# Deployment options · One by Lughlabs

> A marketing site can be static. The product needs persistent services and an operator.

URL: https://onedev.jobrella.ai/docs/deployment/

Developers

## Deployment options

A marketing site can be static. The product needs persistent services and an operator.

### [Choose a supported topology](https://onedev.jobrella.ai/docs/deployment/#choices)

The source deployment runs a long-lived API, worker, PostgreSQL, and a computer provider. Docker is the default local computer path; optional remote computer adapters exist for E2B, Daytona, and Box.

Web, Electron, and mobile connect to a configured product deployment. The marketing website in apps/www builds independently as a static Astro site.

Private Enterprise compute and semi-private deployments, which share a GPU server between a few teams with each team in an isolated section, are commercial deployment propositions. Isolation, resource limits, and provider boundaries must be configured and agreed for the actual environment.

### [For approved source access](https://onedev.jobrella.ai/docs/deployment/#source)

Use the One source revision and setup instructions provided for your approved deployment. Do not assume upstream container images include One-specific capabilities. The source checkout expects supported Node.js (22.22.2+ within 22.x, 24.x, or 26+), pnpm, and Docker.

From the application directory, copy.env.example to a private.env. Set matching database credentials and independent strong values for BETTER\_AUTH\_SECRET, ENCRYPTION\_KEY, SCREEN\_PROXY\_SECRET, and SANDBOX\_SUPERVISOR\_TOKEN. Never commit those values.

```bash
docker compose --env-file .env \
  -f infra/compose/docker-compose.yml \
  -f infra/compose/docker-compose.postgres-host.yml \
  up postgres -d
pnpm install
pnpm db:generate
pnpm db:migrate
pnpm sandbox:build
pnpm dev
```

### [Before a public deployment](https://onedev.jobrella.ai/docs/deployment/#public)

Terminate TLS in front of the web origin. Set BETTER\_AUTH\_URL, WEB\_ORIGIN, and API\_URL consistently. Keep the raw API port and sandbox control listeners private. Configure backups and verify a restore before relying on the environment.

The phone subsystem uses a separate optional overlay and production policy. Expose only the carrier callback and tokened media allowlist; never proxy /api/calling/engine/\* publicly.

The upstream self-hosting guide is useful architectural background. One-specific source, image versions, access, and commercial arrangements are provided by Lughlabs.

[Discuss a private deployment ↗](https://onedev.jobrella.ai/talk?plan=enterprise) [Trust & deployment ↗](https://onedev.jobrella.ai/trust)

Adapted for One from the project’s current implementation and self-hosting documentation. One builds on Rakazo; the license and attribution notices are on the [Licenses](https://onedev.jobrella.ai/licenses) page. [Upstream reference ↗](https://github.com/elie222/rakazo/blob/main/docs/self-host.md)

On this page [Choose a supported topology](https://onedev.jobrella.ai/docs/deployment/#choices) [For approved source access](https://onedev.jobrella.ai/docs/deployment/#source) [Before a public deployment](https://onedev.jobrella.ai/docs/deployment/#public)