Runewrd Labs
ConsoleGet early access
MenuClose

Deployment

Hosted by us, or run it yourself.

Startup runs on Runeward Labs hosting. Enterprise can also self-host, with an air-gapped option. Every option uses the same product, evidence model and policies.

Deployment options

Self-hosting is part of Enterprise and isn’t included with Startup. Air-gapped deployment is an Enterprise add-on.

Compare plans

Hosted by Runewrd Labs

Guard Cloud and the Console, run for you. Included with Startup and Enterprise.

  • Explicit enrollment and privacy tier
  • Metadata-only by default
  • Regional residency options under evaluation

Self-hosted

Run Guard Cloud and the Console on your own infrastructure. Enterprise only.

  • Guard Cloud backend with PostgreSQL
  • Compose on one host, or Kubernetes with the Guard Helm chart
  • Linux packages and a Kubernetes DaemonSet for endpoints
  • Console served from the same origin as the API

Air-gapped

Self-hosted Guard on a network with no outside connection. An Enterprise add-on.

  • Release images packed into one bundle with checksums
  • Compose and Kubernetes installs load the bundle offline
  • Policy signed on an administrator’s own machine or hardware key
  • Upgrades load a new bundle

Self-hosted bootstrap

Gurd Cloud on one host.

A single-host compose file with PostgreSQL, Guard Cloud and Caddy.

For Kubernetes, install the Guard Helm chart from a source checkout. It requires external PostgreSQL and an existing application Secret; follow the chart guide for required values and TLS.

Compose

cloud/deploy/compose.yaml runs PostgreSQL, Guard Cloud and Caddy on one host. Guard Cloud applies migrations on start and listens only on the compose network.

TLS

Caddy obtains and renews a certificate for GUARD_DOMAIN and overwrites the forwarded-protocol header. Guard refuses a non-loopback listener without TLS or --behind-tls-proxy.

Secrets

POSTGRES_PASSWORD is required. The first admin key is printed once; keys and enrollment tokens are stored as digests. Keep catalog.key off the server.

Backup and restore

Back up PostgreSQL with pg_dump -Fc and restore with pg_restore --single-transaction, then run guard-cloud migrate. Tested on a single instance; disaster recovery across several instances isn’t tested.

Upgrade

Upgrade Guard Cloud before its devices: an older server refuses uploads with newer fields. Migrations are additive and refuse checksum collisions.

Console

Off by default. Set GUARD_CONSOLE_ORIGIN to one exact HTTPS origin and serve the Console from runeward-fe behind the same proxy.

# cloud/deploy/.env: GUARD_DOMAIN and a strong POSTGRES_PASSWORD
docker compose -f cloud/deploy/compose.yaml up -d
docker compose -f cloud/deploy/compose.yaml exec guard-cloud \
  guard-cloud bootstrap --organization "Acme"

Before you roll out

Permissions, by OS.

What each endpoint sensor needs before it can collect. Harness hooks need none of this: they install per user.

macOS

  • MDM profile allowing the system extension and granting Full Disk Access
  • User-approved or automated MDM enrollment, or manual approval in System Settings
  • Network flows need a separate content-filter profile
  • On macOS 13+, the sensor can read Apple’s eslogger output

Linux

  • Sensor runs as root; no kernel module
  • Netlink process connector (CONFIG_PROC_EVENTS) and fanotify permission events
  • eBPF flows: Linux 5.8+ with BTF, CAP_BPF and CAP_PERFMON, and tracefs
  • CAP_NET_RAW to name flows from DNS answers
  • .deb and .rpm packages, from repositories you build and host

Windows

  • ETW kernel providers: an elevated administrator or SYSTEM
  • Installed as a LocalSystem service; no driver
  • Optional process-creation auditing (event 4688) for short-lived commands
  • Package is unsigned: sign both binaries before distribution
  • Per-user hooks: each user runs guard hooks install all

Network boundary

What a self-hosted deployment talks to.

Guard’s documentation describes no call from a self-hosted deployment to a service operated by Runeward Labs. It does not yet state a formal no-egress guarantee; this is what it documents.

  • Devices sync only with the Guard Cloud server named at enrollment
  • Detection catalogs are uploaded to your server and checked against keys you pin
  • No auto-updater: guard update verify is an offline check
  • guard scan and guard assess use no network; Cloud upload is a separate step
  • Caddy contacts a certificate authority to issue your domain’s certificate

Your agents already have access. Ward off the risks.

Join Guard early access for your team, or run the free local scan today. Agents in automation too? Add the open-source Rune Box.

Get Guard early accessRun the free scan