# Self-hosted AI agent: run Krypton on your own server

> An open source AI agent that lives on hardware you control, using your keys, your model and your data.

A self-hosted AI agent keeps the whole stack on infrastructure you operate. Krypton, an open source platform, runs persistent AI teammates: every bot can work in a browser and a shell, stores its routines as Markdown and pauses for your approval whenever a task crosses a line you have drawn.

Krypton is licensed under [Apache-2.0](https://github.com/krypton-bot/kryptonbot/blob/main/LICENSE), and hosted Krypton Cloud is in beta for anyone who prefers not to manage servers ([pricing](https://krypton.bot/pricing/)). This page covers what you need to get it running. Production Compose, restricted networks, secrets, upgrades and backups are covered in the [full self-hosting guide](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host.md) on GitHub.

## Why self-host your AI agent

### Keep your data

Your own deployment holds the audit log, Postgres, browser profiles and bot files; none of it moves elsewhere. When you send content to a model provider, that provider processes it under its own terms, and both the provider and the keys are your choice.

### Choose any model

Hook up Anthropic, OpenAI, Google, or Vercel AI Gateway, or run a local model server like MLX, llama.cpp, LM Studio or Ollama. Any OpenAI-compatible endpoint works too, and bots do not have to share a model.

### Control your costs

No seat fee applies to the open source software. Your costs are the model you connect, billed directly by OpenAI, Anthropic, xAI or another service (a local Ollama or LM Studio model adds none), plus, if chosen, a remote computer provider. Since bots use local Docker computers by default, a single machine needs no Boat, CreateOS, Daytona or E2B account.

## System requirements

**Published images:** OpenSSL, curl, the Compose plugin and Docker Engine 26 or later (API 1.45 or later, which bot home volume subpaths rely on). No Node.js install.

**Source checkout:** pnpm 9, Docker and Node.js 22.22.2 or later within 22.x, any 24.x release, or 26 and above. The 23.x and 25.x lines are not supported.

## Install with published Docker images

Run this from an empty folder on the machine that will host Krypton:

```bash
mkdir -p krypton && cd krypton &&
curl -fsSLO https://raw.githubusercontent.com/krypton-bot/kryptonbot/main/infra/compose/install-images.sh &&
bash install-images.sh
```

The script fetches the Compose file and `.env.images.example`, writes a `.env` filled with random secrets and starts Krypton. Running it again leaves an existing `.env` untouched. Images default to the `edge` tag: main-branch builds for both `linux/arm64` and `linux/amd64`.

Then visit [http://127.0.0.1:5173](http://127.0.0.1:5173) and sign up; whoever registers first owns the deployment. Connect a model inside the app. Local Docker computers are enabled out of the box.

Want an agent to do the install? Give it the [setup prompt](https://github.com/krypton-bot/kryptonbot/blob/main/SETUP_PROMPT.md).

## Run Krypton on a server

For bots that should keep running, use the same installer on a VPS. Images Compose binds the web app to the loopback address `127.0.0.1:5173`. Put TLS termination on the host and proxy to that address. Leave port 3100 unpublished, because the web server already proxies `/api`.

```bash
bash install-images.sh --prepare-only
# Edit .env, then:
bash install-images.sh
```

Before running the second command, set `KRYPTON_HOST` to your hostname, and point `API_URL`, `WEB_ORIGIN` and `BETTER_AUTH_URL` at that same `https://` origin. To use a remote computer rather than local Docker, set `SANDBOX_PROVIDER` to `boat`, `createos`, `daytona` or `e2b`, then supply that provider's API key.

```Caddyfile
app.example.com {
	reverse_proxy 127.0.0.1:5173
}
```

Swap `app.example.com` for your own host. In desktop clients, choose **Existing instance** and enter the `https://` address. SMTP, signup allowlists, host hardening and production Compose are covered in the [public single-VM section](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host.md#public-single-vm-deployment).

Blocked downloads? Follow the [restricted-network guide](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host-restricted-network.md). The [secrets checklist](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host-secrets.md) lists every secret name and how to recover it.

## Install from source

Choose this route if you want to work on Krypton itself; the published images are all you need to run it.

```bash
git clone https://github.com/krypton-bot/kryptonbot.git
cd krypton
cp .env.example .env
```

Generate two URI-safe random values (for instance with `openssl rand -hex 16`) for `POSTGRES_PASSWORD` and `POSTGRES_APP_PASSWORD`, and use them inside `DATABASE_MIGRATION_URL` and `DATABASE_URL`. Give `SCREEN_PROXY_SECRET`, `ENCRYPTION_KEY` and `BETTER_AUTH_SECRET` their own long random values. Docker sandboxes additionally require a dedicated `SANDBOX_SUPERVISOR_TOKEN`. All of these belong in `.env` and never in git.

Developing on the host with Docker Desktop? Add `SANDBOX_CONTROL_VIA_LOOPBACK=true` to `.env` so the supervisor exposes its control service on a loopback port; the host cannot reach Docker Desktop container addresses directly. If the supervisor runs inside Compose, do not set it.

```bash
docker compose --env-file .env \
  -f infra/compose/docker-compose.yml \
  -f infra/compose/docker-compose.postgres-host.yml \
  up postgres -d
pnpm install
pnpm db:generate
pnpm db:migrate
pnpm sandbox:build
pnpm dev
```

The Postgres overlay exposes `127.0.0.1:5433` on loopback for tools on the host. Visit [http://127.0.0.1:5173](http://127.0.0.1:5173). Note that `docker compose down -v` wipes the Postgres data.

## Connect the desktop and mobile apps

If a server is already up, enter its `https://` address under **Existing instance** in the Electron app (plain HTTP works only for loopback and private LAN addresses). Choosing **This computer** instead sets up the published images on that same machine using Docker Compose.

Prefer your Mac? Pick This computer in the desktop app and Krypton installs itself on that Mac. A Mac Mini left switched on makes a good always-on host.

On the mobile sign-in screen, choose **Use a custom server**, then enter the HTTPS origin you configured as `WEB_ORIGIN`.

## Self-hosting reference docs

- [Setup prompt for coding agents](https://github.com/krypton-bot/kryptonbot/blob/main/SETUP_PROMPT.md)
- [Self-hosting guide on GitHub](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host.md)
- [Secrets checklist](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host-secrets.md)
- [Restricted-network install](https://github.com/krypton-bot/kryptonbot/blob/main/docs/self-host-restricted-network.md)
- [Krypton source code](https://github.com/krypton-bot/kryptonbot)

## Self-hosting FAQ

### What are the requirements for self-hosting Krypton?

For the published images you need Docker Engine 26 or later, the Compose plugin, curl and OpenSSL; Node.js is not required on that path. Building from source instead calls for pnpm 9, Docker and a supported Node.js: 22.22.2 or later within 22.x, any 24.x release, or 26 and above. The 23.x and 25.x lines are not supported.

### Where is my data stored?

On the deployment you operate. The audit log, Postgres, browser profiles and bot files never leave it. Anything you send to a model provider is handled by that provider under its own terms, and you decide which provider and which keys to use.

### How are models chosen and paid for?

Bring your own model keys, or point Krypton at a model server that is local or OpenAI-compatible, and give each bot a different model if you want. The open source software charges no seat fee; your only bills come from the model and computer providers you pick. Bots use local Docker computers by default, so no hosted sandbox account is needed.

### Can I use Krypton without hosting it myself?

Yes. Krypton Cloud, the hosted version, is in beta at krypton.bot, and self-hosting remains available.

### How is Krypton different from OpenClaw?

They share two traits: open source code and hardware you control. Once the Docker or desktop install is done, Krypton is simply a chat with persistent teammates. OpenClaw's getting-started guide brings in a wizard, then a Gateway living in your terminal or installed as a background service, plus a separate step that links a chat app.

## Related pages

- [Krypton home](https://krypton.bot/)
- [Krypton Cloud pricing](https://krypton.bot/pricing/)
- [Self-learning memory with Supermemory](https://krypton.bot/memory)
- [MCP catalog](https://krypton.bot/mcp-catalog/)
- [Krypton vs OpenClaw](https://krypton.bot/openclaw-alternative/)
- [All alternatives](https://krypton.bot/alternatives/)
- [Blog](https://krypton.bot/blog/)