Otari publishes mzdotai/otari on Docker Hub. Use the
Quickstart for local setup; this page covers production choices
and hybrid gateways.
A durable standalone deployment should:
- use PostgreSQL and back it up
- set a strong master key in a secret store
- set and back up
OTARI_SECRET_KEYwhen storing provider credentials - configure explicit pricing or deliberately enable default pricing
- terminate TLS in front of the gateway
- restrict database and management access
- monitor
/health/readinessand, when enabled,/metrics - pin an image version and test migrations before upgrading
The default SQLite database is intended for evaluation and single-node local use.
The repository Compose stack runs Otari and PostgreSQL:
cp config.example.yml config.yml
docker compose pull
docker compose up -dUse docker-compose.build.yml when testing source changes:
docker compose -f docker-compose.yml -f docker-compose.build.yml up --buildThose pages own their current image tags, variables, platform limits, and maintenance instructions.
Create a gateway in otari.ai and copy its gateway token, then start Otari in hybrid mode. Put the token in a private environment file:
OTARI_AI_TOKEN=gw_your_gateway_tokendocker run --rm -p 8000:8000 \
--env-file .env \
mzdotai/otari:0.4.0 \
otari serveHybrid mode does not initialize a local management database or use local provider credentials. Clients send an otari.ai user token to the gateway:
curl http://localhost:8000/v1/chat/completions \
-H "Authorization: Bearer tk_your_user_token" \
-H "Content-Type: application/json" \
-d '{
"model": "openai/gpt-4o",
"messages": [{"role": "user", "content": "Say hello."}]
}'Verify both liveness and control-plane reachability:
curl http://localhost:8000/health
curl http://localhost:8000/health/readinessSee Runtime modes for the trust and credential model.
Compose profiles start the bundled service backends:
docker compose --profile code-exec up -d
docker compose --profile web-search up -d
docker compose --profile guardrails up -dWeb search needs no container when web_search_provider names a licensed API
(tavily or brave) and web_search_provider_api_key carries its key. These
services are optional; requests that require an unconfigured backend fail
without affecting ordinary inference.
See Built-in tools and Guardrails.
Otari accepts a mounted YAML file, scalar environment variables, or a complete
YAML document in OTARI_CONFIG_YAML or OTARI_CONFIG_B64. See
Configuration for precedence and security notes.