On your laptop or in your cloud.
Start with one binary on your own machine. When your team needs more, run it on Kubernetes or your own server. Agent blueprints and gateways stay the same.1
Your laptop
One binary, and three questions.
- The web app and Postgres are built in.2
- Runs in Docker.
- Or run the multi-service deployment with Docker Compose, with smoke checks across the services.
Your cloud
The same platform, on the infrastructure you already run.
- Kubernetes: a Helm chart for any cluster that enforces network policies, with a gVisor sandbox for every run where the cluster offers one.3
- Any server with Docker: the binary, or the Compose deployment.
Pick your sandbox
Every run gets a fresh environment and its own checkout. Choose the isolation that fits where Ryph runs.4
On your laptop
Docker
Each run is a Docker container. When it needs service containers, they join it on a private network.
In your cloud
Kubernetes
Each run is a Job with no service-account token, running as non-root behind NetworkPolicy, with gVisor on GKE.
- The binary’s embedded Postgres can’t yet be migrated to a Kubernetes deployment, so moving means setting up agents and settings again.
- The binary includes the web app, embedded Postgres and local platform services. Git, a container runtime and agent images are separate prerequisites. The forge gateway for GitHub, GitLab and Radicle runs inside the binary. Setup asks three questions, with follow-up choices including internet access, and a fourth about mail when the instance is multi-user.
- The Helm chart needs Kubernetes 1.29 or later, and NetworkPolicy needs a network plugin that enforces it. The Helm chart needs your own Postgres and object storage; it brings them only for laptop clusters.
- Runs get separate checkouts, but sandbox strength depends on the backend. No sandbox rules out every escape. Docker creates a per-run service network only when services are declared. Docker removes a run’s containers once the run ends; Kubernetes Jobs are cleaned up after a delay.
More of Ryph
- Incident response An agent joins the incident chat, investigates and ships the fix.
- Automations Recipes that run on a schedule or when a webhook fires.
- Forges and chat Summon an agent with /ryph on an issue, a pull request or a merge request.
- Artifacts Reports and overviews agents publish as pages your team can open.
- Memory What agents learn, shared and kept current with the code.
- Agentic CI One CI for agents and the people working with them. Pull requests open already green.
- Security Keys stay behind gateways, and work leaves as a patch.
- Environments Images built for your repo, and services for every run.
Try it on your own machine.
One binary with the web app and database built in.
Get started