Skip to main content

Production Deployment

This guide provides a production readiness checklist for deploying AgentVisor™. Use it to ensure you've addressed all critical areas before going live. Each item links to the guide that owns the detailed how-to — this page focuses on what to verify, not how to configure it.

Production Readiness Checklist​

Before deploying to production, verify each area:

AreaStatusGuide
Security hardening☐Security Checklist
Temporal configured☐Temporal Guide
Scaling configured☐Scaling and Resilience
Authentication enabled☐OIDC Setup
Policies defined☐Policy Configuration
Guest images deployable☐Guest Images
Monitoring set up☐Monitoring
Backup plan in place☐Backup and Recovery

Security Checklist​

Before deploying to production:

  • Configure sandbox mode (gVisor recommended for Linux; Docker is production-grade on any platform)
  • Configure restrictive policies (deny-by-default)
  • Enable OIDC authentication
  • Set up TLS for the API
  • Configure resource limits (guest.memory_limit/cpu_limit/pids_limit: enforced in docker mode, and in gvisor mode when the host runtime runs as root with a writable cgroup v2 mount; otherwise set limits on the host runtime's container or pod, or set guest.hardening.resource_limits: enabled to fail startup without them)
  • Enable audit logging
  • Review SSRF allowlist exemptions (proxy.ssrf_allowed_cidrs — see Egress Controls)
  • Review network policies

See the Security Guide for the full hardening reference (sandbox mode selection, resource limits and timeouts, authentication, default-deny policy examples, and the SSRF guard's allowlist model) and its own more detailed security checklist.

Temporal Configuration​

Configure Temporal for production use. This is critical for durability and reliability.

Key areas to configure:

  • Temporal Cloud or self-hosted cluster connection
  • Namespace and task queue strategy
  • Search attributes setup
  • Payload encryption (recommended)
  • History management

See Temporal Configuration for complete setup instructions.

Scaling and High Availability​

For production deployments, configure:

  • Multiple replicas (minimum 3 recommended)
  • Availability zone spread
  • PodDisruptionBudget
  • Auto-scaling (HPA)

See Scaling and Resilience for deployment manifests and configuration.

Guest Images and Registry Deployment​

Guest images can be built and pushed as standalone OCI artifacts, separate from the combined host+guest image, so a CI/CD pipeline can build and version them independently and pull a pre-built guest image at runtime instead of a local rootfs.

Kubernetes Deployment​

  • Network policies restrict egress to Temporal and allowed external APIs only
  • Secrets (API keys, OIDC client secrets) stored in Kubernetes Secrets, never embedded in images

See Kubernetes Deployment for manifests covering network policy, secrets, HorizontalPodAutoscaler, and PodDisruptionBudget.

Monitoring​

  • Liveness and readiness probes configured
  • Prometheus metrics enabled (AGENTVISOR_TELEMETRY_METRICS_ENABLED=true) and scraped — served on the same shared HTTP API listener as /health and /ready, no separate metrics address
  • Structured JSON logging enabled (AGENTVISOR_LOG_FORMAT=json)

See Scaling and Resilience: Monitoring for Scale for the full metrics/alerting reference, and Docker Deployment or Kubernetes Deployment for health check and ServiceMonitor examples.

Backup and Recovery​

Temporal State​

Temporal stores all workflow state. Back up:

  • Temporal database (PostgreSQL/MySQL/Cassandra)
  • Elasticsearch (for visibility features)

For Temporal Cloud, backups are managed automatically.

Configuration​

Version control all configuration:

  • Policy domain files
  • Kubernetes manifests
  • Environment variable templates (without secrets)

Encryption Keys​

If using payload encryption:

  • Store codec passwords in a secrets manager
  • Document key rotation procedures
  • Warning: Lost encryption keys = lost data

See Temporal Configuration: Payload Encryption for encryption setup.

Incident Response​

Disable a Problematic Agent​

Cancel all threads for a specific agent:

# Cancel all threads for an agent
for thread in $(curl -s http://localhost:8090/threads/search \
  -d '{"metadata": {"agent": "problematic-agent"}}' | jq -r '.[].thread_id'); do
  curl -X DELETE "http://localhost:8090/threads/$thread"
done

Emergency Policy Update​

Apply a restrictive policy immediately:

# Apply restrictive policy
kubectl create configmap emergency-policy --from-file=domain.yml=emergency.yml
kubectl rollout restart deployment/agentvisor

Audit Investigation​

Query audit logs for policy decisions:

# Search recent logs for policy decisions
kubectl logs -l app=agentvisor --since=1h | grep "policy_decision"

Next Steps​

Once your production deployment is configured:

  1. Run a load test to validate scaling configuration
  2. Set up alerts for key metrics (see Scaling and Resilience)
  3. Document runbooks for common incident scenarios
  4. Schedule regular policy reviews to audit access controls

See Also​