# Self-hosting

Run your own TaskStation instance with Docker Compose, on a VPS or for evaluation.

Canonical page: https://taskstation.co/docs/host

TaskStation runs as one Docker Compose stack: the frontend, the API, the LLM gateway, and the Supabase distribution. This page shows the three ways to install it, how updates work, and how to back up your data.

Agent sessions run on a separate sandbox provider, not on this stack. The default is [Daytona](https://www.daytona.io/); Platinum and E2B are also supported.

## One-shot bootstrap

On a bare Linux box, one command installs Docker, installs the `taskstation` CLI, and starts the stack:

```sh
curl -fsSL https://raw.githubusercontent.com/melihyolacan/suna/main/scripts/taskstation-selfhost-up.sh \
  | bash -s -- --domain taskstation.example.com --email ops@example.com
```

This script runs on Linux only. On another OS, install the CLI directly and use the manual path below.

## Manual path

### Install the CLI

```sh
curl -fsSL https://taskstation.co/install | bash
```

### Point DNS, then initialize

Create an A/AAAA record for your domain and for `api.<domain>`, both pointing
at the box's IP. Open ports 80 and 443 — the bundled Caddy proxy uses them to
issue a TLS certificate. Then run:

```sh
taskstation self-host init --domain taskstation.example.com
```

### Start the stack

```sh
taskstation self-host start
```

Check `taskstation self-host status`, `logs`, and `doctor` while the stack starts.

## Evaluation mode

To try TaskStation with no domain, use a Cloudflare tunnel instead of a domain:

```sh
taskstation self-host init --tunnel cloudflare
taskstation self-host start
```

The tunnel URL changes on every restart. Use this mode for evaluation, not production.

After the stack starts, set your sandbox provider key:

```sh
taskstation self-host configure
```

`configure` is an interactive prompt for the sandbox provider key, and
optionally a managed-git token. Sign up in the dashboard, then connect your
own LLM key in the model picker. Self-hosted instances use your own key
by default.

> **Info**
> By default, only the platform admin can create new organization accounts. The
> platform admin is the super-admin flag on a membership, not a role.
> Any signed-in user can still join by invite or SSO. Opt out with
> `taskstation self-host init --no-restrict-account-creation`, or re-enable the
> admin-only default with `--restrict-account-creation`.

Each API container has a 640 MiB memory limit by default.
Keep this default on an 8 GiB host.
Use a 1 GiB limit on a 16 GiB host when API traffic reaches the default limit:

```sh
taskstation self-host env set TASKSTATION_API_MEMORY_LIMIT=1024m
```

Confirm the applied limit with `docker stats --no-stream`.

## Updates

Every instance updates itself automatically. Pin an exact version instead:

```sh
taskstation self-host update --tag 0.9.84
```

Turn the updater off with `--auto-update off`. See
[Self-hosting architecture](/docs/host/architecture) for
the update schedule, the zero-downtime swap, and the channels.

## Backups

TaskStation has no separate backup system. Each instance stores its data as two
directories under `~/.config/taskstation/self-host/<instance>/`: `volumes/db/data`
(the Postgres database) and `volumes/storage` (file storage). The instance's
`.env` file holds every secret and signing key it uses. Back up all three
before you run a destructive command.

> **Warn**
> `taskstation self-host uninstall` stops the stack, deletes its containers and
> volumes, and deletes the instance directory. This cannot be undone.

## Learn more

- [Self-hosting architecture](/docs/host/architecture) —
  how the stack fits together.
- [CLI reference](/docs/cli) — every `taskstation self-host` subcommand
  and flag.