Install¶

Joch supports four install paths. Pick the one that matches where you want to run agents — same joch apply -f . works against all four.

Local (developer mode)¶

Single process, SQLite store, local files, no Kubernetes.

brew install joch                       # macOS / Homebrew
# or
curl -sSL https://joch.dev/install.sh | bash

Start the local control plane and apply a sample agent:

joch up
joch apply -f https://raw.githubusercontent.com/peasantsai/joch-examples/main/quickstart/support-triage.yaml
joch run support-triage "Triage incoming queue"

Docker Compose¶

For team dev environments, CI smoke tests, and small self-hosted deployments.

joch init docker-compose
docker compose up -d
joch context use docker
joch apply -f .

Stack: joch-server, joch-worker, joch-gateway, joch-router, joch-memory, joch-trace, Postgres (with pgvector), Redis (event bus), MinIO (artifacts), OpenTelemetry collector.

Kubernetes¶

For production. Native CRDs, Helm chart, controllers, NetworkPolicies, ServiceMonitor, autoscaling.

helm repo add joch https://charts.joch.dev
helm install joch joch/joch -n joch-system --create-namespace
joch context use kubernetes
joch apply -f .

Joch Cloud (managed control plane)¶

Hosted multi-tenant SaaS plus customer-runtime tunnel. Free Starter tier, paid Team / Enterprise tiers.

joch cloud login
joch runtime install kubernetes --name prod-eu
joch apply -f . --context cloud

See Revenue Models for tier details.

Verify the install¶

joch doctor

The doctor checks:

API server reachable,
model credentials configured,
registered MCP servers reachable and healthy,
worker registered and ready,
trace endpoint reachable,
AgBOM service ready.

Configure model providers¶

Joch resolves provider credentials at the gateway boundary. Set one of:

# OpenAI
export OPENAI_API_KEY=sk-...

# Anthropic
export ANTHROPIC_API_KEY=sk-ant-...

# Google
export GOOGLE_APPLICATION_CREDENTIALS=/path/to/key.json
export GOOGLE_CLOUD_PROJECT=...

# Microsoft Foundry
az login
export AZURE_FOUNDRY_PROJECT_ENDPOINT=https://...

Or apply Secret records pointing at Vault, Kubernetes secrets, or AWS / GCP / Azure secret managers. Joch never stores secret values.