Skip to main content
Compiler ships as a single container image, so it runs on any platform that can run a container and give it PostgreSQL and Redis. This guide walks through deploying it on your own platform, such as Kubernetes, Amazon ECS, Nomad or Cloud Run. The steps use your platform’s usual building blocks. On Kubernetes, that’s a Deployment, Service, Ingress and Secret. On ECS, it’s a task definition and service behind an Application Load Balancer.

​
Prerequisites

  • A container platform that can pull public images from ghcr.io
  • A domain or subdomain for Compiler, such as compiler.yourdomain.com, and a TLS certificate for it
  • A way to provision PostgreSQL and Redis, either managed services or your own

​
Step 1: Provision PostgreSQL and Redis

PostgreSQL 16 or later

Create an empty database that Compiler owns. Managed services such as Amazon RDS, Aurora PostgreSQL, Cloud SQL and Azure Database for PostgreSQL work.The database user must be able to create tables and the pg_trgm extension, which the first migration adds. On RDS, the master user can.

Redis 7 or later

Managed services such as Amazon ElastiCache and Memorystore work. Compiler refuses to start without Redis.
Note both connection strings for the next step. Use a rediss:// URL when Redis requires TLS.

​
Step 2: Create the secrets

Generate an encryption key for stored credentials:
Store these values in your platform’s secret store, such as a Kubernetes Secret, AWS Secrets Manager or SSM Parameter Store:
Back up TOKEN_ENCRYPTION_KEY. If it is lost, every stored credential (GitHub App key, AI provider keys, connectors) has to be entered again.

​
Step 3: Run the container

Run one replica of the image with the secrets from step 2 and these settings: The image is public and built for linux/amd64 and linux/arm64, so no registry credentials are needed. The other environment variables are optional.
main is the latest build; pull it again to update. Every build also has a sha-<commit> tag. Use one to pin a version and roll back predictably. Settings in Compiler shows the commit your instance is running.
Without PORT, the app uses 3000 when that port is free and picks another when it isn’t. Setting it keeps the port your platform routes to fixed.
Compiler clones the repositories it reads into /repos. The contents can be lost safely: Compiler re-clones any missing repository the next time someone loads the app, and shows a loading screen until it’s ready.Ephemeral storage, such as an emptyDir volume or ECS task storage, works. A persistent volume avoids re-cloning after every restart or deployment, which matters for large repositories. Size it for full clones of every repository in every project.
Database migrations run automatically when the container starts, so no separate migration job is needed.

​
Step 4: Configure the deployment lifecycle

Keep to one replica, and make sure an old and a new one never run side by side. Each replica runs migrations on startup and keeps its own clones of your repositories. When it receives SIGTERM, Compiler stops taking new work and gives in-progress answers up to 25 seconds to finish, so allow at least 30 seconds before the container is killed.
  • Set replicas: 1 and strategy.type: Recreate
  • Set terminationGracePeriodSeconds: 30 or more

​
Step 5: Add health checks

GET /up on port 3000 returns 200 OK when the app can reach its database, and 503 when it can’t. Use it for liveness and readiness probes, and for load balancer target health checks. Requests wait until startup migrations finish, so give the first check some room with an initial delay, a startup probe or an ECS health check grace period.

​
Step 6: Expose it over HTTPS

The container serves plain HTTP. Put a load balancer, ingress or reverse proxy in front of it to terminate TLS, and point your domain at it.
  • Route https://compiler.yourdomain.com to port 3000 on the container
  • Pass the original Host header through. Compiler checks it against PUBLIC_URL for its MCP endpoint. Kubernetes ingress controllers and AWS load balancers do this by default
  • Allow long-lived responses. Answers stream over HTTP, so raise any idle or read timeout below a few minutes
Compiler can run on a private network with no public address. The only exception is Slack, which sends events to /api/slack/events and needs that path reachable from the internet.

​
Step 7: Allow outbound access

If your network restricts egress, allow HTTPS (443) from the container to these hosts: The container also needs to reach your database and Redis, any MCP connectors you add, and your identity provider if you use SSO.

​
Step 8: Finish setup

Open https://compiler.yourdomain.com and sign up as the first user. Setup then walks you through:
  1. Connecting a GitHub App and choosing the repositories Compiler may read
  2. Choosing an AI provider, either the Anthropic API or AWS Bedrock
  3. Creating your first project
On AWS, Bedrock and S3 storage take an IAM access key ID and secret access key, entered in the app. Compiler doesn’t use instance profiles, ECS task roles or IAM Roles for Service Accounts (IRSA).

​
Updating

Pull the new image and restart the deployment. With the main tag, that’s a rollout restart on Kubernetes or a forced new deployment on ECS. With a pinned sha- tag, change the tag. Migrations run on startup.

​
Quick reference