Self-host on macOS or Linux

Requirements

• macOS or Linux with hardware virtualization enabled
• Lima 1.x or 2.x ↗ installed and available as limactl. On macOS, run brew install lima.
• Python 3.11 or newer
• At least 2 CPUs, 2 GiB RAM, and 48 GiB disk available to Lima

Deploy the host

git clone https://github.com/infiloop2/kern.git
cd kern
python3 -m host.cli.generate_password
ssh-keygen -t ed25519

python3 -m host.cli.deploy \
  --provider lima \
  --agent-name my-kern \
  --admin-password-sha256 <sha256-from-generate-password> \
  --operator-ssh-public-key "$(cat ~/.ssh/id_ed25519.pub)"

Open Kern over SSH

ssh -p <ssh-port> -N -L 7443:127.0.0.1:7443 [email protected]

Keep the tunnel running, open http://127.0.0.1:7443 ↗, and sign in with the admin password you saved.

Optional: add remote browser access

When you want a stable HTTPS address that works from any browser, follow Set up remote access to add a Cloudflare Tunnel.

From deployment to a useful first run

1. 1
   Deploy on your computer

   Create the Lima host, open the SSH tunnel, then sign in to Kern on localhost.

2. 2
   Connect an agent

   Open Home → Integrations and connect the runtime you use.

3. 3
   Enable only the access you need

   Connect tools and network integrations for the task. Kern denies everything else.

4. 4
   Give the agent a real outcome

   Start a Chat with a bounded task, such as researching a question or improving a repository.

5. 5
   Inspect the boundary

   Review Network audit and Tool audit to see what was allowed, denied, or held for approval.