Production
Running PentAGI for a team — hardening, isolation, Podman and several instances.
Checklist
- Set every credential,
COOKIE_included, before the first start — see Security. The installer generates the salt and the service passwords, but not the Langfuse and Grafana admin passwords: setSIGNING_ SALT LANGFUSE_,INIT_ USER_ PASSWORD passwordin the template, before Langfuse first starts, and change Grafana's defaultadmin/adminafter its first start. On a running installation, change the PostgreSQL and Neo4j passwords inside the databases before you change them in.env. - Serve a real certificate and a stable
PUBLIC_.URL - Behind a reverse proxy, set
TRUSTED_to the proxy's address or CIDR. Otherwise every user shares the proxy's address, and 30 failed sign-ins within 5 minutes lock everyone out for 15 minutes.PROXIES - Move tooltoolWhat an agent acts through: a built-in capability such as the terminal, the isolated browser or web search, or a program in the sandbox such as nmap, metasploit or sqlmap. execution to a dedicated worker node.
- Enable observability so you can follow cost and failures.
- Keep the knowledge graphknowledge graphThe graph of hosts, services, vulnerabilities and the access between them that PentAGI builds during a test when this optional feature is enabled. It shows how findings connect. and Langfuse on a private network.
Podman
PentAGI runs on Podman as well as Docker. In rootless mode the scraper service needs extra configuration because rootless containers cannot bind privileged ports; the repository README describes the rootless and rootful setups.
Several instances (TENANT_)
Leave TENANT_ empty for a single installation, and keep it empty on an existing one: setting it later moves the instance to a new, empty schema that starts with the default [email protected] account, and its flowsflowOne run of PentAGI: a goal, the tasks created from your messages, and everything the agents did along the way., users and settings no longer appear. Set it on the instances you add when several PentAGI instances share external resources such as one PostgreSQL server, one worker nodeworker nodeA separate server that runs the agents' tool containers, so the commands they run never touch the main PentAGI host., one Neo4j or one Langfuse:
| Area | Effect of TENANT_ |
|---|---|
| PostgreSQL | Works inside schema acme instead of public |
| Worker containers | Named acme-pentagi-terminal-<flow> |
| Knowledge graph | Group ids become acme-flow-<id> |
| Auth | Cookie and token keys include the tenanttenantOne PentAGI installation. When several installations share external resources, such as one PostgreSQL database, each one you add gets its own TENANT_ID; an existing installation keeps it empty. |
| Telemetry | Langfuse and OpenTelemetry data are tagged with the tenant |
The value must match ^[a-z][a-z0-9_. Host resources are not namespaced. Instances on one server need their own DATA_ and published ports. Instances whose sandboxessandboxThe isolated Docker container in which agents run their tools. The interface shows it as Terminal. run on the same Docker host, on one server or a shared worker node, need their own DOCKER_ and, if it is set, their own DOCKER_; otherwise their sandboxes claim the same ports and flows fail to start. Each base starts a window of 2000 ports, 28000 by default, so use for example 28000 and 30000.
Last updated on