Self-hosting
Deploy the Jio bridge and workspace service on infrastructure you control.
Jio is designed to run without a managed control plane. You provide the remote machine, connection path, identity model, and operational controls.
Deployment components
| Component | Location | Responsibility |
|---|---|---|
| MCP bridge | Local | Presents tools to the agent and carries authenticated requests |
| Workspace service | Remote | Performs filesystem and process operations inside the workspace |
| Policy configuration | Local and remote | Defines approval, permissions, limits, and networking |
| Logs and metrics | Operator-controlled | Records tool activity, failures, and resource pressure |
Deployment sequence
Prepare the host
Patch the operating system, create a dedicated service identity, and choose the workspace root.
Establish the connection
Use an authenticated and encrypted transport between the local bridge and remote service. Avoid exposing the service directly to the public internet.
Apply policy
Configure filesystem scope, allowed operations, resource limits, network rules, and approval behavior.
Add observability
Capture health, request latency, tool failures, policy denials, and capacity signals without logging secret values.
Test recovery
Confirm you can revoke access, rebuild the service, restore intended project state, and destroy a compromised workspace.
Operational checklist
- Bind the workspace service to a private interface or protected network.
- Keep the service and workspace identities non-privileged.
- Store credentials outside repositories and rotate them regularly.
- Set disk quotas and monitor free space as well as CPU and memory.
- Define timeouts for commands and idle sessions.
- Back up only state you deliberately intend to retain.
- Review rejected operations; they often reveal a missing workflow or an overreaching agent.
- Re-run boundary tests after upgrades or policy changes.
No account does not mean no identity
A self-hosted deployment still needs strong machine and user authentication. Ownership replaces the managed control plane; it does not remove access control.
Continue with the configuration concepts and security model before exposing the workspace to an agent.