Self-hosted
One product, two ways to run it.
Use our managed service or deploy Tablemere on your own infrastructure. The managed service runs in Nuremberg, Germany, operated by Tablemere SL. The self-hosted version is the same containers on your servers. The surface your agents see is identical: the API, the CLI, the MCP server and the connection recipes. The DuckDB in your agent's environment does not know which one it talks to.
01What you operate
Four containers. One state directory.
The compose file the managed service runs, plus a production override. Every hostname comes from .env; nothing in the containers calls a cloud API or needs one provider's service.
State is one directory, /data, which is also the backup set. Signup codes go out through any SMTP sender (AL_SMTP_*). Placement is whatever you set (AL_PROVIDER, AL_REGION).
| Container | Image | Role |
|---|---|---|
| weed | SeaweedFS 4.47 (Apache-2.0) | Object store, Iceberg REST catalog, IAM and STS, credential vending, table maintenance |
| control-plane | Built from the source (FastAPI, SQLite) | Tenants, connection recipes, quotas, organisations, signup |
| gateway | Caddy 2.10 | TLS on api., catalog., s3., auth. |
| rauthy (optional) | Rauthy 0.36.2 | Human identity. Or name your own OpenID Connect provider in AL_OIDC_ISSUERS (Okta, Entra, Keycloak, Authentik) and skip it |
02What you need
A host, a domain, a mail sender.
| Requirement | Detail |
|---|---|
| Linux host | Docker with Compose, and a data disk mounted at /data. Any disk works. |
| Domain | Three or four A records at your DNS: api., catalog., s3. and, with Rauthy, auth.. Certificates come from Let's Encrypt through the gateway. |
| Mail sender | Any SMTP account, for the signup codes. Without one the codes are read from the host's log. |
| Identity (optional) | Your OpenID Connect provider, or the bundled Rauthy. |
03The path, as it exists today
Four steps, and a test you can run.
1. Host. A machine with Docker and a disk at /data. deploy/host_setup.sh does it for a Hetzner Volume.
2. Configuration. deploy/render_env.sh writes the server's .env; AL_DOMAIN=lake.example.com gives the real hostnames.
3. Deploy. deploy/push.sh from a laptop over SSH: rsync, start, bootstrap, TLS health check. Or copy .env.example, edit it, and start the stack on the host itself.
4. Acceptance. scripts/test.sh phase1 against your hostnames is the suite we run against ours. Each check prints PASS or FAIL with the real response.
# 1 · host: Docker and a data disk at /data $ bash deploy/host_setup.sh # 2 · configuration: hostnames from your domain $ AL_DOMAIN=lake.example.com bash deploy/render_env.sh lake1 # 3 · deploy from a laptop over SSH ... $ bash deploy/push.sh lake1 # ... or on the host itself $ cp .env.example .env $ ./al up && ./al bootstrap # 4 · the acceptance test, against your hostnames $ bash scripts/test.sh phase1
04What is honest about it today
What would block you, and what we have not decided.
- No Helm chart, no single installer. The path is the compose file and the deploy scripts above.not yet
- The deploy scripts assume Hetzner for provisioning and for the off-host backup tier. The compose stack does not.hetzner today
- Single node. High availability is planned for the managed service first; the self-hosted shape follows.planned
- No licence file yet on the control plane and the CLI; the source is not yet published. A decision pending with the founder.pending
- Support is by email. There is no support contract and no SLA, for the managed service or for self-hosting.email
05Upgrades
The same images, the same scripts, a backup first.
A self-hosted Tablemere runs the images and compose files that tablemere.com runs. There is no separate upgrade tool: deploy/push.sh deploys or redeploys a host, and a new checkout goes the same way. No zero-downtime upgrade and no release cadence is promised.
Back up first. The daily backup (deploy/on_host_backup.sh) checks free space, stops the object store for the seconds the archive takes, and restarts it from an exit trap whatever fails in between. Measured on our host: stopped 3.1 s, catalog answering again after 4.3 s; the window grows with the volume files.
deploy/restore.sh rebuilds a host from an archive, hardens it, installs the backup and maintenance timers, and prints a checklist of what it did not do. We rehearse it on our own hosts.
| On a single host | Guaranteed by the scripts |
|---|---|
| Restarts | Every long-running container comes back after a reboot or an out-of-memory kill. |
| Privileges | The control plane and the gateway run without capabilities on a read-only root filesystem. |
| Backup | Daily. Free-space check first; archives pruned by count and size; old metadata dumps dropped. |
| Restore | Re-runnable; refuses a target whose data directory holds something else. |
| Logs | What the timers write under /data rotates weekly. |
06Managed or self-hosted?
Who operates, where, and what it costs.
| Managed | Self-hosted | |
|---|---|---|
| Who operates | Tablemere SL | You |
| Where | Hetzner, Nuremberg, Germany | Wherever you run it |
| Identity | Sign-in at auth.tablemere.eu; a code by email from the CLI | The bundled Rauthy, or your OpenID Connect provider |
| Backups | Daily, off-host, in Germany; restore rehearsed | The same scripts; the off-host target assumes Hetzner Object Storage today |
| Price | Free: 5 GB stored, no card. Paid plans not yet | Your infrastructure cost. Software licence fee: to be decided |
| Support | Email. No SLA | Email. No support contract or SLA |
Both hold Apache Iceberg tables in open formats. Your tables leave with you either way.
Next.
Or create a catalog on the managed service: 5 GB, no card.