Self-Hosted Requirements

Hardware and software requirements for running KubeWatch on your own infrastructure.

Before deploying the self-hosted KubeWatch stack, make sure your infrastructure meets the following requirements.

Hardware

Resource	Minimum	Recommended (production)
CPU	2 vCPU	4 vCPU
RAM	6 GB	10 GB
Disk	20 GB	100 GB
Network	100 Mbps	1 Gbps

The minimum spec is suitable for small teams monitoring fewer than 100 containers with 7-day metric retention. For production environments with longer retention or more agents, the recommended spec applies.

The RAM minimum accounts for the embedded AI log-diagnosis model (`embedded-llm`, serving Phi-4-mini-instruct via llama.cpp), which is on by default and reserves 1.5 GB with a 3 GB ceiling on its own, on top of the rest of the stack's combined reservations (roughly 3.3 GB across the other ~25 containers). If you don't need AI log diagnosis, set `EMBEDDED_LLM_ENABLED=false` (Docker Compose) or `devopsAgent.embeddedLlm.enabled=false` (Helm) and the older 4 GB minimum / 8 GB recommended figures apply instead. See [Configuration Reference](/self-hosted/configuration) for the full set of `devopsAgent`/`embedded-llm` variables.

Disk usage is dominated by the VictoriaMetrics time-series store. Estimate approximately 1 GB per 10,000 container-metrics-days (one container running for one day with default 15-second collection = ~5,760 rows). The embedded AI log-diagnosis model adds one more one-time download: a ~2.5 GB GGUF file cached in its own volume after the first start.

Software

KubeWatch self-hosted deploys either onto a single server with Docker Compose, or onto an existing Kubernetes cluster with the Helm chart, whichever matches how your organization already runs infrastructure. The rest of this page (hardware sizing, ports, database) applies to both. Only the tooling below differs.

Docker Compose (see Install with Docker Compose):

Software	Minimum version	Notes
Docker	24.0	Required for Docker Compose deployment
Docker Compose	v2.20	`docker compose` (V2), not `docker-compose` (V1)
curl	Any recent	Used by the install script
bash	4.0+	Used by the install script

Verify Docker and Compose versions

docker --version
# Docker version 27.3.1, build ...

docker compose version
# Docker Compose version v2.29.1

If docker compose version fails (not found), you have Docker Compose V1 (docker-compose). Upgrade to Docker Compose V2 before proceeding.

Kubernetes (Helm) (see Install on Kubernetes (Helm)):

Software	Minimum version	Notes
Kubernetes	1.26	Any conformant distribution (EKS, GKE, AKS, kubeadm, k3s, ...)
Helm	3.10+	Used to install and upgrade the chart
StorageClass	N/A	A default `StorageClass` for PostgreSQL/metrics persistent volumes
Ingress controller	N/A	e.g. ingress-nginx or Traefik, for external access

Operating system

Tested and supported:

Ubuntu 22.04 LTS and 24.04 LTS
Debian 12 (Bookworm)
RHEL 9 / CentOS Stream 9 / AlmaLinux 9
Amazon Linux 2023

Other Linux distributions may work but are not officially supported.

Windows and macOS are supported for local development/testing only, not for production deployments.

Network requirements

Inbound ports

Port	Protocol	Required for
80	TCP	HTTP (redirected to 443 if TLS enabled)
443	TCP	HTTPS dashboard and API

If you change the default ports during installation, adjust your firewall rules accordingly.

Outbound access

During installation and upgrades, the server needs outbound access to:

Destination	Port	Purpose
`ghcr.io`	443	Pull Docker images from GitHub Container Registry
`raw.githubusercontent.com`	443	Download the release files (install script)
`huggingface.co`	443	One-time download of the embedded AI log-diagnosis model on first start (only if `EMBEDDED_LLM_ENABLED`/`devopsAgent.embeddedLlm.enabled` is left on, the default); cached afterward, so this isn't needed again unless the model volume is cleared

After initial installation, outbound internet access is not required unless you need to pull updated images during an upgrade, the embedded AI log-diagnosis model needs to (re-)download, or you've opted into either of the two live-pricing features below (both off by default).

Cloud service (optional)

Only if you set cloud.pricing.awsAccessKeyId/awsSecretAccessKey or cloud.pricing.gcpApiKey in your Helm values (see Cloud Costs); leaving these unset keeps the Infrastructure Estimates tab on its static pricing table with no outbound calls beyond what cloud account billing/inventory sync already needs:

Destination	Port	Purpose
`api.pricing.us-east-1.amazonaws.com`	443	Live AWS instance pricing (only if an AWS pricing credential is set)
`prices.azure.com`	443	Live Azure instance pricing (always reachable if enabled, needs no credential)
`cloudbilling.googleapis.com`	443	Live GCP regional pricing (only if a GCP pricing API key is set)

Agent hosts

Agents need outbound access to your self-hosted gateway:

Destination	Port	Purpose
Your gateway domain	443	Agent registration and metric pushes
`api.pricing.us-east-1.amazonaws.com`	443	Live AWS node pricing (only if `livePricing.enabled: true` on an AWS node)
`prices.azure.com`	443	Live Azure node pricing (only if `livePricing.enabled: true` on an Azure node)
`cloudbilling.googleapis.com`	443	Live GCP node pricing (only if `livePricing.enabled: true` and `livePricing.gcpApiKey` is set on a GCP node)

These rows only apply if you've explicitly turned on the agent's optional live pricing (see Cloud Costs); leave it off and the agent makes no calls beyond your own gateway, same as before this feature existed.

Database

KubeWatch bundles PostgreSQL, VictoriaMetrics, and NATS in its Docker Compose stack, you don't need to install or manage them separately.

If you prefer to use an external PostgreSQL instance:

PostgreSQL 15 or 16
A dedicated database and user for KubeWatch

External database configuration is documented in Configuration Reference.