One Docker Compose stack, built from the same images the managed cloud runs. Your database, your files, your repos and your policies sit on disk you control. It is open source, so what you are running is code you can read.
Same images as the cloud · One command · Any model, your keys
Self-hosting is not a smaller Kortix with the interesting parts removed. It is the whole control plane — accounts, projects, repos, secrets, connectors, policies, audit — running inside your network, on storage you back up yourself.
on your box
not on your box
Sandbox compute is a provider choice: Daytona by default, or Platinum or E2B. local-docker runs sandboxes on the same box through Docker and is experimental — not for production. Air-gapped and other fully isolated topologies are scoped with us rather than self-served.
There is no separate provisioning step and no console to click through. One command brings the stack up. One more decides which Kortix your CLI is talking to.
# install the CLI$ curl -fsSL https://kortix.com/install | bash # create the config if it is missing, then start everything$ kortix self-host start→ stack up · dashboard registered as host "selfhost" # check on it any time$ kortix self-host status$ kortix self-host logs kortix-api# a host is one Kortix API endpoint, with its own token$ kortix hosts ls # work against your own stack$ kortix hosts use selfhost→ Active host is now selfhost # and back to the managed cloud$ kortix hosts use cloud→ Active host is now cloudYou are not handed a template env file to fill in. The CLI asks the handful of things only you can know, generates every port, URL, password, signing key and Compose default itself, and writes the whole instance to one directory.
A domain you point at the box, or a Cloudflare tunnel for evaluation. Sessions run on a remote sandbox and have to call back, so this is the first real decision.
Grants platform admin, so you can configure GitHub and the rest in the dashboard. Optional, and you can set it later.
Unlocks SAML SSO, SCIM directory sync, custom roles, groups and audit read on this instance.
Admin-only by default. People still join by invite or SSO either way.
Daytona, Platinum, E2B, or experimental local-docker. This is the one credential the stack genuinely cannot start without.
Pipedream credentials for the 3,000+ app catalog — optional, skipped by default — then whether to auto-update nightly.
what it generates for you
Everything the CLI generates is rotatable later with kortix self-host env rotate, and every value is visible with kortix self-host env ls, masked unless you ask for --show.
GitHub and your model key are not asked here on purpose. Both are set in the dashboard after the stack is up — GitHub at Settings → Git, the model key in the model picker.
The same artifact runs on a laptop, a VPS or a cloud VM. A domain is one environment variable, not a different deployment. Everything lives in one instance directory you can back up by copying it.
kortix
data plane
edge — only what you chose
The Postgres data directory, the storage directory, and the .env that holds every key the instance uses. Back up those three and you have backed up the instance. There is no separate backup service to configure, and nothing to export from us.
The updater checks once a day at a time you set, runs the migration, then starts the new services before it stops the old ones. Track the curated stable channel, ride latest, or pin an exact version and never move.
This is not a stripped build with the good parts held back for the paid tier. Self-hosted instances run the same images the managed cloud runs, produced by the same pipeline, on the same release train.
A self-hosted instance has no managed model lineup and does not want one. You connect the providers you already pay for, and every model call routes through the gateway running on your own box.
# stored as an encrypted project secret, injected at session boot$ kortix providers set anthropic sk-ant-...$ kortix providers set openai sk-...$ kortix providers set openrouter sk-or-... # or the subscription you already pay for$ kortix providers login chatgpt $ kortix providers ls→ anthropic · openai · openrouterSessions call the gateway inside your own stack, over your own domain or tunnel. Kortix has no credential in that path and no visibility into it.
Anthropic, OpenAI, Google, Groq, xAI, DeepSeek, Mistral, Bedrock and OpenRouter, or the ChatGPT and Copilot subscription you already hold.
It is the same Compose project everywhere. What changes is where you point the domain and how much you give it.
Self-hosting is free and always will be. Kortix Cloud is the same product with the box, the upgrades and the sandbox tier taken off your hands.
Need it inside your own network, with SSO and a licence? Talk to us. Talk to us.