Install
One command, inside your own account.
Bring Your Own Cloud deployments are not something we reach into. You run the installer in your infrastructure, it launches an agent, and the agent pulls the work it has been told to do. Nothing listens on the network, and we never hold a role in your account.
The one-liner
Start here.
On any host with Docker and outbound HTTPS:
curl -fsSL https://install.calliope.ai/install.sh | shUse the explicit /install.sh path rather than the bare host. The install site serves an index page beside the script, and a one-liner against the host alone can pipe HTML into sh.
The script detects your platform, checks for Docker, verifies the signed agent image against cosign.pub, and launches it. It is POSIX sh with no bashisms, and every default is overridable by a flag or an environment variable.
Three ways to run it
Pick the interface that fits the host.
| Mode | What you get | Use it when |
|---|---|---|
| Setup UI (default) | A setup interface served on localhost. | You are at a workstation or a jump host with a browser. |
| Wizard | An interactive terminal walkthrough. | You are on a headless box over SSH and want to be asked, not guess. |
| Daemon | Headless, no prompts. CALLIOPE_MODE=daemon | You are automating the install, or an agent is running it for you. |
Why pull, not push
We do not hold keys to your account.
A push model needs a cross-account IAM role, standing credentials, and an inbound path from a vendor's control plane into your network. That is a permanent hole in a perimeter you are paying to keep closed, and it is the first thing a security review asks about.
The BYOC agent inverts it. It accepts nothing inbound. It reaches out, authenticates, leases the work it is told to do, and reports back. Your firewall needs one outbound HTTPS path and no ingress rule at all. Revoking us is a matter of stopping a container you own.
That is also why BYOC has no provisioning step on our side. There is nothing for us to provision. The installer and the agent do it, in your account, under your control.
Configuration
Environment variables.
| Variable | What it does |
|---|---|
CALLIOPE_MODE | setup, wizard or daemon. |
CALLIOPE_VERSION | Image tag to pull. Defaults to stable. |
CALLIOPE_BOOTSTRAP_TOKEN | Single-use enrollment token, issued from your deployment in the control plane. |
CALLIOPE_DEPLOYMENT_ID | The deployment this agent enrolls against. |
CALLIOPE_CONTROL_PLANE_URL | Where the agent enrolls and leases jobs. Defaults to https://app.calliope.ai/app. The /app prefix is required. |
Flags mirror every variable, so sh -s -- --mode daemon is equivalent to setting CALLIOPE_MODE. Beyond this script, the bootstrap/ paths run the same signed artifact through Docker Compose, Kubernetes, CloudFormation or Terraform, if you would rather it arrive the way the rest of your infrastructure does.
For agents
Machine-readable, so you do not have to scrape this page.
If you are an agent handling pricing, checkout or installation on someone's behalf, read /pricing.json. It carries the full volume-tier table, the checkout endpoint and its request contract, and these install steps as structured data, generated from the same source that bills the customer.
Two things to respect. Payment details are entered by the buyer on Stripe's hosted page, so do not attempt to collect or submit card details for them. And the enrollment token is single-use and grants control of a deployment, so treat it as a secret and never write it somewhere it will be read back later.
A short index of the whole site is at /llms.txt.
Want someone on the call?
Enterprise deployments, air-gapped networks and security reviews are a conversation, not a one-liner.
