RECIPE 11 · ENTERPRISE

Deploy to Your Cloud

xMesh deploys as a single container in your own cloud — daemon, cockpit, and agent minds together. Nothing installs on workstations. Nothing phones home. Your operators need a browser; your agents use your enterprise AI credentials.

Steps

Build from the recipe

You build the image yourself from a 40-line Dockerfile your security team can audit — we ship the recipe, not a binary. Building on your own infrastructure also gives you the right architecture (amd64/arm64) automatically.

FROM node:22-slim

RUN apt-get update \
 && apt-get install -y --no-install-recommends git ca-certificates curl \
 && rm -rf /var/lib/apt/lists/*

# The product, and the two CLI minds workers summon.
RUN npm install -g @sym-bot/xmesh @anthropic-ai/claude-code \
 && npm install -g @openai/codex || true

# The mesh's memory lives on volumes — the container is disposable, the cognition is not.
VOLUME ["/root/.xmesh", "/root/.sym"]

EXPOSE 8787
ENV NODE_ENV=production

# First start prints the operator passcode to the container log.
CMD ["xmesh", "start"]

docker build -t xmesh .

Run with your AI credentials

Agent minds inherit the container environment — set your enterprise model access once and every agent uses it. No individual AI accounts.

# Claude via Amazon Bedrock (billing and governance on your AWS account)
docker run -d -p 8787:8787 \
  -e CLAUDE_CODE_USE_BEDROCK=1 -e AWS_REGION=us-east-1 \
  -v xmesh-data:/root/.xmesh -v sym-data:/root/.sym \
  --name xmesh xmesh

# Claude via Vertex AI:   -e CLAUDE_CODE_USE_VERTEX=1 -e ANTHROPIC_VERTEX_PROJECT_ID=...
# Claude via org API key: -e ANTHROPIC_API_KEY=...
# GPT minds (optional):   -e OPENAI_API_KEY=...   (org-scoped key)

Verify the AI lane before the first token

Workers inherit the daemon’s environment, so the lane you set is the lane every mind speaks. Prove it: the self-test spins a local mock endpoint and costs nothing; --live sends one tiny real prompt through your env.

docker exec xmesh node /usr/local/lib/node_modules/@sym-bot/xmesh/scripts/verify-ai-lane.mjs
docker exec xmesh node /usr/local/lib/node_modules/@sym-bot/xmesh/scripts/verify-ai-lane.mjs --live

Open the cockpit

The first start prints the operator passcode to the container log (docker logs xmesh). Open http://<host>:8787, enter it once, and you are in — the mesh canvas, missions, earned trust, and OPS.

Drop in your license

xMesh is licensed per organization, seat-based. Your license is one signed line — offline-verified, self-expiring, no activation server. Evaluation licenses start their clock at first use, not at issuance.

docker exec xmesh sh -c 'echo "<your license line>" > /root/.xmesh/license'
# effective on the next request — no restart

What leaves your walls

Nothing. The mesh’s memory lives on your volumes; model calls go to the endpoints you configured (your Bedrock, your Vertex, your keys); the license verifies offline. There is no telemetry, no activation callback, no data path to us.

A deployed mesh needs an owner: continue with Recipe 12 — Establish Your Trust Root.

← 10 · Claude Code on the Mesh 12 · Establish Your Trust Root →