,4649,4651],{"id":4650},"follow-the-progress","Follow the progress",[104,4653,4655],{"className":106,"code":4654,"language":108,"meta":109,"style":109},".\u002Fbyodt logs console-init     # schema, module install, and data ingest\n.\u002Fbyodt logs platform         # model download, load, and class embedding\n.\u002Fbyodt logs                  # everything, interleaved\n",[29,4656,4657,4662,4667],{"__ignoreMap":109},[113,4658,4659],{"class":115,"line":116},[113,4660,4661],{},".\u002Fbyodt logs console-init     # schema, module install, and data ingest\n",[113,4663,4664],{"class":115,"line":140},[113,4665,4666],{},".\u002Fbyodt logs platform         # model download, load, and class embedding\n",[113,4668,4669],{"class":115,"line":180},[113,4670,4671],{},".\u002Fbyodt logs                  # everything, interleaved\n",[14,4673,4674,4676],{},[29,4675,4171],{}," stops following the log. It never stops the deployment.",[344,4678,4680],{"id":4679},"if-part-of-it-fails","If part of it fails",[14,4682,4683,4684,4686],{},"The two halves of ",[29,4685,945],{}," fail differently, on purpose:",[348,4688,4691],{"className":4689,"tabIndex":352,"role":353,"ariaLabel":4690},[351],"Table: If part of it fails",[356,4692,4693,4702],{},[359,4694,4695],{},[362,4696,4697,4700],{},[365,4698,4699],{},"Problem",[365,4701,2859],{},[372,4703,4704,4720],{},[362,4705,4706,4711],{},[377,4707,4708],{},[24,4709,4710],{},"A version, schema, or embedding-model problem",[377,4712,4713,4714,4716,4717],{},"The start is aborted and the platform is not started. A schema that disagrees with the code serving it must not serve, and a model that did not make the reference vectors would not match them. ",[29,4715,1934],{}," fails with an error ending ",[29,4718,4719],{},"'.\u002Fbyodt logs console-init' says why.",[362,4721,4722,4727],{},[377,4723,4724],{},[24,4725,4726],{},"A module or data problem",[377,4728,4729],{},"The fault is recorded and the stack still comes up. You get a running deployment with a specific diagnosis in the console, instead of a silent empty one.",[14,4731,4732,4733,4736,4737,77],{},"Either way, go to ",[66,4734,552],{"href":4735},"\u002Fbyodt-cloud\u002Ftroubleshooting",": every state the one-shot can report is listed there with its fix. For a first start that seems stuck, see ",[66,4738,4740],{"href":4739},"\u002Fbyodt-cloud\u002Ftroubleshooting#it-is-taking-a-very-long-time","It is taking a very long time",[55,4742],{},[58,4744,1917],{"id":4745},"verify-the-deployment-is-healthy",[14,4747,4748],{},"Run all four checks. Each one tests something different.",[344,4750,4752],{"id":4751},"_1-every-service-is-running","1. Every service is running",[104,4754,4756],{"className":106,"code":4755,"language":108,"meta":109,"style":109},".\u002Fbyodt status\n",[29,4757,4758],{"__ignoreMap":109},[113,4759,4760],{"class":115,"line":116},[113,4761,4755],{},[14,4763,4764,391,4767,479,4769,479,4771,1052,4773,4775,4776,2949,4779,479,4781,1052,4783,4785,4786,4789],{},[24,4765,4766],{},"Expected:",[29,4768,4593],{},[29,4770,4610],{},[29,4772,4628],{},[29,4774,4636],{}," are ",[29,4777,4778],{},"Up",[29,4780,4593],{},[29,4782,4610],{},[29,4784,4628],{}," report ",[29,4787,4788],{},"(healthy)",". Columns trimmed:",[104,4791,4794],{"className":4792,"code":4793,"language":1615},[1613],"NAME                    SERVICE    STATUS                    PORTS\ndethernety-console-1    console    Up 27 minutes\ndethernety-db-1         db         Up 27 minutes (healthy)   7687\u002Ftcp\ndethernety-platform-1   platform   Up 27 minutes (healthy)   3003\u002Ftcp\ndethernety-proxy-1      proxy      Up 27 minutes (healthy)   127.0.0.1:3000->80\u002Ftcp\n",[29,4795,4793],{"__ignoreMap":109},[14,4797,4319,4798,4800,4801,1052,4803,4805],{},[29,4799,4636],{}," has no health status: its image has no shell to run a health check in. The ",[29,4802,4593],{},[29,4804,4610],{}," ports are internal to the stack; only the proxy publishes one.",[14,4807,4808,4810,4811,4814],{},[29,4809,945],{}," is missing from this list, and that is correct. It is a one-shot that has already exited, and ",[29,4812,4813],{},"status"," lists running containers only. To see it, include stopped containers:",[104,4816,4818],{"className":106,"code":4817,"language":108,"meta":109,"style":109},".\u002Fbyodt status -a\n",[29,4819,4820],{"__ignoreMap":109},[113,4821,4822],{"class":115,"line":116},[113,4823,4817],{},[104,4825,4828],{"className":4826,"code":4827,"language":1615},[1613],"NAME                        SERVICE        STATUS\ndethernety-console-init-1   console-init   Exited (0) 27 minutes ago\n",[29,4829,4827],{"__ignoreMap":109},[14,4831,4832,4835,4836,77],{},[29,4833,4834],{},"Exited (0)"," is success. Any other exit code means it stopped the start; see ",[66,4837,552],{"href":4838},"\u002Fbyodt-cloud\u002Ftroubleshooting#the-platform-never-starts-and-console-init-exited-non-zero",[344,4840,4842],{"id":4841},"_2-the-front-door-answers","2. The front door answers",[104,4844,4846],{"className":106,"code":4845,"language":108,"meta":109,"style":109},"curl -fsS http:\u002F\u002F127.0.0.1:3000\u002Fhealthz\n",[29,4847,4848],{"__ignoreMap":109},[113,4849,4850],{"class":115,"line":116},[113,4851,4845],{},[14,4853,4854,391,4856],{},[24,4855,4766],{},[29,4857,4858],{},"ok",[14,4860,4861],{},"This is the proxy answering for itself, so it succeeds even when the platform behind it is down. That is what makes it useful: it tells a front-door problem apart from a platform problem.",[344,4863,4865],{"id":4864},"_3-the-platform-and-the-console-are-healthy","3. The platform and the console are healthy",[104,4867,4869],{"className":106,"code":4868,"language":108,"meta":109,"style":109},"curl -fsS http:\u002F\u002F127.0.0.1:3000\u002Fhealth\n",[29,4870,4871],{"__ignoreMap":109},[113,4872,4873],{"class":115,"line":116},[113,4874,4868],{},[14,4876,4877,4879,4880,4882,4883,4886,4887,4890],{},[24,4878,4766],{}," a JSON document whose ",[29,4881,4813],{}," is ",[29,4884,4885],{},"healthy",", with a ",[29,4888,4889],{},"services"," section covering the database, GraphQL, the loaded modules, and the embedder. Formatted and trimmed:",[104,4892,4894],{"className":1197,"code":4893,"language":1199,"meta":109,"style":109},"{\n  \"status\": \"healthy\",\n  \"version\": \"0.14.0\",\n  \"services\": {\n    \"database\": { \"status\": \"up\", \"responseTime\": 1 },\n    \"graphql\":  { \"status\": \"up\" },\n    \"modules\":  { \"status\": \"up\", \"loaded\": 3, \"healthy\": 3 },\n    \"embedder\": { \"state\": \"ready\", \"runtime\": \"onnx\", \"profile\": \"embeddinggemma-300m-retrieval-v1\" }\n  }\n}\n",[29,4895,4896,4900,4912,4924,4931,4960,4976,5008,5046,5050],{"__ignoreMap":109},[113,4897,4898],{"class":115,"line":116},[113,4899,1206],{"class":1149},[113,4901,4902,4905,4907,4910],{"class":115,"line":140},[113,4903,4904],{"class":1211},"  \"status\"",[113,4906,1223],{"class":1149},[113,4908,4909],{"class":1153},"\"healthy\"",[113,4911,1229],{"class":1149},[113,4913,4914,4917,4919,4922],{"class":115,"line":180},[113,4915,4916],{"class":1211},"  \"version\"",[113,4918,1223],{"class":1149},[113,4920,4921],{"class":1153},"\"0.14.0\"",[113,4923,1229],{"class":1149},[113,4925,4926,4929],{"class":115,"line":187},[113,4927,4928],{"class":1211},"  \"services\"",[113,4930,1215],{"class":1149},[113,4932,4933,4936,4939,4942,4944,4947,4949,4952,4954,4957],{"class":115,"line":193},[113,4934,4935],{"class":1211},"    \"database\"",[113,4937,4938],{"class":1149},": { ",[113,4940,4941],{"class":1211},"\"status\"",[113,4943,1223],{"class":1149},[113,4945,4946],{"class":1153},"\"up\"",[113,4948,479],{"class":1149},[113,4950,4951],{"class":1211},"\"responseTime\"",[113,4953,1223],{"class":1149},[113,4955,1008],{"class":4956},"sviXB",[113,4958,4959],{"class":1149}," },\n",[113,4961,4962,4965,4968,4970,4972,4974],{"class":115,"line":199},[113,4963,4964],{"class":1211},"    \"graphql\"",[113,4966,4967],{"class":1149},":  { ",[113,4969,4941],{"class":1211},[113,4971,1223],{"class":1149},[113,4973,4946],{"class":1153},[113,4975,4959],{"class":1149},[113,4977,4978,4981,4983,4985,4987,4989,4991,4994,4996,4998,5000,5002,5004,5006],{"class":115,"line":205},[113,4979,4980],{"class":1211},"    \"modules\"",[113,4982,4967],{"class":1149},[113,4984,4941],{"class":1211},[113,4986,1223],{"class":1149},[113,4988,4946],{"class":1153},[113,4990,479],{"class":1149},[113,4992,4993],{"class":1211},"\"loaded\"",[113,4995,1223],{"class":1149},[113,4997,1039],{"class":4956},[113,4999,479],{"class":1149},[113,5001,4909],{"class":1211},[113,5003,1223],{"class":1149},[113,5005,1039],{"class":4956},[113,5007,4959],{"class":1149},[113,5009,5010,5013,5015,5018,5020,5023,5025,5028,5030,5033,5035,5038,5040,5043],{"class":115,"line":210},[113,5011,5012],{"class":1211},"    \"embedder\"",[113,5014,4938],{"class":1149},[113,5016,5017],{"class":1211},"\"state\"",[113,5019,1223],{"class":1149},[113,5021,5022],{"class":1153},"\"ready\"",[113,5024,479],{"class":1149},[113,5026,5027],{"class":1211},"\"runtime\"",[113,5029,1223],{"class":1149},[113,5031,5032],{"class":1153},"\"onnx\"",[113,5034,479],{"class":1149},[113,5036,5037],{"class":1211},"\"profile\"",[113,5039,1223],{"class":1149},[113,5041,5042],{"class":1153},"\"embeddinggemma-300m-retrieval-v1\"",[113,5044,5045],{"class":1149}," }\n",[113,5047,5048],{"class":115,"line":216},[113,5049,1244],{"class":1149},[113,5051,5052],{"class":115,"line":222},[113,5053,1249],{"class":1149},[14,5055,5056],{},"How to read the result:",[348,5058,5061],{"className":5059,"tabIndex":352,"role":353,"ariaLabel":5060},[351],"Table: 3. The platform and the console are healthy",[356,5062,5063,5073],{},[359,5064,5065],{},[362,5066,5067,5070],{},[365,5068,5069],{},"You see",[365,5071,5072],{},"Meaning",[372,5074,5075,5088,5110],{},[362,5076,5077,5082],{},[377,5078,5079],{},[29,5080,5081],{},"\"status\": \"healthy\"",[377,5083,5084,5085,77],{},"Everything is up and the embedder is ",[29,5086,5087],{},"ready",[362,5089,5090,5101],{},[377,5091,5092,2103,5095,494,5098],{},[29,5093,5094],{},"\"status\": \"degraded\"",[29,5096,5097],{},"\"embedder\": { \"state\": \"downloading\" }",[29,5099,5100],{},"\"loading\"",[377,5102,5103,5104,5107,5108,77],{},"Normal right after a first start. The platform serves meanwhile, and class search shows ",[586,5105,5106],{},"Semantic search is unavailable on this deployment — showing name-based matches."," Wait, and follow ",[29,5109,1877],{},[362,5111,5112,5117],{},[377,5113,5114,5116],{},[29,5115,485],{}," fails with an HTTP error",[377,5118,5119,5120,5123,5124,77],{},"The platform is unhealthy (it answers ",[29,5121,5122],{},"503","), or not reachable through the front door. See ",[66,5125,552],{"href":5126},"\u002Fbyodt-cloud\u002Ftroubleshooting#first-gather-the-facts",[14,5128,5129,5131,5132,5134,5135,149,5138,77],{},[29,5130,4885],{}," means the model is ready, but the classes may still be embedding for a short while. Class matching uses names until ",[29,5133,1877],{}," shows ",[29,5136,5137],{},"Embeddings resolved",[66,5139,5141],{"href":5140},"\u002Fbyodt-cloud\u002Ftroubleshooting#matching-uses-names-after-a-start","Matching uses names after a start",[296,5143,5146],{"className":5144},[299,5145],"callout-tip",[14,5147,5148,5151,5152,5155,5156,5159],{},[24,5149,5150],{},"Tip:"," With ",[29,5153,5154],{},"jq"," installed, ",[29,5157,5158],{},"curl -fsS http:\u002F\u002F127.0.0.1:3000\u002Fhealth | jq '.status, .services.embedder.state'"," prints just the two values you are waiting for.",[14,5161,5162],{},"The console has its own probe on the same address:",[104,5164,5166],{"className":106,"code":5165,"language":108,"meta":109,"style":109},"curl -fsS http:\u002F\u002F127.0.0.1:3000\u002Fconsole\u002Fhealthz\n",[29,5167,5168],{"__ignoreMap":109},[113,5169,5170],{"class":115,"line":116},[113,5171,5165],{},[14,5173,5174,391,5176],{},[24,5175,4766],{},[29,5177,4858],{},[296,5179,5181],{"className":5180},[299,300],[14,5182,5183,5185,5186,5188,5189,149,5192,5196,5197,5200,5201,5203,5204,5206],{},[24,5184,327],{}," Once you install a TLS certificate, these addresses become ",[29,5187,1729],{},", and a self-signed certificate also needs ",[29,5190,5191],{},"curl -k",[66,5193,5195],{"href":5194},"\u002Fbyodt-cloud\u002Foperations#tls-at-the-front-door","TLS at the front door",". After you connect the deployment to the cloud, ",[29,5198,5199],{},"\u002Fhealth"," reports only ",[29,5202,4813],{}," and a timestamp, without the ",[29,5205,4889],{}," section.",[344,5208,5210],{"id":5209},"_4-the-console-reports-a-healthy-deployment","4. The console reports a healthy deployment",[14,5212,5213],{},"Open the console:",[104,5215,5216],{"className":106,"code":294,"language":108,"meta":109,"style":109},[29,5217,5218],{"__ignoreMap":109},[113,5219,5220],{"class":115,"line":116},[113,5221,294],{},[14,5223,5224,5225,5228,5229,5232],{},"This prints the console address and, on macOS, opens it in your browser. You can also browse to ",[66,5226,40],{"href":40,"rel":5227},[75]," directly. In the standalone configuration there is no sign-in: the page loads straight to the ",[24,5230,5231],{},"Deployment"," dashboard.",[14,5234,5235],{},[5236,5237],"img",{"alt":5238,"src":5239},"The Dethernety Console's Deployment page on its Overview tab. Numbered markers highlight four things: 1, the green Healthy verdict; 2, the Placed column reading \"placed\" for each of the three modules; 3, the Data ingest section reading Status ok, with 29,446 statements; 4, the Pre-cloud badge in the header beside \"authentication disabled\".","\u002Fguides\u002Fbyodt-cloud\u002Fimages\u002Fconsole-healthy.webp",[14,5241,5242],{},"Check each numbered item:",[348,5244,5247],{"className":5245,"tabIndex":352,"role":353,"ariaLabel":5246},[351],"Table: 4. The console reports a healthy deployment",[356,5248,5249,5261],{},[359,5250,5251],{},[362,5252,5253,5255,5258],{},[365,5254,1759],{},[365,5256,5257],{},"What you should see",[365,5259,5260],{},"What it means",[372,5262,5263,5279,5301,5323,5338],{},[362,5264,5265,5269,5276],{},[377,5266,5267],{},[24,5268,1008],{},[377,5270,5271,5272,5275],{},"A green ",[24,5273,5274],{},"Healthy"," verdict at the top.",[377,5277,5278],{},"No failures are being reported.",[362,5280,5281,5285,5294],{},[377,5282,5283],{},[24,5284,1022],{},[377,5286,5287,5288,5291,5292,77],{},"Under ",[24,5289,5290],{},"Modules",", every module reads ",[29,5293,1921],{},[377,5295,5296,5297,5300],{},"The signed module payloads installed. On later starts they read ",[29,5298,5299],{},"skipped",", which is equally good: the copy on disk already matches.",[362,5302,5303,5307,5316],{},[377,5304,5305],{},[24,5306,1039],{},[377,5308,5287,5309,479,5312,5315],{},[24,5310,5311],{},"Data ingest",[29,5313,5314],{},"Status: ok",", with a statement count in the tens of thousands beneath it.",[377,5317,5318,5319,5322],{},"The reference data loaded into the graph. On later starts it reads ",[29,5320,5321],{},"skipped-unchanged",", which is equally good.",[362,5324,5325,5329,5335],{},[377,5326,5327],{},[24,5328,1064],{},[377,5330,1166,5331,5334],{},[24,5332,5333],{},"Pre-cloud"," badge in the header, top right.",[377,5336,5337],{},"The deployment is running standalone.",[362,5339,5340,5342,5345],{},[377,5341,3083],{},[377,5343,5344],{},"No banners above the tabs.",[377,5346,5347,5348,5351,5352,5356],{},"Nothing needs your attention. The ",[24,5349,5350],{},"Connect to cloud"," card is an invitation, not a warning; see ",[66,5353,5355],{"href":5354},"\u002Fbyodt-cloud\u002Fcloud","Cloud"," if you want it.",[14,5358,1166,5359,494,5362,5365,5366,77],{},[24,5360,5361],{},"Degraded",[24,5363,5364],{},"Fault"," verdict, or any banner, is explained in ",[66,5367,552],{"href":5368},"\u002Fbyodt-cloud\u002Ftroubleshooting#verdict-shows-degraded-or-fault",[55,5370],{},[58,5372,5374],{"id":5373},"open-the-platform","Open the platform",[14,5376,5377,5378,5381,5382,5385],{},"Browse to ",[66,5379,31],{"href":31,"rel":5380},[75],", or select ",[24,5383,5384],{},"Open platform →"," in the console header.",[14,5387,5388,5390,5391,479,5394,479,5397,1052,5400,77],{},[24,5389,1865],{}," the Dethernety home page loads, with cards for ",[24,5392,5393],{},"Data Flow Models",[24,5395,5396],{},"Control Catalog",[24,5398,5399],{},"Issues",[24,5401,5290],{},[14,5403,5404],{},[5236,5405],{"alt":5406,"src":5407},"The Dethernety platform home page at 127.0.0.1:3000. A banner reads \"de-threat your security posture with intelligent threat analysis\" above a Browse Content button, and below it four cards: Data Flow Models with Open Model, Control Catalog with Open Control, Issues with Manage Issues, and Modules with Configure Modules.","\u002Fguides\u002Fplatform\u002Fimages\u002Ffirst-model\u002Fplatform-home.webp",[14,5409,5410,5411,5415,5416,5420],{},"The deployment is installed. Continue with the ",[66,5412,5414],{"href":5413},"\u002Fplatform\u002Fquick-start#draw-the-model","Quick Start"," for a first finding in minutes, or ",[66,5417,5419],{"href":5418},"\u002Fplatform\u002Fbuilding-your-first-model","Building Your First Model"," for a full threat model.",[55,5422],{},[58,5424,5426],{"id":5425},"commands-you-will-use","Commands you will use",[14,5428,5429,5430,5433,5434,77],{},"Run these from the bundle directory. ",[29,5431,5432],{},".\u002Fbyodt help"," lists every command; the full reference is in ",[66,5435,5437],{"href":5436},"\u002Fbyodt-cloud\u002Foperations#command-reference","Operations → Command reference",[348,5439,5442],{"className":5440,"tabIndex":352,"role":353,"ariaLabel":5441},[351],"Table: Commands you will use",[356,5443,5444,5452],{},[359,5445,5446],{},[362,5447,5448,5450],{},[365,5449,3663],{},[365,5451,2432],{},[372,5453,5454,5466,5476,5490,5510,5520,5533],{},[362,5455,5456,5460],{},[377,5457,5458],{},[29,5459,1934],{},[377,5461,5462,5463,5465],{},"Start the deployment, and apply changes to ",[29,5464,627],{},". Safe to run at any time.",[362,5467,5468,5473],{},[377,5469,5470],{},[29,5471,5472],{},".\u002Fbyodt down",[377,5474,5475],{},"Stop the deployment. Data is kept.",[362,5477,5478,5483],{},[377,5479,5480],{},[29,5481,5482],{},".\u002Fbyodt status",[377,5484,5485,5486,5489],{},"Show the running services and their health. Add ",[29,5487,5488],{},"-a"," to include stopped ones.",[362,5491,5492,5497],{},[377,5493,5494],{},[29,5495,5496],{},".\u002Fbyodt logs [service]",[377,5498,5499,5500,479,5502,479,5504,479,5506,479,5508,77],{},"Follow the logs of every service, or one: ",[29,5501,4593],{},[29,5503,945],{},[29,5505,4610],{},[29,5507,4628],{},[29,5509,4636],{},[362,5511,5512,5517],{},[377,5513,5514],{},[29,5515,5516],{},".\u002Fbyodt console",[377,5518,5519],{},"Print the console address, and open it on macOS.",[362,5521,5522,5527],{},[377,5523,5524],{},[29,5525,5526],{},".\u002Fbyodt backup",[377,5528,5529,5530,77],{},"Back up the graph to ",[29,5531,5532],{},"backups\u002F",[362,5534,5535,5540],{},[377,5536,5537],{},[29,5538,5539],{},".\u002Fbyodt version",[377,5541,5542],{},"Show the control script's version and the pinned release set.",[55,5544],{},[58,5546,5548],{"id":5547},"next-steps","Next steps",[18,5550,5551,5559,5567,5585,5596,5604],{},[21,5552,5553,5556,5557,77],{},[24,5554,5555],{},"Build your first model."," Follow ",[66,5558,5419],{"href":5418},[21,5560,5561,5564,5565,77],{},[24,5562,5563],{},"Secure the front door."," The default is plain HTTP bound to loopback, which suits a single operator on a trusted machine. Anything else — a shared host, access from another machine — should terminate TLS first. See ",[66,5566,5195],{"href":5194},[21,5568,5569,391,5572,5574,5575,5577,5578,5580,5581,77],{},[24,5570,5571],{},"Set up backups.",[29,5573,5526],{}," copies the graph out to ",[29,5576,5532],{}," — with no downtime on Memgraph; on Neo4j the database stops while it is dumped. Copy the result off the machine, and keep ",[29,5579,1051],{}," safe too. See ",[66,5582,5584],{"href":5583},"\u002Fbyodt-cloud\u002Foperations#backing-up-and-restoring-the-graph","Backing up and restoring the graph",[21,5586,5587,391,5590,5592,5593,5595],{},[24,5588,5589],{},"Learn the settings.",[66,5591,3365],{"href":3364}," documents every value in ",[29,5594,627],{},", and which command applies which kind of change.",[21,5597,5598,5601,5602,77],{},[24,5599,5600],{},"Connect the deployment"," to cloud sign-in and content packages, if you want them. See ",[66,5603,5355],{"href":5354},[21,5605,5606,5609,5610,77],{},[24,5607,5608],{},"If something went wrong",", start at ",[66,5611,552],{"href":4735},[5613,5614,5615],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .sOLd2, html code.shiki .sOLd2{--shiki-default:#6F42C1;--shiki-dark:#F69D50}html pre.shiki code .s7YZ4, html code.shiki .s7YZ4{--shiki-default:#D73A49;--shiki-dark:#F47067}html pre.shiki code .sYgZi, html code.shiki .sYgZi{--shiki-default:#24292E;--shiki-dark:#ADBAC7}html pre.shiki code .s-HuK, html code.shiki .s-HuK{--shiki-default:#032F62;--shiki-dark:#96D0FF}html pre.shiki code .snmFh, html code.shiki .snmFh{--shiki-default:#005CC5;--shiki-dark:#8DDB8C}html pre.shiki code .sviXB, html code.shiki .sviXB{--shiki-default:#005CC5;--shiki-dark:#6CB6FF}",{"title":109,"searchDepth":180,"depth":180,"links":5617},[5618,5619,5625,5632,5643,5650,5655,5656,5657,5660,5661,5668,5674,5675,5676],{"id":60,"depth":140,"text":61},{"id":341,"depth":140,"text":342,"children":5620},[5621,5622,5623,5624],{"id":69,"depth":180,"text":346},{"id":592,"depth":180,"text":593},{"id":639,"depth":180,"text":640},{"id":758,"depth":180,"text":466},{"id":973,"depth":140,"text":332,"children":5626},[5627,5628,5629,5630,5631],{"id":1102,"depth":180,"text":1103},{"id":1509,"depth":180,"text":1510},{"id":1620,"depth":180,"text":1621},{"id":1844,"depth":180,"text":1845},{"id":1901,"depth":180,"text":1902},{"id":1952,"depth":140,"text":153,"children":5633},[5634,5635,5637,5638,5639,5640,5641,5642],{"id":2038,"depth":180,"text":2005},{"id":2144,"depth":180,"text":5636},"With get-byodt.sh from the release",{"id":2252,"depth":180,"text":2253},{"id":2415,"depth":180,"text":2416},{"id":2569,"depth":180,"text":2570},{"id":2658,"depth":180,"text":2486},{"id":2833,"depth":180,"text":2280},{"id":2943,"depth":180,"text":2290},{"id":2981,"depth":140,"text":5644,"children":5645},"Set up with .\u002Fbyodt setup",[5646,5647,5648,5649],{"id":3022,"depth":180,"text":3023},{"id":3249,"depth":180,"text":3250},{"id":3418,"depth":180,"text":3419},{"id":3449,"depth":180,"text":3450},{"id":3540,"depth":140,"text":2300,"children":5651},[5652,5653,5654],{"id":3564,"depth":180,"text":3565},{"id":3584,"depth":180,"text":3585},{"id":3622,"depth":180,"text":3623},{"id":3708,"depth":140,"text":1524},{"id":3944,"depth":140,"text":318},{"id":4130,"depth":140,"text":4131,"children":5658},[5659],{"id":4224,"depth":180,"text":968},{"id":4274,"depth":140,"text":4275},{"id":4349,"depth":140,"text":4350,"children":5662},[5663,5664,5665,5666,5667],{"id":4356,"depth":180,"text":4357},{"id":4486,"depth":180,"text":4487},{"id":4640,"depth":180,"text":4641},{"id":4650,"depth":180,"text":4651},{"id":4679,"depth":180,"text":4680},{"id":4745,"depth":140,"text":1917,"children":5669},[5670,5671,5672,5673],{"id":4751,"depth":180,"text":4752},{"id":4841,"depth":180,"text":4842},{"id":4864,"depth":180,"text":4865},{"id":5209,"depth":180,"text":5210},{"id":5373,"depth":140,"text":5374},{"id":5425,"depth":140,"text":5426},{"id":5547,"depth":140,"text":5548},"Install Dethernety on your own machine: check the requirements, download and verify the signed bundle, start it, and confirm the deployment is healthy","md",{"category":5680,"position":140,"tags":5681},"documentation",[511,5682,5683,5684,5685,5686,1346,5687],"deployment","installation","getting-started","quick-start","docker","self-hosted","\u002Fbyodt-cloud\u002Finstallation",{"title":5,"description":5677},"02.byodt-cloud\u002F01.installation","linVe5CapGAsvsTqlBmRbP9FjDWU5qHdAxGT5oIqLck",[5693,5745,5773,5827,5861,5905,5920,5990],{"title":5694,"description":5695,"path":5696,"stem":5697,"children":5698,"page":-1},"Platform","Modelling, analysis, findings and controls in the Dethernety platform.","\u002Fplatform","01.platform",[5699,5703,5707,5710,5715,5720,5725,5730,5735,5740],{"title":5700,"path":5696,"stem":5701,"description":5702},"Dethernety User Documentation","01.platform\u002Findex","User guide for the Dethernety threat modeling platform",{"title":5414,"path":5704,"stem":5705,"description":5706},"\u002Fplatform\u002Fquick-start","01.platform\u002F01.quick-start","Install Dethernety on your own machine, draw a four-element model and read its first threat finding.",{"title":5419,"path":5418,"stem":5708,"description":5709},"01.platform\u002F02.building-your-first-model","Build a threat model of an online store in about 30 minutes, run a Threat Report on it, and raise an issue from a finding.",{"title":5711,"path":5712,"stem":5713,"description":5714},"Security Analysis Workflow","\u002Fplatform\u002Fsecurity-analysis-workflow","01.platform\u002F03.security-analysis-workflow","How to run security analysis and interpret results to improve your threat models.",{"title":5716,"path":5717,"stem":5718,"description":5719},"Managing Findings","\u002Fplatform\u002Fmanaging-findings","01.platform\u002F04.managing-findings","Record decisions on system-generated exposures and countermeasures — affirm them as confirmed live risk, or mute them as not applicable, false positive, waived, or superseded — instead of deleting them.",{"title":5721,"path":5722,"stem":5723,"description":5724},"Working with Security Controls","\u002Fplatform\u002Fworking-with-security-controls","01.platform\u002F05.working-with-security-controls","Learn how to create, manage, and assign reusable security controls in Dethernety to protect your threat models.",{"title":5726,"path":5727,"stem":5728,"description":5729},"Issue Management Guide","\u002Fplatform\u002Fissue-management-guide","01.platform\u002F06.issue-management-guide","Issue tracking, filtering, and management in Dethernety.",{"title":5731,"path":5732,"stem":5733,"description":5734},"Boundary Trust Zones","\u002Fplatform\u002Fboundary-trust-zones","01.platform\u002F07.boundary-trust-zones","Record each security boundary's trust zone, business domains, operational role, and approved channels to document how your system is meant to be segmented.",{"title":5736,"path":5737,"stem":5738,"description":5739},"Understanding Modules","\u002Fplatform\u002Funderstanding-modules","01.platform\u002F08.understanding-modules","How Dethernety's module system extends your threat modeling capabilities.",{"title":5741,"path":5742,"stem":5743,"description":5744},"Component Configuration Guide","\u002Fplatform\u002Fcomponent-configuration-guide","01.platform\u002F09.component-configuration-guide","Detailed guide on configuring different types of components and their security implications.",{"title":5746,"description":5747,"path":5748,"stem":5749,"children":5750,"page":-1},"BYODt cloud","Deploying the platform yourself and connecting it to the BYODt cloud.","\u002Fbyodt-cloud","02.byodt-cloud",[5751,5755,5756,5760,5765,5769],{"title":5752,"path":5748,"stem":5753,"description":5754},"BYODt Deployment","02.byodt-cloud\u002Findex","Run Dethernety on your own machine: install, configure, operate, and recover",{"title":5,"path":5688,"stem":5690,"description":5677},{"title":5757,"path":3364,"stem":5758,"description":5759},"Configuring the BYODt Deployment","02.byodt-cloud\u002F02.configuration","The .env settings reference, the generated secret file, database storage, and how to apply a change",{"title":5761,"path":5762,"stem":5763,"description":5764},"Operating the BYODt Deployment","\u002Fbyodt-cloud\u002Foperations","02.byodt-cloud\u002F03.operations","The byodt command reference and the day-to-day tasks: start, stop, inspect, back up, restore, TLS, upgrade, remove",{"title":5766,"path":5354,"stem":5767,"description":5768},"Connecting the BYODt Deployment to the Cloud","02.byodt-cloud\u002F04.cloud","Add cloud sign-in and content packages from the operator console, and disconnect again",{"title":5770,"path":4735,"stem":5771,"description":5772},"Troubleshooting the BYODt Deployment","02.byodt-cloud\u002F05.troubleshooting","Symptom, cause, and fix for the failures this deployment reports",{"title":2012,"description":5774,"path":5775,"stem":5776,"children":5777,"page":-1},"The Claude Code plugin: build a threat model in conversation and publish it to the platform.","\u002Fdethereal","03.dethereal",[5778,5782,5787,5792,5797,5802,5807,5812,5817,5822],{"title":5779,"path":5775,"stem":5780,"description":5781},"Dethereal — Claude Code Plugin for Threat Modeling","03.dethereal\u002Findex","Comprehensive documentation for the Dethereal threat modeling plugin",{"title":5783,"path":5784,"stem":5785,"description":5786},"Getting Started with Dethereal","\u002Fdethereal\u002Fgetting-started","03.dethereal\u002F01.getting-started","Install the plugin, authenticate, and create your first threat model",{"title":5788,"path":5789,"stem":5790,"description":5791},"The 11-Step Guided Workflow","\u002Fdethereal\u002Fguided-workflow","03.dethereal\u002F02.guided-workflow","Complete walkthrough of the \u002Fdethereal:threat-model guided process",{"title":5793,"path":5794,"stem":5795,"description":5796},"Command Reference","\u002Fdethereal\u002Fcommand-reference","03.dethereal\u002F03.command-reference","Complete reference for all 14 Dethereal slash commands",{"title":5798,"path":5799,"stem":5800,"description":5801},"Threat Model Concepts","\u002Fdethereal\u002Fmodel-concepts","03.dethereal\u002F04.model-concepts","Components, boundaries, data flows, classes, attributes, and quality scoring",{"title":5803,"path":5804,"stem":5805,"description":5806},"Discovery and Enrichment","\u002Fdethereal\u002Fdiscovery-and-enrichment","03.dethereal\u002F05.discovery-and-enrichment","Infrastructure scanning, security attributes, MITRE ATT&CK, credentials, and compliance",{"title":5808,"path":5809,"stem":5810,"description":5811},"Sync and Version Control","\u002Fdethereal\u002Fsync-and-version-control","03.dethereal\u002F06.sync-and-version-control","Push\u002Fpull workflow, conflict handling, git integration, and multi-model projects",{"title":5813,"path":5814,"stem":5815,"description":5816},"Review and Attack Surface Analysis","\u002Fdethereal\u002Freview-and-analysis","03.dethereal\u002F07.review-and-analysis","Quality review, attack surface summary, and platform analysis integration",{"title":5818,"path":5819,"stem":5820,"description":5821},"Agents, Tools, and Hooks","\u002Fdethereal\u002Fagents-and-architecture","03.dethereal\u002F08.agents-and-architecture","How the 5 AI agents, 22 MCP tools, and 3 lifecycle hooks work together",{"title":5823,"path":5824,"stem":5825,"description":5826},"Dethereal Glossary","\u002Fdethereal\u002Fglossary","03.dethereal\u002F09.glossary","Definitions for Dethereal-specific terminology",{"title":5828,"description":5829,"path":5830,"stem":5831,"children":5832,"page":-1},"Threat Report","The residual-risk report over a threat model: reading it, filtering it and exporting it.","\u002Fthreat-report","04.threat-report",[5833,5836,5841,5846,5851,5856],{"title":5828,"path":5830,"stem":5834,"description":5835},"04.threat-report\u002Findex","Read, filter, drill into, and export a residual-risk report over a threat model",{"title":5837,"path":5838,"stem":5839,"description":5840},"Getting Started with the Threat Report","\u002Fthreat-report\u002Fgetting-started","04.threat-report\u002F01.getting-started","Generate, open, refresh, and export a threat report over a model",{"title":5842,"path":5843,"stem":5844,"description":5845},"Reading the Report","\u002Fthreat-report\u002Freading-the-report","04.threat-report\u002F02.reading-the-report","Navigating the report, the shared visual language, and the Posture and Boundary Crossings views",{"title":5847,"path":5848,"stem":5849,"description":5850},"Understanding Coverage and Gaps","\u002Fthreat-report\u002Funderstanding-coverage","04.threat-report\u002F03.understanding-coverage","Reading the MITRE ATT&CK coverage matrix: tiers, prevent vs detect, off-grid notes, and what coverage does and does not mean",{"title":5852,"path":5853,"stem":5854,"description":5855},"Reachability and Flow Routes","\u002Fthreat-report\u002Freachability","04.threat-report\u002F04.reachability","Exploring flow routes to crown-jewel assets and between any two elements — and what the analysis does and does not model",{"title":5857,"path":5858,"stem":5859,"description":5860},"Working with Findings","\u002Fthreat-report\u002Fworking-with-findings","04.threat-report\u002F05.working-with-findings","The Residual Risk ledger, triaging findings, filtering, and the per-element Component Profile",{"title":5862,"description":5863,"path":5864,"stem":5865,"children":5866,"page":-1},"Risk assessment","The risk assessment module: the register, the reports and the method behind them.","\u002Frisk-assessment","05.risk-assessment",[5867,5871,5876,5881,5886,5891,5895,5900],{"title":5868,"path":5864,"stem":5869,"description":5870},"Dethernety Risk Assessment User Guide","05.risk-assessment\u002Findex","Dethernety Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report. From one point-in-time assessment of your model you get a prioritized worklist, a likelihood × impact risk matrix, a security-coverage posture, ten kinds of finding, a management risk register your team authors and maintains, and audience-tiered stakeholder reports — Board, Risk Committee, and Technical — plus machine-readable data exports.",{"title":5872,"path":5873,"stem":5874,"description":5875},"FAQ and Troubleshooting","\u002Frisk-assessment\u002Ffaq","05.risk-assessment\u002F01.faq","Short answers to the questions analysts, risk managers, and compliance officers ask most often about the Risk Assessment. Each answer links to the guide that covers it in full.",{"title":5877,"path":5878,"stem":5879,"description":5880},"Findings","\u002Frisk-assessment\u002Ffindings","05.risk-assessment\u002F02.findings","A finding is a specific observation the Risk Assessment makes about your threat model. Every finding is grounded in something concrete you have declared — an element, a data flow, a trust zone, a crown jewel — and it points you at a place worth a closer look. This guide is the reference to open when you see a finding and want to know what it means and what to do about it.",{"title":5882,"path":5883,"stem":5884,"description":5885},"Getting Started","\u002Frisk-assessment\u002Fgetting-started","05.risk-assessment\u002F03.getting-started","Risk Assessment turns a threat model you have built on the Dethernety platform into a grounded, board-ready draft risk report — a prioritized worklist, a likelihood × impact matrix, a security-coverage posture, ten kinds of finding, a risk register your team authors, and audience-tiered stakeholder reports and exports.",{"title":5887,"path":5888,"stem":5889,"description":5890},"Methodology and Trust","\u002Frisk-assessment\u002Fmethodology-and-trust","05.risk-assessment\u002F04.methodology-and-trust","Every number in a Risk Assessment is meant to survive scrutiny. This chapter explains why you can trust the report and — just as importantly — what it deliberately declines to claim, so you can put it in front of your board, a regulator, or an external auditor and defend every line.",{"title":5842,"path":5892,"stem":5893,"description":5894},"\u002Frisk-assessment\u002Freading-the-report","05.risk-assessment\u002F05.reading-the-report","The Risk Assessment turns your threat model into a single, scannable draft risk report: an executive summary at the top and a set of analytical tabs below it. This guide explains how to read what you see — what a matrix cell means, how coverage is stated, what a severity band is (and is not), and how to interpret each tab.",{"title":5896,"path":5897,"stem":5898,"description":5899},"Stakeholder Reports and Exports","\u002Frisk-assessment\u002Fstakeholder-reports","05.risk-assessment\u002F06.stakeholder-reports","One assessment produces reporting for every audience you answer to. From a single generated Risk Assessment you can hand your board a one-page brief, give your risk committee the full reconciliation, keep the complete technical detail for your own team, and export the underlying data into your GRC tool — without ever re-running anything or reconciling one document against another.",{"title":5901,"path":5902,"stem":5903,"description":5904},"The Risk Register","\u002Frisk-assessment\u002Fthe-risk-register","05.risk-assessment\u002F07.the-risk-register","The Risk Register is where your team records and manages the real risks your organisation is carrying — on top of, but separate from, what the analysis computed for you. Each entry is written by a person: a plain-language risk statement, your own assessment of how likely it is and how much it would hurt, the findings and elements from the analysis that back it up, a treatment decision, an owner, a review date, and a reference handle you can quote in a ticket or a board pack.",{"title":5906,"description":5907,"path":5908,"stem":5909,"children":5910,"page":-1},"Threat Patterns","The Threat Patterns module and its modelling checklist.","\u002Fthreat-patterns","06.threat-patterns",[5911,5915],{"title":5912,"path":5908,"stem":5913,"description":5914},"Threat Patterns User Guide","06.threat-patterns\u002Findex","Threat Patterns finds threats in your model that no single element shows on its own. Each one appears only when several elements line up. For example, an agent may read content anyone can write, hold private data, and be able to send data where an outsider reads it. Each element can look acceptable alone, but together they form a path an attacker can use.",{"title":5916,"path":5917,"stem":5918,"description":5919},"Modelling Checklist","\u002Fthreat-patterns\u002Fmodelling-checklist","06.threat-patterns\u002F01.modelling-checklist","Threat Patterns decides a leg only from what your model states. An unanswered attribute or field is undetermined, never read as \"no\". This checklist lists the facts and drawings the analysis asks for most often. For each one it says where to set it and which leg it settles. Attribute names are shown as they appear on the class, in code.",{"title":5921,"description":5922,"path":5923,"stem":5924,"children":5925,"page":-1},"Agentic modelling","A hands-on training: model one agentic system step by step, with Threat Patterns after each step.","\u002Fagentic-modelling","07.agentic-modelling",[5926,5930,5935,5940,5945,5950,5955,5960,5965,5970,5975,5980,5985],{"title":5927,"path":5923,"stem":5928,"description":5929},"Model an Agentic Architecture","07.agentic-modelling\u002Findex","A hands-on training in modelling systems that run AI agents, so that Threat Patterns can analyse them. You build one system, a fictional customer-support copilot, in eleven short lessons. Each lesson adds one thing to the model, and you run Threat Patterns after each one to see what the change did.",{"title":5931,"path":5932,"stem":5933,"description":5934},"Lesson 1: Draw the Agent and What It Talks To","\u002Fagentic-modelling\u002F01-draw-the-agent","07.agentic-modelling\u002F01.01-draw-the-agent","Training overview · Lesson 1 of 11 · Next: Say what data moves",{"title":5936,"path":5937,"stem":5938,"description":5939},"Lesson 2: Say What Data Moves","\u002Fagentic-modelling\u002F02-say-what-data-moves","07.agentic-modelling\u002F02.02-say-what-data-moves","Training overview · Lesson 2 of 11 · Previous: Draw the agent · Next: Mark who is outside",{"title":5941,"path":5942,"stem":5943,"description":5944},"Lesson 3: Mark Who Is Outside","\u002Fagentic-modelling\u002F03-mark-who-is-outside","07.agentic-modelling\u002F03.03-mark-who-is-outside","Training overview · Lesson 3 of 11 · Previous: Say what data moves · Next: Draw a tool that reaches any host",{"title":5946,"path":5947,"stem":5948,"description":5949},"Lesson 4: Draw a Tool That Reaches Any Host","\u002Fagentic-modelling\u002F04-draw-a-tool-that-reaches-any-host","07.agentic-modelling\u002F04.04-draw-a-tool-that-reaches-any-host","Training overview · Lesson 4 of 11 · Previous: Mark who is outside · Next: State what the agent can do",{"title":5951,"path":5952,"stem":5953,"description":5954},"Lesson 5: State What the Agent Can Do","\u002Fagentic-modelling\u002F05-state-what-the-agent-can-do","07.agentic-modelling\u002F05.05-state-what-the-agent-can-do","Training overview · Lesson 5 of 11 · Previous: Draw a tool that reaches any host · Next: Fix a finding with a fact",{"title":5956,"path":5957,"stem":5958,"description":5959},"Lesson 6: Fix a Finding With a Fact","\u002Fagentic-modelling\u002F06-fix-a-finding-with-a-fact","07.agentic-modelling\u002F06.06-fix-a-finding-with-a-fact","Training overview · Lesson 6 of 11 · Previous: State what the agent can do · Next: Record a compensating control",{"title":5961,"path":5962,"stem":5963,"description":5964},"Lesson 7: Record a Compensating Control","\u002Fagentic-modelling\u002F07-record-a-compensating-control","07.agentic-modelling\u002F07.07-record-a-compensating-control","Training overview · Lesson 7 of 11 · Previous: Fix a finding with a fact · Next: Leave what you don't know open",{"title":5966,"path":5967,"stem":5968,"description":5969},"Lesson 8: Leave What You Don't Know Open","\u002Fagentic-modelling\u002F08-leave-unknowns-open","07.agentic-modelling\u002F08.08-leave-unknowns-open","Training overview · Lesson 8 of 11 · Previous: Record a compensating control · Next: Follow a credential",{"title":5971,"path":5972,"stem":5973,"description":5974},"Lesson 9: Follow a Credential","\u002Fagentic-modelling\u002F09-follow-a-credential","07.agentic-modelling\u002F09.09-follow-a-credential","Training overview · Lesson 9 of 11 · Previous: Leave what you don't know open · Next: Watch what gets into knowledge and memory",{"title":5976,"path":5977,"stem":5978,"description":5979},"Lesson 10: Watch What Gets Into Knowledge and Memory","\u002Fagentic-modelling\u002F10-what-gets-in","07.agentic-modelling\u002F10.10-what-gets-in","Training overview · Lesson 10 of 11 · Previous: Follow a credential · Next: Draw tools from others and hand-offs",{"title":5981,"path":5982,"stem":5983,"description":5984},"Lesson 11: Draw Tools From Others and Hand-offs","\u002Fagentic-modelling\u002F11-tools-and-handoffs","07.agentic-modelling\u002F11.11-tools-and-handoffs","Training overview · Lesson 11 of 11 · Previous: Watch what gets into knowledge and memory",{"title":5986,"path":5987,"stem":5988,"description":5989},"The recipe at a glance","\u002Fagentic-modelling\u002Frecipe-at-a-glance","07.agentic-modelling\u002F12.recipe-at-a-glance","The ten steps of the training on one page. Each lesson teaches one or two of them.",{"title":5991,"description":5992,"path":5993,"stem":5994,"children":5995,"page":-1},"BYODt subscription","Subscribing on the BYODt Portal, and moving a deployment you already run to a new team.","\u002Fbyodt-subscription","08.byodt-subscription",[5996,6000,6005],{"title":5997,"path":5993,"stem":5998,"description":5999},"BYODt Subscription","08.byodt-subscription\u002Findex","Buy content for the deployment you run yourself, and decide where that deployment goes when you buy a team edition",{"title":6001,"path":6002,"stem":6003,"description":6004},"Your Subscription","\u002Fbyodt-subscription\u002Fyour-subscription","08.byodt-subscription\u002F01.your-subscription","Create an account, subscribe by card, and find the values your deployment needs on the portal",{"title":6006,"path":6007,"stem":6008,"description":6009},"Moving a Deployment to a New Team","\u002Fbyodt-subscription\u002Fmoving-a-deployment-to-a-new-team","08.byodt-subscription\u002F02.moving-a-deployment-to-a-new-team","What to do with the deployment you already run once you buy a team edition: three ways forward, best first",1793748184212]