Skip to content
Metergraph

Metergraph v0.2.27 for your own machine

The performance dashboard, anomaly detection alerts and optimization analysis, running under Docker Compose. Nothing about a call is sent to Metergraph. What each option gives you.

  1. Download

    Section titled “Download”

    No account or credential is needed for any of this.

    Download the bundle and the signed manifest
    curl -fsSLO https://www.metergraph.dev/releases/v0.2.27/metergraph-customer-local-v0.2.27.tar.gz
    curl -fsSLO https://www.metergraph.dev/releases/v0.2.27/metergraph-byoc-release.json
    curl -fsSLO https://www.metergraph.dev/releases/v0.2.27/metergraph-byoc-release.json.sig
    curl -fsSLO https://www.metergraph.dev/releases/v0.2.27/metergraph-byoc-release.json.pem

  2. Check it before you run it

    Section titled “Check it before you run it”

    The manifest is signed by the workflow that built this release. Install cosign first.

    Verify the manifest signature
    cosign verify-blob \
      --certificate metergraph-byoc-release.json.pem \
      --signature metergraph-byoc-release.json.sig \
      --certificate-oidc-issuer https://token.actions.githubusercontent.com \
      --certificate-identity-regexp '^https://github\.com/PioneerSquareLabs/metergraph-internal/\.github/workflows/byoc-release\.yml@refs/(heads/main|tags/v.+)$' \
      metergraph-byoc-release.json

    The manifest records the bundle’s own checksum, so verifying the manifest also authenticates the archive. Read the expected value from the manifest rather than from a web page, so the two cannot disagree.

    Check the bundle against the verified manifest
    python3 - <<'EOF'
    import hashlib, json, sys
    manifest = json.load(open("metergraph-byoc-release.json"))
    name = manifest["local_bundle"]
    actual = hashlib.sha256(open(name, "rb").read()).hexdigest()
    if actual != manifest["local_bundle_sha256"]:
        sys.exit(f"{name} does not match the signed manifest. Do not run it.")
    print(f"{name} matches the signed manifest.")
    EOF

  3. Extract

    Section titled “Extract”
    Extract
    tar xzf metergraph-customer-local-v0.2.27.tar.gz
    mv metergraph-byoc-release.json* local/
    cd local

  4. Sign in to the image registry

    Section titled “Sign in to the image registry”

    Both values come with your invitation. No GitHub account of your own is involved, and this credential only pulls the images.

    Registry login
    export METERGRAPH_PULL_USER=...
    export METERGRAPH_PULL_TOKEN=...
    echo "$METERGRAPH_PULL_TOKEN" | docker login ghcr.io \
      -u "$METERGRAPH_PULL_USER" --password-stdin

  5. Set your passwords

    Section titled “Set your passwords”
    Settings file
    cp .env.example .env

    Set the admin and database passwords in .env.

  6. Start

    Section titled “Start”
    Start the stack
    ./bin/start

    This verifies the manifest signature and both image digests with cosign before anything runs, then pulls exactly those digests and prints them. You can check them against the manifest, which is why it is published here rather than handed over with the images.

    Sign in at http://localhost:8080. Then ./bin/demo-ingest lays down a sample dataset without calling any model, and ./bin/status reports health.

Running an analysis

Section titled “Running an analysis”

Everything above runs without a model provider key. The analysis is the one part that makes model calls of its own, with your key, and you choose where they go. In .env, set METERGRAPH_ANALYSIS_CONTROL_CHANNEL and the matching key. No gateway account is required, and those calls cost what your provider charges for them.

Channel Key to set in .env
vercel-ai-gateway AI_GATEWAY_API_KEY
anthropic-api ANTHROPIC_API_KEY
openai-api OPENAI_API_KEY

Full documentation