Hosted Agents
Run a complete OpenClaw, Hermes, n8n, Onyx, or custom multi-service Compose stack with prebuilt images, state, networking, HTTPS, and isolation.
Approved organizations can create, revise, inspect, open, and delete Agent Hosts in the console or Control API.
Capacity and billing
Approved organizations have no fixed limit on the number of Agent Hosts they can own. New hosts still need available shared CPU, memory, storage, and host capacity, plus enough credit within your spending limits. If capacity is full, retry later or remove a host you no longer need.
US East placement
New Agent Hosts use Europe (eu-1) by default. The console shows placement with the price quote; API clients may omit location or explicitly choose "us-1" for US East. Existing hosts retain their location and disks when updated.
US East hosts use isolated virtual machines and encrypted persistent disks. Capacity grows on demand, so cold starts can take several minutes. Services that share a volume run together on one worker. Pausing releases compute capacity while keeping the disk; resuming reattaches that disk.
Review spec.compute_quote from an Agent Host dry run and submit its id as accepted_quote_id. The quote covers runtime, persistent disk, network allowance and startup credit hold. Runtime starts billing when ready, with a 60-second minimum. Allocated disk is billed even during setup and while paused, until deleted. Model calls remain separate.
Outbound Internet traffic uses the supplied authenticated HTTPS proxy on port 443. Your client must honor HTTPS_PROXY; direct Internet, metadata and private-address access are blocked. Public ingress and forwarded outbound bytes in both directions count toward the renewable network allowance. The default is 1 GiB per five minutes; send max_network_bytes: 0 to disable public and Internet access. Omitting this field on an update preserves its current value.
Volume names and sizes are fixed after creation. Disk is retained if credit runs out; Tarka pauses the host and does not automatically delete data or create unpaid debt. Delete unneeded hosts to release their disks.
Push private images to Tarka
Build locally or in your own CI, then push to registry.tarka.rest/orgs/<organization UUID>/<repository>. Use the same organization's canonical UUID as the Docker username and a Tarka sandbox-scoped API key as the password. Your account needs approved sandbox access and an owner, admin, or operator role to push. Model-only keys cannot access the registry.
ORG_ID='<your organization UUID>'
IMAGE="registry.tarka.rest/orgs/$ORG_ID/my-agent:v1"
# Enter a Tarka sandbox-scoped API key at Docker's password prompt.
docker login registry.tarka.rest --username "$ORG_ID"
docker build --platform linux/amd64 --tag "$IMAGE" .
docker push "$IMAGE"Enter the key only in your terminal, never in a coding-agent conversation. Reference the pushed image in Custom Compose. Tarka checks access and pins the image digest when saving; hosts pull it automatically. No GitHub account, PAT, or extra host pull credential is required.
Each organization can retain up to 5 GiB and upload two layers concurrently. A platform image may contain up to 2 GiB of compressed content. Keep the image available while hosts use it, including while paused. Remote Git and Dockerfile builds on Tarka remain unavailable.
Private GitHub images
Automating deployments? See REST, MCP, and Python credential examples.
If your images already live on GitHub, reference them in Compose. Under Private GitHub images, add a credential with a label, the token owner's GitHub username, a classic PAT with read:packages, and the Compose services that should use it. You can use different credentials for different services. The token's account must have access to each assigned package; authorize SSO if the organization requires it. Tarka registry images need no GitHub credential.
Select Test image pulls before applying credential changes. Tarka downloads and verifies every GHCR image in the Compose file without running it. A successful test is valid for 30 minutes and one apply for that host and credential version. A failed test leaves the current host and saved credentials unchanged. Images are pinned to the verified digest.
Credentials are encrypted and never returned by the API. Leave a stored token blank to keep it, or enter a replacement and test again. To remove a credential, remove its row and test the remaining configuration; images without an assigned credential must be publicly accessible. Apply the host revision before revoking the old PAT at GitHub. GHCR workloads always check registry access, even when image layers are cached.
You can import a local JSON file containing an array of credentials with label, username, token and services fields. Open the file picker yourself: do not give the file or its values to a coding agent. Limits are 16 credentials, 32 images, 2 GiB per image and 4 GiB per test. Remote source builds remain unavailable.
Managed templates
Templates are versioned Compose stacks, not single-container shortcuts. You provide their required credentials when applying the host.
2 services · CoreOpenClaw, browser automation, persistent workspace and browser state.
2 services · CoreHermes gateway and Web UI with shared persistent home, source and workspace volumes.
1 service · CoreWorkflow automation with private owner setup, persistent state, and a managed Tarka Inference credential.
9 services · ProWeb, API, workers, model servers, Postgres, OpenSearch, Redis and S3-compatible object storage. The code interpreter is not included.
The current Onyx template uses a new OpenSearch data volume. Existing Vespa deployments need an explicit reindex or migration before replacement.
Choose the model and gateways before deploying
The console walks through template, primary model, messaging gateways, environment variables, and a final review. DeepSeek V4.1 Flash (EU), deepseek-v4.1-flash-eu, is the default when it is active: the same model as deepseek-v4.1-flash, through its EU inference route, independent of where the host runs. It is a paid model, so its calls are charged to your organization's credit at the listed price. Through the API, a new revision that names no model keeps the host's current one.
81,920 tokensBuilt-in adapters cap the active model context and enable automatic compaction at 65,536 tokens.
STT · OCR · TTS · embeddings · rerankAvailable active utility aliases are injected through the same host-local API.
template-specificConfigure supported Telegram, Discord, WhatsApp, or Signal adapters. Secrets are encrypted separately; policy YAML remains editable.
OpenClaw currently publishes Telegram, Discord, and WhatsApp. Hermes publishes those gateways plus Signal. Pair Signal from the ready host card in the console. Custom Compose can run a gateway service directly, but does not inherit a runtime-specific adapter.
Open a shell in any running service
Choose Terminal on an Agent Host card, select a service and container, then Connect. The terminal runs inside that container with its existing user, environment and mounted volumes.
Use it for runtime setup, pairing commands and diagnostics across built-in templates and Custom Compose. Working-directory changes and interactive input remain in the same shell. Use Ctrl+C to interrupt a command, or Disconnect to close the session.
Automatic shell selection prefers bash and falls back to sh. The container image must include a shell. Sessions close after 15 minutes without input, after one hour, or when the container or terminal service restarts. Owners, admins and operators with Agent Hosts access can connect.
For example, select the Hermes agent container and run your bot’s pairing command, replacing PAIRING_CODE with its code:
hermes pairing approve telegram PAIRING_CODEUse Compose as the portable stack definition
Tarka accepts a supported subset of the Compose Specification and manages the declared services as one Agent Host.
custom agent + Postgres + Redisx-tarka:
routes:
- service: agent
port: 8080
path: /
volume_sizes:
postgres-data: 20Gi
services:
agent:
image: registry.tarka.rest/orgs/<your-organization-uuid>/my-agent:v1
environment:
DATABASE_URL: postgres://agent:${POSTGRES_PASSWORD}@postgres:5432/agent
REDIS_URL: redis://redis:6379
depends_on:
postgres: {condition: service_healthy}
redis: {condition: service_started}
expose: ["8080"]
postgres:
image: postgres:16-alpine
environment:
POSTGRES_USER: agent
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: agent
volumes: [postgres-data:/var/lib/postgresql/data]
expose: ["5432"]
healthcheck:
test: [CMD-SHELL, pg_isready -U agent]
interval: 10s
timeout: 5s
retries: 5
redis:
image: redis:7-alpine
expose: ["6379"]
volumes:
postgres-data:| Compose input | Hosted Agent behavior |
|---|---|
services and depends_on | Starts the declared services and honors supported dependency conditions. |
image | Runs the declared container image within the Agent Host boundary. |
build.context | Currently disabled. Build locally or in your own CI and reference the published image. |
healthcheck | Controls service health and readiness reporting. |
| Named volumes | Persists declared data across host revisions and shares it only as configured within the host. |
tmpfs and shm_size | Memory-backed ephemeral volumes. |
| Resource reservations and limits | Per-service resource bounds within the selected stack quota. |
x-tarka.routes | Path-based public routing through a generated HTTPS hostname. |
Flexible application topology without host control
Each host is tenant-isolated and quota-limited. Applications receive no host or control-plane access, and private-address egress is blocked by default.
privileged, host PID/IPC/network/user namespaces, capabilities, devices and GPUs, bind mounts, the Docker socket, external networks or volumes, file includes, Compose secrets/configs, and privileged build features are not accepted.
Compose service and named-volume keys must be lowercase DNS labels. A Compose file may contain up to 24 services, 32 named volumes, and 512 KiB.
Custom services may set a numeric user such as user: "1000:1000". Persistent volumes provide shared group access with GID 1000, so applications can write without running as root. Image files must still be readable and executable by the selected user.
Secret values travel separately from Compose
Submit interpolation values through the console or the request's variables list. Values marked secret are encrypted at rest, supplied only at runtime, and never returned in resource specs—even when interpolated into a connection URL.
When working through MCP, have the assistant prepare a secret handoff, then upload your file yourself through its authenticated console link. The assistant receives the bundle ID, key names, and status; secret values stay outside its context.
Both API_TOKEN: ${API_TOKEN} and an interpolated connection URL such as postgres://user:${PASSWORD}@db/app remain secret-backed at runtime.
Inside a stack, http://tarka/v1 resolves to Tarka's model API without a caller-supplied API key. Access is automatically scoped to the host and its selected primary and utility models.
Update named hosts and inspect lifecycle state
Names are unique within an organization. Applying the same name creates an immutable revision while retaining named volumes. Status advances through pending, provisioning, and ready; deployment and workload phases appear in status_detail.
Choose Configure on a host card to open its saved runtime settings. Use the Model and Gateways steps to edit those settings, leave stored secrets blank to keep them, then review and apply a new revision.
POST same nameCreates the next revision and applies changed images, settings, routes and services.
external_urlAvailable after all services report ready.
DELETE host IDPermanently removes the host, its routes, and its managed persistent data.