Self-Hosting

The manager is your control plane. It stores releases, deploys them, serves the charts and images that customer environments pull, forwards their telemetry, and routes commands and tunnel requests to them. alien.dev runs one for you; this page is for running your own. The alien CLI works the same way with both.

Run the managerCopy Anchor Link

The manager is one container that keeps its state (database, keys, and release images unless you configure a cloud registry) in /data. Give it a persistent volume and a public HTTPS URL, which it takes as BASE_URL. Customer environments connect to that URL.

docker run -d --name alien-manager \
  -p 8080:8080 \
  -v alien-data:/data \
  -e BASE_URL=https://manager.example.com \
  ghcr.io/alienplatform/alien-manager

docker logs alien-manager

To try it on your machine, alien serve runs the same manager in the foreground.

Connect the CLICopy Anchor Link

alien login --manager https://manager.example.com --token ax_admin_...
alien whoami

Every command then targets your manager: alien release, alien onboard, alien deployments ls, alien logs. alien logout disconnects. In CI, set ALIEN_MANAGER_URL and ALIEN_API_KEY instead.

Onboard customersCopy Anchor Link

alien release
alien onboard acme --platforms kubernetes

For Kubernetes, onboard prints a helm install command that pulls the chart from your manager with a token for that customer. See Kubernetes. Sites that can't reach your manager at all get releases as files: see Air-gapped deployments.

HTTPSCopy Anchor Link

Customer clusters pull charts and images from the manager, and container runtimes only pull from HTTPS registries. Serve the manager over HTTPS with a certificate their nodes trust. The manager itself serves plain HTTP on port 8080, so terminate TLS in front of it.

Long-lived connections pass through that proxy: Operators hold tunnel connections open, and images upload and download through it. Allow request bodies of any size and idle timeouts of several minutes or more. With ingress-nginx:

nginx.ingress.kubernetes.io/proxy-body-size: "0"
nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"

UpgradesCopy Anchor Link

Upgrade the manager by running a newer image. Deployments pick up the new Operator on their next sync: Operators installed from the manager's charts update themselves to the Operator version the manager serves.

Deploying to customer cloudsCopy Anchor Link

For push deployments into AWS, Google Cloud, or Azure accounts, the manager also needs a registry in that cloud, an identity to impersonate, and optionally a cloud backend for command state. Terraform modules create them for AWS, Google Cloud, and Azure, and output the matching alien-manager.toml sections. See Configuration and Impersonation.

Production checklistCopy Anchor Link

• Persistent volume for /data, backed up
• BASE_URL set to the public HTTPS URL
• TLS in front of the manager, with large bodies and long timeouts allowed
• The admin API key stored in a secret store (ALIEN_ADMIN_TOKEN)
• Telemetry forwarded to your OpenTelemetry backend
• For push deployments: cloud registries, impersonation, and a commands backend