Everything you need before you run the single-server installer, laid out as a short series of steps. Work through them in order. Each item explains why it is needed and how to check it.
Scope: This covers the single-server install driven by bootstrap.sh and setup.sh (for evaluations — POVs and POCs). Production installs on Kubernetes with the Helm chart have their own prerequisites — see the Helm installation guide.
At-a-glance checklist
OCI registry access granted, with the 3b repository
Your Tines tenant name and OCI registry API key to hand
The release version to install (e.g.
v2.0.0)Your signed 3B license token (
3bl_v1_…)A 64-bit (amd64 / x86_64) Linux server, correctly sized (step 2)
Root / sudo access on that server
Linux kernel 5.19 or newer
Unprivileged user namespaces available in the kernel
curl,openssl, andpython3installedOutbound access to
oci.tines.com(step 3) — or an air-gapped planDNS records, plus open firewall ports, for your URLs (step 4)
A TLS plan — HTTPS is effectively required (AI providers need it); terminate TLS at 3B or at a load balancer in front (step 5)
(Optional) SMTP details if 3B should send email (step 6)
Step 1 — Get registry access and your license
3B is downloaded from the Tines OCI registry (oci.tines.com).
Complete the onboarding. Follow accessing the OCI registry to get an account.
Note the values you receive:
Tines tenant name — your username for
oci.tines.com.Tines OCI registry API key — your password for
oci.tines.com. Treat it like any password; the installer enters it hidden and stores it only in the root-protected/opt/3b/.env.
Step 2 — Prepare the server
Hardware sizing
Everything runs on one machine, so size it for your workload. These are starting points; some heavier automation may need more.
Use case | vCPU | RAM | Disk (SSD) |
Light smoke test | 8 | 16 GB | 250 GB |
Recommended POC starting point | 8 | 32 GB | 500 GB |
Heavier POC | 16 | 64 GB | 500 GB – 1 TB |
Why: 3B runs roughly a dozen services plus a database and sandboxed automation runtimes on the same box; under-sizing leads to slow performance or services failing to start.
Operating system and architecture
A 64-bit Linux server on amd64 / x86_64. Arm and other CPU architectures are not currently supported. Recent mainstream distributions all work: Ubuntu 22.04+, Debian 12, Amazon Linux 2023, Oracle Linux 8/9, RHEL 8/9, and similar.
uname -m # must print x86_64 (or amd64); aarch64 is not supported
Why: The 3B container images and the sandbox runtime are built for amd64 Linux only.
Use a clean, dedicated server. The installer sets up k3s and expects to own the machine. Do not install it on a host that already runs another Kubernetes, or that you use for other workloads.
Root access
You must run the installer as root, normally by adding sudo in front of the command.
sudo -v # confirms you have sudo rights
Why: The installer installs system packages, adjusts kernel settings, creates system directories, and starts services — all of which require administrative privileges. It refuses to run as a normal user.
Kernel 5.19 or newer
uname -r # read the first two numbers: 6.5.x is fine; 5.15.x is too old
Why: 3B runs untrusted automation code inside secure sandboxes (gVisor) that rely on modern kernel features. The installer refuses to run below kernel 5.12 (k3s needs idmapped mounts); on kernels between 5.12 and 5.19 it automatically configures a slower containerd fallback, so 5.19+ is what we recommend.
Too old? Update to a newer kernel package, or use a newer OS image, then re-check. On long-term-support distributions this often means installing a newer “hardware enablement” kernel.
Unprivileged user namespaces
The kernel must allow unprivileged user namespaces, which the sandboxes use to isolate automation execution. Most distributions enable this by default, and the installer automatically writes the common kernel settings (in /etc/sysctl.d/99-3b-userns.conf) where your kernel exposes them — including the AppArmor restriction Ubuntu ships.
cat /proc/sys/kernel/unprivileged_userns_clone 2>/dev/null # 1 = enabled; absent = fine
You usually need to do nothing here. On a hardened or locked-down host, confirm with your platform team that user namespaces are not disabled by policy.
Command-line tools
Tool | Used by | Notes |
| both scripts | Installer can install it if missing. |
|
| Installer can install it if missing. |
|
| Installer can install it if missing. |
|
| Pulls the bundle from the OCI registry. Installer downloads it to |
|
| Generates secrets and certificates. Install yourself if missing. |
|
| Used during key generation. Install yourself if missing. |
for t in curl tar unzip oras openssl python3; do command -v "$t" >/dev/null && echo "ok: $t" || echo "MISSING: $t" done
If any are missing, install them with your package manager:
Debian / Ubuntu:
sudo apt-get update && sudo apt-get install -y curl tar unzip openssl python3Fedora / RHEL / Oracle (dnf):
sudo dnf install -y curl tar unzip openssl python3Older RHEL / CentOS (yum):
sudo yum install -y curl tar unzip openssl python3
Step 3 — Confirm connectivity
Standard install
The server needs outbound HTTPS to:
oci.tines.com— the bundle and images live here, and it is the only source of the software (see step 1). Required for the first install and every update.github.com— to fetch the smallorasdownload tool.
Behind an outbound proxy? 3B can use it — you will set HTTP_PROXY, HTTPS_PROXY, and NO_PROXY during install. Make sure the proxy permits the hosts above.
Air-gapped install (server has no internet)
If the target server cannot reach the internet at all, it needs none of the above. Instead:
Run the bootstrap on a separate, connected machine and choose the air-gapped option, which downloads a single self-contained bundle.
Copy that bundle to the offline server and install from it.
The connected machine needs the same oci.tines.com access; the offline server needs none. Full steps are in the air-gapped installation guide.
Step 4 — Plan your URLs, DNS, and ports
3B is configured with four URLs (UI, API, public, and Zero sync — see connectivity requirements for what each does). On a new install the UI, API, and Zero sync URLs share one hostname by default, and the public URL gets its own — so you plan two hostnames under one root domain:
URL | Setting | Default from root domain |
UI |
|
|
API |
|
|
Zero sync |
|
|
Public |
|
|
DNS records (required)
Point each hostname at the server’s IP with a DNS A (or AAAA) record:
3b.example.com → <server IP> 3b-public.example.com → <server IP>
Why DNS is required: The built-in web front end serves everything on ports 80/443 and routes each request by hostname, so each hostname must resolve. An IP-only setup cannot tell the services apart. (Kubernetes also exposes the same front end on NodePorts 30080 / 30443 if you front it with a load balancer.)
Firewall ports
Setup | Inbound ports to open |
HTTPS hostnames | 80, 443 |
HTTP hostnames (evaluation only) | 80 |
The install binds these directly on the host (nginx uses host ports 80 and 443).
Step 5 — Plan TLS / HTTPS
If you use https:// URLs (recommended), decide how encryption is handled. You will pick one of these during install:
An upstream load balancer or proxy terminates TLS — something in front of the server already does HTTPS and forwards plain HTTP. You provide no certificate.
A certificate already on the server — you have a full-chain certificate (PEM) and private key on the box. It must cover every hostname you configured.
A self-signed certificate generated during install — fine for a quick POC; browsers warn until it is trusted.
HTTPS is effectively required, not just recommended. 3B expects requests to reach it over HTTPS, with TLS terminated somewhere in the request path — at 3B itself, or at a load balancer or proxy in front of it. This matters most for AI providers: configuring and using them depends on requests arriving over a secure (HTTPS) connection, so on a plain-HTTP install that step will not work.
Decide now: For option 2 you need the certificate and key files staged on the server before (or during) the install. Whichever option you choose, make sure something terminates TLS so 3B is reached over https://. See TLS termination for details.
Step 6 (optional) — Email (SMTP)
If you want 3B to send email (for example, user invitations), have ready:
An SMTP connection string (
SMTP_URL).A “from” address (
EMAIL_FROM_ADDRESS).
These are optional and can be added later by editing /opt/3b/.env and re-running setup.sh.
You’re ready
When every box in the checklist is ticked, continue to the installation guide and run the installer.