Skip to content
LabTether

Installation

Get LabTether running with Docker Compose in under 5 minutes.

What you'll need

  • Docker Engine and Docker Compose 2.33.1 or newer. Confirm with docker version and docker compose version.
  • A browser that can reach the hub host.

No other dependencies. LabTether ships its own Postgres, generates its own secrets, and handles TLS automatically.

Install

Download the release installer, inspect it, and pin the version you intend to deploy:

curl --proto '=https' --tlsv1.2 -fsSLo install-labtether.sh https://labtether.com/install.sh
less install-labtether.sh
LABTETHER_VERSION=vX.Y.Z bash install-labtether.sh

The installer verifies the release checksums, verifies signed provenance when GitHub CLI (gh) is available, uses digest-pinned images, and starts the hub API, web console, managed Postgres, and remote desktop gateway. To make provenance mandatory, run it with LABTETHER_REQUIRE_ATTESTATION=true. Runtime secrets are generated automatically on first boot.

Open http://localhost:3000 to reach the setup wizard.

Alternative: Docker Compose

The verified installer writes the release-specific Compose file, manifest, checksums, and .env.deploy into the install directory. Use those pinned artifacts for split services, external Postgres, or resource-limit customization; do not deploy the mutable main branch directly.

Run one active LabTether hub runtime per PostgreSQL database. Scaling the API service horizontally is not currently supported because agent and interactive stream connections are owned by one process. A second hub pointed at the same database fails closed before serving traffic; use the container restart policy to replace the active instance after it stops.

Verify it's running

Check the three main endpoints:

Endpoint URL What it tells you
Console http://localhost:3000 Web UI is serving
API health http://localhost:8080/healthz Backend is healthy
Container status docker compose ps All services are up

Tip: With the default auto TLS mode, the hub generates a self-signed CA on first boot. Your browser will show a certificate warning at https://localhost:8443 -- this is normal. You can download the CA certificate at https://localhost:8443/api/v1/tls/ca.crt and install it in your system trust store if you want to suppress the warning. The HTTP health endpoint at port 8080 is always available, even when TLS is enabled.

What got created

Behind the scenes, first boot generated and persisted these in the LabTether data volume:

  • Owner token and API token -- used internally for service-to-service auth.
  • Encryption key -- protects stored credentials at rest.
  • Postgres password -- auto-generated before Postgres starts; visible later in Settings if you need it.

These live in the Docker volume at /data/install/state.json and /data/install/secrets.json. You never need to touch them for normal operation.

Warning: The deploy defaults bind hub HTTPS to 127.0.0.1 only. If you need LAN clients (mobile app, agents on other machines) to reach the hub over HTTPS, widen the bind address in .env.deploy after setup is complete.

Next up: First Login