> ## Documentation Index
> Fetch the complete documentation index at: https://usenaive.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Quickstart — region on Docker Compose

> Run a full Naive region on any Linux box in ~10 minutes with file-backed secrets (no TPM), then prove it with scripts/demo.sh.

The fastest way to run Naive on your own hardware. This brings up the whole
region — the open plumbing **and** the closed engine — on one box with Docker
Compose, using the `secrets-file` driver (no TPM required). It ends by running
`scripts/demo.sh`, the same green/red proof both other tutorials finish with.

<Note>
  This is the developer/CI topology. The production artifact is the **Tower golden
  image** (see [Local VM](/docs/self-hosting/tutorial-local-vm) and
  [AWS](/docs/self-hosting/tutorial-deploy-aws)), where the vault root is sealed to a
  real TPM and the agent runtime is sandboxed with gVisor (`runsc`).
</Note>

## Prerequisites

* Linux (or macOS with Docker Desktop — note the [runc fallback](/docs/self-hosting/security-model#gvisor-and-the-runc-fallback)).
* Docker Engine + Compose v2, Node 20+, pnpm 9.
* The repo cloned. The closed engine images (`region`, `vaultd`) build from
  `image/Dockerfile.region` and `engine/vaultd/Dockerfile`.

## 1. Build the images

```sh theme={"theme":"css-variables"}
cd image && ./build-tarballs.sh   # builds naive-region/region:dev + vaultd
```

## 2. Bring up the stack

The compose file wires the [load-bearing topology](/docs/self-hosting/security-model):
`frontnet` (egress-capable) + `agentnet`/`datanet` (`internal: true`) + `vaultd`
on no network. The agent runtime's only reachable peer is the egress gateway.

```sh theme={"theme":"css-variables"}
docker compose -f image/compose.yaml up -d
docker compose -f image/compose.yaml run --rm migrate
```

Drivers on this box: `secrets-file`, `queue-pg`, `storage-fs` (see
[Drivers](/docs/self-hosting/drivers)). The closed **governor** decides every gated
action; without it the region is inert (403 `enforcement_unavailable`).

## 3. Prove it end-to-end

```sh theme={"theme":"css-variables"}
scripts/demo.sh
```

This registers a company, provisions a sandbox operator, sends an email to the
on-box catch-all, watches an over-cap purchase **freeze**, approves it, replays
it **synthetically**, promotes to production, and finishes with the **topology
proof** (direct egress fails; the gateway terminating path works; a
non-allowlisted CONNECT is refused; stopping the governor makes gated actions
return 403). Green means your region is real.

## Teardown

```sh theme={"theme":"css-variables"}
docker compose -f image/compose.yaml down -v
```