Metergraph v0.2.137 for your own machine

This guide walks you through deploying Metergraph locally or on a virtual machine using Docker Compose. It is the simplest way to try Metergraph on infrastructure you control.

If you would rather not run any infrastructure, sign up for hosted Metergraph.

With a local deployment, no information is sent to Metergraph.

Before you start

You need Docker with Compose and cosign, which checks the release before anything runs. On Windows, run the bundle inside WSL with Docker Desktop’s WSL integration enabled.

1. Download

   No account or credential is needed for any of this.

   Download the bundle and the signed manifest

   curl -fsSLO https://www.metergraph.dev/releases/v0.2.137/metergraph-customer-local-v0.2.137.tar.gz
   curl -fsSLO https://www.metergraph.dev/releases/v0.2.137/metergraph-byoc-release.json
   curl -fsSLO https://www.metergraph.dev/releases/v0.2.137/metergraph-byoc-release.json.sig
   curl -fsSLO https://www.metergraph.dev/releases/v0.2.137/metergraph-byoc-release.json.pem

2. Check it before you run it

   The manifest is signed by the workflow that built this release. Install cosign first.

   Verify the manifest signature

   cosign verify-blob \
     --certificate metergraph-byoc-release.json.pem \
     --signature metergraph-byoc-release.json.sig \
     --certificate-oidc-issuer https://token.actions.githubusercontent.com \
     --certificate-identity-regexp '^https://github\.com/PioneerSquareLabs/metergraph-internal/\.github/workflows/byoc-release\.yml@refs/(heads/main|tags/v.+)$' \
     metergraph-byoc-release.json

   The verified manifest includes the bundle checksum. Use it to confirm that the archive has not changed.

   Check the bundle against the verified manifest

   python3 - <<'EOF'
   import hashlib, json, sys
   manifest = json.load(open("metergraph-byoc-release.json"))
   name = manifest["local_bundle"]
   actual = hashlib.sha256(open(name, "rb").read()).hexdigest()
   if actual != manifest["local_bundle_sha256"]:
       sys.exit(f"{name} does not match the signed manifest. Do not run it.")
   print(f"{name} matches the signed manifest.")
   EOF

3. Extract

   Extract

   tar xzf metergraph-customer-local-v0.2.137.tar.gz
   mv metergraph-byoc-release.json* local/
   cd local

4. Sign in to the image registry

   Your invitation includes METERGRAPH_PULL_USER and METERGRAPH_PULL_TOKEN. Use them to sign in to the image registry.

   Registry login

   export METERGRAPH_PULL_USER=...
   export METERGRAPH_PULL_TOKEN=...
   echo "$METERGRAPH_PULL_TOKEN" | docker login ghcr.io \
     -u "$METERGRAPH_PULL_USER" --password-stdin

5. Set your passwords and provider credentials

   Settings file

   cp .env.example .env

   Set the admin and database passwords in .env.

   To run an analysis, add credentials for every provider you want Metergraph’s analysis to use. At least one of these control channels is required:

   Channel	Key to set in .env
   vercel-ai-gateway	AI_GATEWAY_API_KEY
   anthropic-api	ANTHROPIC_API_KEY
   openai-api	OPENAI_API_KEY

   Set METERGRAPH_ANALYSIS_CONTROL_CHANNEL to the channel you want to use. Fireworks and Google can extend an analysis, but neither can run it by itself:

   Provider	Key to set in .env	What it adds
   Fireworks	FIREWORKS_API_KEY	Fireworks models as comparison candidates
   Google	GOOGLE_API_KEY	Search-enabled workloads, but no comparison candidates

   Analysis uses your keys, and those calls cost what your providers charge.

6. Start

   Start the stack

   ./bin/start

   This verifies the manifest signature and both image digests with cosign before anything runs, then pulls exactly those digests and prints them. You can check them against the manifest, which is why it is published here rather than handed over with the images.

   Sign in at http://localhost:8080. Then ./bin/demo-ingest lays down a sample dataset without calling any model, and ./bin/status reports health.

Full documentation