Deployment

Docker (single node)

docker run -d \
  --name dakera \
  --restart unless-stopped \
  -p 3300:3300 \
  -e DAKERA_PORT=3300 \
  -e DAKERA_ROOT_API_KEY=your-secret \
  -e DAKERA_STORAGE=filesystem \
  -e DAKERA_STORAGE_PATH=/data \
  -v dakera-data:/data \
  ghcr.io/dakera-ai/dakera:latest

Docker Compose (recommended)

The recommended way to run Dakera in production. This compose file includes Dakera, MinIO for S3 storage, and optional Dashboard UI and monitoring.

# docker-compose.yml
version: "3.8"
services:
  dakera:
    image: ghcr.io/dakera-ai/dakera:latest
    restart: unless-stopped
    ports:
      - "3300:3300"
    environment:
      DAKERA_PORT: 3300
      DAKERA_ROOT_API_KEY: ${DAKERA_ROOT_API_KEY}
      DAKERA_STORAGE: s3
      DAKERA_S3_ENDPOINT: http://minio:9000
      DAKERA_S3_BUCKET: dakera
      AWS_ACCESS_KEY_ID: ${MINIO_ROOT_USER}
      AWS_SECRET_ACCESS_KEY: ${MINIO_ROOT_PASSWORD}
      DAKERA_ENCRYPTION_KEY: ${DAKERA_ENCRYPTION_KEY}
      DAKERA_AUDIT_ENABLED: "true"
      RUST_LOG: info
    volumes:
      - dakera-data:/data
    depends_on:
      minio:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-sf", "http://localhost:3300/health"]
      interval: 30s
      timeout: 5s
      retries: 3

  minio:
    image: minio/minio:latest
    command: server /data --console-address ":9001"
    environment:
      MINIO_ROOT_USER: ${MINIO_ROOT_USER}
      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}
    volumes:
      - minio-data:/data
    healthcheck:
      test: ["CMD", "mc", "ready", "local"]
      interval: 10s
      timeout: 5s
      retries: 5

volumes:
  dakera-data:
  minio-data:

# Generate secrets and start
printf "DAKERA_ROOT_API_KEY=%s\nDAKERA_ENCRYPTION_KEY=%s\nMINIO_ROOT_USER=minioadmin\nMINIO_ROOT_PASSWORD=%s\n" \
  "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" "$(openssl rand -hex 16)" > .env

docker compose up -d

Kubernetes

helm install dakera oci://ghcr.io/dakera-ai/dakera-helm/dakera \
  --namespace dakera --create-namespace \
  --set dakera.rootApiKey="$(openssl rand -hex 32)" \
  --set minio.rootPassword="$(openssl rand -hex 16)"

Full values: charts/dakera/values.yaml · ArtifactHub. Kustomize manifests available in dakera-deploy/k8s/.

Reverse proxy & TLS termination

Nginx

# /etc/nginx/sites-available/dakera
server {
    listen 443 ssl http2;
    server_name dakera.example.com;

    ssl_certificate     /etc/letsencrypt/live/dakera.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/dakera.example.com/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    location / {
        proxy_pass http://127.0.0.1:3300;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # SSE support (required for event streaming)
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 86400s;
    }
}

# Redirect HTTP → HTTPS
server {
    listen 80;
    server_name dakera.example.com;
    return 301 https://$host$request_uri;
}

# Obtain certificate with certbot
sudo certbot --nginx -d dakera.example.com

Caddy

# Caddyfile — automatic HTTPS with Let's Encrypt
dakera.example.com {
    reverse_proxy localhost:3300 {
        flush_interval -1   # required for SSE streaming
    }
}

Caddy automatically provisions and renews TLS certificates via Let's Encrypt — no additional setup required.

Self-hosted VPS

Run Dakera directly on a VPS (Ubuntu/Debian) with systemd for process management. Avoids Docker overhead — ideal for single-node deployments with dedicated hardware.

# /etc/systemd/system/dakera.service
[Unit]
Description=Dakera Agent Memory Engine
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
User=dakera
Group=dakera
WorkingDirectory=/opt/dakera
ExecStart=/opt/dakera/dakera
Restart=always
RestartSec=5
LimitNOFILE=65535

# Environment
EnvironmentFile=/opt/dakera/.env

[Install]
WantedBy=multi-user.target

# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable dakera
sudo systemctl start dakera

# Check status
sudo systemctl status dakera
curl http://localhost:3300/health

Cloud deployment

Resource sizing guide

RocksDB benefits from high random-read IOPS. Use NVMe SSDs for workloads above 1M memories. RAM should comfortably hold the L1 hot cache — configure DAKERA_L1_CACHE_SIZE based on your active memory working set.

Health checks

Dakera exposes a /health endpoint that returns the server status, version, and storage backend. Use this for container orchestration probes.

# Response format
curl http://localhost:3300/health
# {"service":"dakera","status":"healthy","version":"0.11.56","storage":"s3"}

Docker

# In Dockerfile or docker-compose.yml
healthcheck:
  test: ["CMD", "curl", "-sf", "http://localhost:3300/health"]
  interval: 30s
  timeout: 5s
  retries: 3
  start_period: 10s

Kubernetes

# In pod spec
livenessProbe:
  httpGet:
    path: /health
    port: 3300
  initialDelaySeconds: 10
  periodSeconds: 15
readinessProbe:
  httpGet:
    path: /health
    port: 3300
  initialDelaySeconds: 5
  periodSeconds: 10

Backup & restore

Dakera provides full backup and restore via the admin API. Backups are compressed bundles containing all memories, namespaces, keys, and vector indexes.

# Create a backup
curl -X POST http://localhost:3300/admin/backups \
  -H "Authorization: Bearer $DAKERA_ROOT_API_KEY"
# {"id":"bk_20260515_143022","status":"completed","size_bytes":4521984}

# List backups
curl http://localhost:3300/admin/backups \
  -H "Authorization: Bearer $DAKERA_ROOT_API_KEY"

# Download a backup
curl -o backup.tar.zst \
  http://localhost:3300/admin/backups/bk_20260515_143022/download \
  -H "Authorization: Bearer $DAKERA_ROOT_API_KEY"

# Restore from backup
curl -X POST http://localhost:3300/admin/backups/restore \
  -H "Authorization: Bearer $DAKERA_ROOT_API_KEY" \
  -F "[email protected]"

Scheduled backups

# Configure automatic daily backups with 30-day retention
curl -X PUT http://localhost:3300/admin/backups/schedule \
  -H "Authorization: Bearer $DAKERA_ROOT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"cron":"0 2 * * *","retention_days":30,"compression":"zstd"}'

Monitoring & observability

Dakera exposes Prometheus-compatible metrics at /metrics. Key metrics to monitor:

Prometheus scrape config

# prometheus.yml
scrape_configs:
  - job_name: dakera
    scrape_interval: 15s
    static_configs:
      - targets: ["dakera:3300"]
    metrics_path: /metrics

Alert recommendations

OpenTelemetry tracing

# Enable OTLP trace export
DAKERA_TRACING_ENABLED=true
OTEL_EXPORTER_OTLP_ENDPOINT=http://jaeger:4317
OTEL_SERVICE_NAME=dakera

Log management

Dakera uses structured logging via RUST_LOG. In production, set info level. Logs are emitted as structured JSON when a JSON subscriber is configured.

# Log levels
RUST_LOG=info                          # production (recommended)
RUST_LOG=debug                         # development / troubleshooting
RUST_LOG=info,tower_http=debug         # verbose HTTP logging only

Logrotate

# /etc/logrotate.d/dakera
/var/log/dakera/*.log {
    daily
    rotate 14
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload dakera 2>/dev/null || true
    endscript
}

Upgrading

Dakera supports zero-downtime upgrades. Data is backward-compatible across minor versions. For Docker deployments:

# 1. Pull the latest image
docker pull ghcr.io/dakera-ai/dakera:latest

# 2. Restart the container
docker compose down && docker compose up -d

# 3. Verify health and version
curl http://localhost:3300/health
# {"service":"dakera","status":"healthy","version":"0.11.56"}

For systemd deployments: replace the binary at /opt/dakera/dakera, then sudo systemctl restart dakera. Always verify the health endpoint after upgrade.

Production checklist

Environment variable reference

Complete reference of all configuration options, grouped by category.

Core

Storage

Security

Audit & tracing

Clustering

Inference & retrieval

AutoPilot & decay