Skip to main content
Working with an agent? Give them a link to this page as markdown.

Deployment example

Watcher runs as Docker containers in your environment. These diagrams show two authentication paths. Both paths lead into the same stack.

For a cluster deployment, see the Kubernetes infrastructure example. For Tailscale Aperture and LiteLLM connections, see the gateway deployment reference.

WorkOS authentication​

Your reverse proxy terminates TLS and routes traffic. WorkOS handles sign-in.

A self-hosted Watcher deployment using WorkOS authentication. Developers and triage users connect through a TLS-terminating reverse proxy to the Analyzer and API. The database, bootstrap container, grading scheduler, and retention cleanup worker remain internal to the stack. The API uses WorkOS for sign-in and identity verification.

Bring your own authentication​

Your reverse proxy authenticates each request. It removes untrusted identity headers. It adds the trusted user and role headers Watcher consumes. Watcher does not connect to WorkOS on this path.

A self-hosted Watcher deployment using bring-your-own authentication. Developers and triage users connect through an authenticating reverse proxy that uses the organization's identity provider and injects trusted identity headers into the Analyzer and API. The database, bootstrap container, grading scheduler, and retention cleanup worker remain internal to the stack.

The stack contains these components:

  • Analyzer
  • API
  • Database
  • Bootstrap container
  • Retention cleanup worker
  • Grading scheduler (when trailing review is enabled)

The retention worker runs continuously. It does two things. First, it deletes grader inputs. These are inputs that have remained unlinked to a tool-call decision for more than eight days. Second, it enforces any enabled organization session-content retention policy.

The session policy is disabled by default. Disabling the policy retains session content indefinitely.

Organization administrators can enable a period between 7 and 365 days. They configure this through the Analyzer's Data Retention controls or the organization settings API.

Both workers run the API image with separate entrypoints.

See Setup for installation. See Security for data flows. See Supply chain security for artifact controls.

Found an issue with this page? Report it on GitHub.