# Deploy an execution host

Run the execution host where its provider credentials belong: on the user's computer, in a dedicated account environment, or on an application-owned server. Applications in all four supported languages connect through the same authenticated protocol.

## Choose a deployment shape

| Situation                                            | Recommended guide                                                             |
| ---------------------------------------------------- | ----------------------------------------------------------------------------- |
| Desktop and app backend on the same computer         | [Desktop companion](/docs/desktop) and [local connections](/docs/connections) |
| Existing trusted SSH access to an application server | [Remote connections](/docs/real-connections)                                  |
| Dedicated Linux host per native provider account     | [Account containers](/docs/account-isolation)                                 |
| Node service with application-owned credentials      | [Execution host](/docs/host) and [access control](/docs/remote-access)        |

The route must be reachable from your **application backend**. A browser running on a laptop does not make that laptop reachable from a hosted backend. There is no public relay.

## Set up the host

Follow [Install & connect](/docs/quickstart) to install the package, select an existing native sign-in or API key, and initialize a private configuration. The CLI requires explicit scoped tokens. A programmatic host can instead supply `HostAuthentication` backed by the application's own authorization system.

Use [the host service guide](/docs/host#run-as-a-service-and-upgrade) for startup and shutdown. Keep configuration, provider profiles and runtime state private and persistent. A static credential is loaded at startup; coordinate a host restart when changing its configured token.

## Protect the connection

- Use verified HTTPS for a remote endpoint, or loopback HTTP through an explicitly trusted SSH tunnel.
- Keep the execution port private. Configure TLS and routing deliberately; the SDK does not open firewall ports.
- Give each client the provider, model, tool and management grants it needs. These are distinct from provider credentials and application sign-in.
- Keep secrets out of images, URLs, frontend code and logs. Protect private files with appropriate owner access.
- Browser origins are denied by default. An exact origin allowlist does not replace bearer authentication.

For HTTPS proxy prefixes, invitations and connection checks, follow [Remote connections](/docs/real-connections). The Linux desktop can manage outbound SSH to named trusted destinations using existing keys and host trust. It does not install provider CLIs or automatically reconnect a failed tunnel.

## Dedicated account containers

The [Linux account-container guide](/docs/account-isolation) contains the reviewed Docker build, Compose setup, private volumes, TLS and account-provisioning steps. Each account uses its own host and configuration. Do not mount a host home directory, sibling account profile or Docker socket into an execution container.

Mounted private configuration and secret files must be readable by the configured runtime user. Keep credential files mode `0600` and private directories mode `0700` on POSIX; use a deliberate container ownership and SELinux-label policy for mounted paths. The operator, Docker daemon and shared kernel remain trusted.

## Streaming, capacity and shutdown

Preserve streaming responses through your reverse proxy and size its connection policies for long-running work. There is no SDK generation deadline or inactivity timeout by default. Configure an [inactivity policy](/docs/timeouts) only when the application needs one.

Set explicit [concurrency and resource limits](/docs/scheduling). During upgrades, drain or deliberately cancel active work, back up private state and preserve provider/account IDs and grants. Cancellation does not undo external effects. [Durable jobs](/docs/jobs) require their own persistent storage and revocable authorization.

Read [Upgrading](/docs/migrations) before changing a host or client. A package update does not upgrade a running service or expand its grants.