Self-hosted AI agent: run Krypton on your own server

A self-hosted AI agent keeps the whole stack on infrastructure you operate. Krypton, an open source platform, runs persistent AI teammates: every bot can work in a browser and a shell, stores its routines as Markdown and pauses for your approval whenever a task crosses a line you have drawn.

Krypton is licensed under Apache-2.0, and hosted Krypton Cloud is in beta for anyone who prefers not to manage servers (see Krypton Cloud pricing). This page covers what you need to get it running. Production Compose, restricted networks, secrets, upgrades and backups are covered in the full self-hosting guide on GitHub.

How a self-hosted Krypton install fits together: the web, desktop and mobile apps call one API, which works alongside a background worker and a Postgres database. Bots run on a Docker computer by default; E2B, Daytona, CreateOS and Boat are optional backends. Prompts travel to whichever model provider you set up. — Inside a Krypton install, the Postgres data, bot files and audit log stay on your own machine. Prompts are the part that still travels, to the model provider you picked.

Why self-host your AI agent

Keep your data

Your own deployment holds the audit log, Postgres, browser profiles and bot files; none of it moves elsewhere. When you send content to a model provider, that provider processes it under its own terms, and both the provider and the keys are your choice.

Choose any model

Hook up Anthropic, OpenAI, Google, or Vercel AI Gateway, or run a local model server like MLX, llama.cpp, LM Studio or Ollama. Any OpenAI-compatible endpoint works too, and bots do not have to share a model.

Control your costs

No seat fee applies to the open source software. Your costs are the model you connect, billed directly by OpenAI, Anthropic, xAI or another service (a local Ollama or LM Studio model adds none), plus, if chosen, a remote computer provider. Since bots use local Docker computers by default, a single machine needs no Boat, CreateOS, Daytona or E2B account.

System requirements

Published images. OpenSSL, curl, the Compose plugin and Docker Engine 26 or later (API 1.45 or later, which bot home volume subpaths rely on). No Node.js install.
Source checkout. pnpm 9, Docker and Node.js 22.22.2 or later within 22.x, any 24.x release, or 26 and above. The 23.x and 25.x lines are not supported.

Install with published Docker images

Run this from an empty folder on the machine that will host Krypton:

mkdir -p krypton && cd krypton &&
curl -fsSLO https://raw.githubusercontent.com/krypton-bot/kryptonbot/main/infra/compose/install-images.sh &&
bash install-images.sh

The script fetches the Compose file and .env.images.example, writes a .envfilled with random secrets and starts Krypton. Running it again leaves an existing .envuntouched. Images default to the edge tag: main-branch builds for bothlinux/arm64 and linux/amd64.

Then visit http://127.0.0.1:5173 and sign up; whoever registers first owns the deployment. Connect a model inside the app. Local Docker computers are enabled out of the box.

Krypton's new bot form filled in with a sample bot called Inbox. — Setting up a bot in Krypton. Every value shown here, from name to description, is sample data.

The model menu open in the settings of a sample Inbox bot. — Bots can each run a different model; the menu shows the models available for the credentials connected to that deployment.

A weekday inbox-check routine open in the editor, its instruction in plain text. — Routines are plain text plus a schedule, editable right in the app.

An approval card for a sample bot that wants to send an email, offering deny, allow once and always allow. — Once a task crosses a boundary you set, the bot pauses on an approval card, and the action is recorded in the audit log as well.

Want an agent to do the install? Give it the setup prompt.

Run Krypton on a server

For bots that should keep running, use the same installer on a VPS. Images Compose binds the web app to the loopback address 127.0.0.1:5173. Put TLS termination on the host and proxy to that address. Leave port 3100 unpublished, because the web server already proxies /api.

bash install-images.sh --prepare-only
# Edit .env, then:
bash install-images.sh

Before running the second command, set KRYPTON_HOST to your hostname, and pointAPI_URL, WEB_ORIGIN and BETTER_AUTH_URL at that samehttps:// origin. To use a remote computer rather than local Docker, setSANDBOX_PROVIDER to boat, createos, daytona ore2b, then supply that provider's API key.

app.example.com {
	reverse_proxy 127.0.0.1:5173
}

Swap app.example.com for your own host. In desktop clients, chooseExisting instance and enter the https:// address. SMTP, signup allowlists, host hardening and production Compose are covered in thepublic single-VM section.

Blocked downloads? Follow the restricted-network guide. Thesecrets checklist lists every secret name and how to recover it.

Install from source

Choose this route if you want to work on Krypton itself; the published images are all you need to run it.

git clone https://github.com/krypton-bot/kryptonbot.git
cd krypton
cp .env.example .env

Generate two URI-safe random values (for instance with openssl rand -hex 16) forPOSTGRES_PASSWORD and POSTGRES_APP_PASSWORD, and use them insideDATABASE_MIGRATION_URL and DATABASE_URL. Give SCREEN_PROXY_SECRET,ENCRYPTION_KEY and BETTER_AUTH_SECRET their own long random values. Docker sandboxes additionally require a dedicated SANDBOX_SUPERVISOR_TOKEN. All of these belong in .env and never in git.

Developing on the host with Docker Desktop? Add SANDBOX_CONTROL_VIA_LOOPBACK=true to.env so the supervisor exposes its control service on a loopback port; the host cannot reach Docker Desktop container addresses directly. If the supervisor runs inside Compose, do not set it.

docker compose --env-file .env \
  -f infra/compose/docker-compose.yml \
  -f infra/compose/docker-compose.postgres-host.yml \
  up postgres -d
pnpm install
pnpm db:generate
pnpm db:migrate
pnpm sandbox:build
pnpm dev

The Postgres overlay exposes 127.0.0.1:5433 on loopback for tools on the host. Visithttp://127.0.0.1:5173. Note that docker compose down -vwipes the Postgres data.

Connect the desktop and mobile apps

If a server is already up, enter its https:// address underExisting instance in the Electron app. Plain HTTP works only for loopback and private LAN addresses. Choosing This computer instead sets up the published images on that same machine using Docker Compose.

Prefer your Mac? Pick This computer in the desktop app and Krypton installs itself on that Mac. A Mac Mini left switched on makes a good always-on host.

On the mobile sign-in screen, choose Use a custom server, then enter the HTTPS origin you configured as WEB_ORIGIN.

Self-hosting reference docs

Self-hosting FAQ

What are the requirements for self-hosting Krypton?

For the published images you need Docker Engine 26 or later, the Compose plugin, curl and OpenSSL; Node.js is not required on that path. Building from source instead calls for pnpm 9, Docker and a supported Node.js: 22.22.2 or later within 22.x, any 24.x release, or 26 and above. The 23.x and 25.x lines are not supported.

Where is my data stored?

On the deployment you operate. The audit log, Postgres, browser profiles and bot files never leave it. Anything you send to a model provider is handled by that provider under its own terms, and you decide which provider and which keys to use.

How are models chosen and paid for?

Bring your own model keys, or point Krypton at a model server that is local or OpenAI-compatible, and give each bot a different model if you want. The open source software charges no seat fee; your only bills come from the model and computer providers you pick. Bots use local Docker computers by default, so no hosted sandbox account is needed.

Can I use Krypton without hosting it myself?

Yes. Krypton Cloud, the hosted version, is in beta at krypton.bot, and self-hosting remains available.

How is Krypton different from OpenClaw?

They share two traits: open source code and hardware you control. Once the Docker or desktop install is done, Krypton is simply a chat with persistent teammates. OpenClaw's getting-started guide brings in a wizard, then a Gateway living in your terminal or installed as a background service, plus a separate step that links a chat app.

Get started

Follow the steps above to self-host, or let Krypton Cloud run it for you.

Krypton Cloud View on GitHub