Metergraph v0.2.19, for your own machine

The performance dashboard, anomaly detection alerts and optimization analysis, running under Docker Compose. Nothing about a call is sent to Metergraph. What each option gives you.

Before you start

You need Docker with Compose, and cosign, which checks the release before anything runs. On Windows, run the bundle inside WSL with Docker Desktop's WSL integration enabled.

1. Download

No account or credential is needed for any of this.

curl -fsSLO https://www.metergraph.dev/releases/v0.2.19/metergraph-customer-local-v0.2.19.tar.gz
curl -fsSLO https://www.metergraph.dev/releases/v0.2.19/metergraph-byoc-release.json
curl -fsSLO https://www.metergraph.dev/releases/v0.2.19/metergraph-byoc-release.json.sig
curl -fsSLO https://www.metergraph.dev/releases/v0.2.19/metergraph-byoc-release.json.pem

2. Check it before you run it

The manifest is signed by the workflow that built this release, and it records the bundle's own checksum, so this authenticates both. Install cosign first.

cosign verify-blob \
  --certificate metergraph-byoc-release.json.pem \
  --signature metergraph-byoc-release.json.sig \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp '^https://github\.com/PioneerSquareLabs/metergraph-internal/\.github/workflows/byoc-release\.yml@refs/(heads/main|tags/v.+)$' \
  metergraph-byoc-release.json

python3 - <<'EOF'
import hashlib, json, sys
manifest = json.load(open("metergraph-byoc-release.json"))
name = manifest["local_bundle"]
actual = hashlib.sha256(open(name, "rb").read()).hexdigest()
if actual != manifest["local_bundle_sha256"]:
    sys.exit(f"{name} does not match the signed manifest. Do not run it.")
print(f"{name} matches the signed manifest.")
EOF

3. Extract

tar xzf metergraph-customer-local-v0.2.19.tar.gz
mv metergraph-byoc-release.json* local/
cd local

4. Sign in to the image registry

Both values come with your invitation. No GitHub account of your own is involved, and this credential only pulls the images.

export METERGRAPH_PULL_USER=...
export METERGRAPH_PULL_TOKEN=...
echo "$METERGRAPH_PULL_TOKEN" | docker login ghcr.io \
  -u "$METERGRAPH_PULL_USER" --password-stdin

5. Set your passwords

cp .env.example .env

Set the admin and database passwords in .env.

6. Start

./bin/start

This verifies the manifest signature and both image digests with cosign before anything runs, then pulls exactly those digests and prints them. You can check them against the manifest above, which is why it is published here rather than handed over with the images.

Sign in at http://localhost:8080. Then ./bin/demo-ingest lays down a sample dataset without calling any model, and ./bin/status reports health.

Running an analysis

Everything above runs without a model provider key. The analysis is the one part that makes model calls of its own, with your key, and you choose where they go. In .env, set METERGRAPH_ANALYSIS_CONTROL_CHANNEL and the matching key. No gateway account is required, and those calls cost what your provider charges for them.

Full documentation