Deployment guide

Deploy the runtime in your environment and choose whether the console is hosted or private.

The runtime is always self-hosted. The deployment choice is about how you want to operate the control plane: not at all, hosted by ZNYX, or self-hosted in Enterprise.

Deployment patterns by plan and where the console fits into the architecture.
Plan	Runtime	Console	Hosted visibility	Best fit
Starter	Self-hosted	None	No hosted console	Open-source runtime evaluation and local policy files.
Growth	Self-hosted	Hosted by ZNYX	Metadata-first by default	Shared policy workflow and operational visibility.
Enterprise	Self-hosted	Hosted by ZNYX or self-hosted	Deployment-dependent	Procurement and private deployment requirements.

1. Standalone runtime

Use this mode to evaluate the runtime without introducing the console. It is the cleanest path for the free tier and the fastest way to validate policy enforcement locally.

docker build -f znyx-backend/Dockerfile.runtime -t znyx-runtime znyx-backend/
docker run -d -p 8080:8080 --name znyx-runtime znyx-runtime

In this mode the runtime loads policy from your own files. No hosted console is involved.

2. Connected runtime for Growth

Growth keeps the runtime self-hosted and connects it to a hosted console for policy management, rollout, and operational traces.

environment:
  - ZNYX_MODE=managed
  - ZNYX_CONTROL_PLANE_URL=<console-api-url>
  - ZNYX_RUNTIME_TOKEN=<runtime-token>

The hosted console works from operational metadata by default. It does not move the runtime into a managed SaaS - your runtime keeps processing prompts and outputs inside your infrastructure.

3. Kubernetes and Helm

The production path is still runtime-first: deploy the runtime with your normal cluster tooling, then layer in console connectivity only if the team needs centralized workflow.

helm install znyx-backend deploy/helm/backend

4. Enterprise private deployment

Enterprise can package both runtime and console as self-hosted components. This is the path for air-gapped environments or procurement rules that block a hosted control plane.

5. Routing note for production

In production the console sits behind your own domain or ingress. The sign-in route/console/login is an internal app path behind that host (sign-up lives on the same screen) and should not be exposed as a public landing URL.

6. Verify the deployment

curl http://localhost:8080/healthz
curl http://localhost:8080/readyz
curl http://localhost:8080/v1/bundle/status

Compare Plans Deployment Patterns