Linux
Install 3AM on a Linux server or VM with one command. What the installer asks, how to open the console, the options worth knowing, RHEL, and Compose.
Install
On the server, as your normal user:
curl -fsSL https://get.3am.si/install | shAdd -s -- --trial to start a free trial at the same time, or -s -- --code 3AM-… if you already have a code.
The installer asks only what it can't work out:
| It asks | When |
|---|---|
| Where 3AM should run | Always. Choose 1, this machine |
| Whether to install Podman | Only if neither Podman nor Docker is installed |
| Where the models run | Only if the server has no GPU. Your own endpoint, or OpenRouter (Models) |
| How you'll open the console | On the first install. An SSH tunnel, or open to the network (below) |
| Whether to go ahead | Last. Type y |
It ends by printing the console's address, the ssh command for the tunnel if you chose one, and the admin token.
The admin token creates the first owner in the console; copy it.
Everything it set up survives a reboot: Podman's containers restart on boot, and keep running after you log out.
Prefer to look first?
curl -fsSL https://get.3am.si | sh only downloads. It leaves a 3am-<version> folder; read it, then run
./install.sh inside it. ./install.sh --help lists every option.
Open the console
The installer asks how you'll reach the console, and remembers the answer.
The default. The console listens only on the server, so nothing is exposed. On your laptop, run the command the installer printed and leave it running:
ssh -N -L 8700:127.0.0.1:8700 you@your-serverThen open http://localhost:8700.
Options worth knowing
Run the installer again with an option to change it. Everything else is kept.
| Option | What it does |
|---|---|
--bind 0.0.0.0, --port 8700 | Where the console listens. The default is 127.0.0.1:8700 |
--console-url URL | The address people use, for links in on-call messages |
--openrouter-key-file FILE | Models through OpenRouter, with the key in this file |
--model-url URL --model NAME | Models on your own OpenAI-compatible endpoint. Add --model-key-file if it needs a key |
--s1-url URL | System 1's endpoint, needed with your own model endpoint |
--resend-key-file FILE | Send sign-in codes by email through Resend. --smtp-host uses any SMTP server instead |
--runtime docker | Use Docker when both are installed. Podman is the default |
--yes | Ask nothing: use the defaults and what's remembered |
--forget | Ignore what was remembered from the last install |
--doctor | Check the running install, piece by piece |
Keep keys in files that only you can read. The installer copies them to ~/.3am/keys/, so you can delete the
originals:
umask 077; printf '%s' 'sk-or-…' > ~/openrouter.keyRed Hat Enterprise Linux
RHEL 8 and 9 work with SELinux enforcing and in FIPS mode. Install Podman from the RHEL AppStream, then:
sudo ./install.shRun as root, the installer also ties the licence to the machine's hardware. On FIPS hosts, ask us for the UBI image, which uses RHEL's FIPS-validated OpenSSL.
To run without containers, each release has a native install with a hardened systemd unit:
sudo deploy/rhel/install-native.sh --licence licence.json
sudo deploy/rhel/rhel-verify.sh # checks the resultDocker Compose
Each release has compose/compose.yaml, with the same containers and hardening as the installer:
cd 3am-<version>
for f in images/*.tar; do docker load -i "$f"; done
cd compose && cp .env.example .env # fill in the model endpoint and a random THREEAM_INGEST_TOKEN
docker compose up -d core
docker compose logs core | grep "admin token"With a GPU, add -f compose.gpu.yaml. You manage upgrades yourself with Compose, so the installer is usually easier.
If something goes wrong
That question needs a y. Pressing Enter stops it without changing anything. Run it again; it remembers your answers.
Something else is on that port. Choose another: ./install.sh --port 8710.
With the tunnel, check that the ssh command is still running. With the port open, the cloud's firewall is usually
what's in the way: the installer printed the rule to add. Then run ./install.sh --doctor on the server.
That's expected on most servers. Choose your own endpoint or OpenRouter. If you meant to use a GPU, check that the NVIDIA Container Toolkit (or AMD ROCm) is installed, so containers can see it.
podman logs 3am-core, or docker logs 3am-core. The console's Doctor page shows the same checks as
./install.sh --doctor.
Next
Open the console, create the first owner, and follow the setup wizard.