Skip to main content
Craft runs generated code in isolated sandboxes and sends sandbox network traffic through an egress proxy. Self-hosted deployments can run these sandboxes in Kubernetes or Docker.

Kubernetes

Deploy sandbox pods, the proxy, RBAC, and workers with the Onyx Helm chart.

Docker Compose

Run sandbox containers and the proxy on a trusted single Docker host.
Use Kubernetes if more than a few people will use Craft, especially when they may work concurrently. Each active user needs a sandbox, so Docker Compose is best suited to small, single-host deployments.

​
Requirements

Both deployment paths require:
  • A full Onyx deployment with the vector database and background workers. Craft does not run on Onyx Lite.
  • A supported Onyx release and matching application and sandbox image versions.
  • An Onyx URL that the sandbox runtime can reach, configured as SANDBOX_API_SERVER_URL.
  • Capacity for a sandbox per active Craft user.
  • An Anthropic, OpenAI, or OpenRouter provider configured after deployment.
Sandboxes execute model-generated code. Review Craft Architecture before enabling Craft, especially the sandbox, network, credential, and sharing boundaries.

​
After the runtime is ready

1

Configure a model

In Admin Panel → Language Models, add an Anthropic, OpenAI, or OpenRouter provider and make at least one model available to your Craft users.
2

Configure workspace access

Open Admin Panel → Craft → Access. Keep the workspace default off for a limited rollout, or enable Craft for everyone.
3

Run a complete test

As an enabled user, start a Craft session, send a prompt that creates a file, and open or download the result.
4

Add Apps and Skills

Configure external services under Admin Panel → Craft → Apps and reusable workflows under Craft → Skills.

Managing Craft

Configure access, models, Apps, and workspace instructions.

Craft Architecture

Understand sandbox isolation, egress, credentials, and approvals.