Self-Hosted Deployment

The customer runs Purple8 Hyper Graph (v0.72.0) on infrastructure it owns and operates. Purple8 supplies container images (Dockerfile.commercial and Dockerfile.rhel), Helm charts, Kubernetes/OpenShift manifests, Terraform modules, and the Python SDK (pip install purple8-hyper-graph). No component depends on Purple8-operated services at runtime.

Purple8 is an approved Red Hat Technology Partner and NVIDIA Inception program member.

Self-Hosted Licensing Tiers

Purple8 offers two self-hosted tiers:

Tier	Price	Node Limit	MCP Agents	Best For
Developer (Self-Hosted Free)	$0	Up to 50K nodes	1 MCP agent	Local development, prototyping, and technical evaluation with the full local engine
Enterprise / Custom (Self-Hosted)	Custom	Tailored to customer capacity	Unlimited / Custom	Production self-hosted deployments tailored to customer capacity, cluster topology, HA, and SLA

Scope

Aspect	Responsibility
Infrastructure provisioning	Customer
Installation and upgrades	Customer, using Purple8-supplied artifacts
Operations, monitoring, on-call	Customer
Backups and disaster recovery	Customer, using built-in backup tooling
Software updates and security fixes	Purple8 publishes; customer applies
Licensing	Offline Ed25519-signed license key; no call-home required

Supported targets

Target	Artifacts	Notes
Docker Compose	docker-compose.yml, Dockerfile.commercial	Single host. Evaluation and production single-node deployments. Includes optional Prometheus, Alertmanager and Grafana services.
Red Hat OpenShift	Dockerfile.rhel (registry.access.redhat.com/ubi9/python-312:9.5), Helm chart	Certified Red Hat UBI9 image engineered for OpenShift's default restricted Security Context Constraint (arbitrary-UID, group 0, /licenses/LICENSE, non-root UID 1001).
Kubernetes	Helm chart (deployment/helm), raw manifests (deploy/kubernetes)	StatefulSet with persistent volume per pod. Raft StatefulSet variant for 3-node coordination.
Amazon Web Services	Terraform (deployment/terraform/aws), CloudFormation	See AWS Deployment Patterns for the reference topology.
Microsoft Azure	Terraform (deployment/terraform/azure)
Google Cloud	Terraform (deployment/terraform/gcp)
Bare metal / VM	Container runtime or Python wheel (pip install purple8-hyper-graph)	Systemd or supervisor managed process.

Red Hat OpenShift & UBI9 Container (Dockerfile.rhel)

For enterprise Red Hat OpenShift and RHEL environments, Purple8 ships a dedicated UBI9 container image built across all stages from registry.access.redhat.com/ubi9/python-312:9.5:

• ABI & glibc alignment: Every build stage compiles native extensions against UBI9's glibc (2.34), eliminating cross-distro ABI mismatches.
• OpenShift restricted SCC ready: Works out-of-the-box under OpenShift's default restricted Security Context Constraint where containers launch with an arbitrary random UID in group 0 (root group). All runtime directories (/data, /backups, /app/logs, /opt/venv, /app) are owned by group 0 with chmod g=u, while defaulting to non-root UID 1001 under standard Docker/Podman runtimes.
• Certification compliance: Includes /licenses/LICENSE and full Red Hat Ecosystem Catalog & OpenShift metadata labels (io.k8s.*, io.openshift.tags).

# Deploy directly on Red Hat OpenShift (restricted SCC — no securityContext overrides needed)
oc new-app purple8/graph:0.72.0-rhel

# Or run under Podman / Docker (runs as non-root UID 1001)
podman run -p 8080:8080 -v purple8-data:/data:Z purple8/graph:0.72.0-rhel

Reference architecture

                         Customer network boundary
 ┌──────────────────────────────────────────────────────────────────┐
 │                                                                  │
 │  Investigator UI ──► Ingress / LB (TLS) ──► Purple8 Graph        │
 │  (static assets)                            primary  (writer)    │
 │                                                │   WAL stream     │
 │                                             follower (SYNC/ASYNC)│
 │                                                                  │
 │  Purple8 DocIntel (stateless, N replicas) ──► Purple8 Graph API  │
 │                                                                  │
 │  Enterprise IdP (OIDC / SAML) ◄──────────── Purple8 Graph        │
 │  Key management (Vault / cloud KMS / local) ◄── Purple8 Graph    │
 │  Object storage (backups) ◄──────────────── Purple8 Graph        │
 │  Inference (Ollama / SentenceTransformers / cloud provider)      │
 │  SIEM / downstream ◄── egress webhooks, Prometheus, OTEL         │
 └──────────────────────────────────────────────────────────────────┘

Component requirements

Purple8 Hyper Graph

• One writer process per instance (WORKERS=1). Multiple worker processes against one data path are not supported for concurrent HTTP writes.
• Persistent block storage for P8G_DATA_PATH. Local NVMe, SAN LUN, or cloud block volume. Network file systems are supported unless P8G_WAL_REJECT_NFS=1 is set, though they increase BrickWAL fdatasync latency.
• Memory sized from available RAM via CortexAutoConfig (auto_config=True); the BrickCoreStorage brick seal-and-evict cycle bounds peak resident set to alpha * available_ram (default 0.75), independent of total corpus size N. See System Requirements and Hardware Sizing.
• Exposes REST API and MCP Server (125 MCP tools across 16 namespaces).
• Python 3.12 runtime included in the container image.

Purple8 DocIntel

• Stateless. Scale horizontally.
• Job store: SQLite (single replica) or Redis/Valkey (multiple replicas, required for SSE fan-out).
• Requires network access to the Purple8 Graph ingest API.

Investigator UI

• Static build. Serve from any web server, CDN, or the Purple8 Graph container's static mount.
• Configured at build time with the Purple8 Graph API base URL.

High availability

Concern	Mechanism
Writer failure	WAL replication to one or more followers (P8G_REPLICATION_ROLE, P8G_REPLICATION_MODE). A follower with P8G_FAILOVER_ENABLED=1 probes the primary /health, promotes itself after P8G_FAILOVER_UNHEALTHY_THRESHOLD consecutive failures, and repoints traffic via P8G_FAILOVER_TARGET_BACKEND (noop logs only; elbv2 swaps AWS target groups). Cooldown between failovers is enforced.
Recovery point	SYNC mode: writer blocks until P8G_REPLICATION_SYNC_REPLICAS followers acknowledge; RPO ≈ 0. ASYNC mode: writer returns after local commit; RPO bounded by replication lag.
Crash recovery	WAL is fsync'd before each mutation is applied. On restart the engine replays uncommitted entries.
Coordination	Optional Raft cluster (3 or 5 nodes) for leader election and membership.
Placement	Primary and follower on separate hosts, racks, or availability zones.
DocIntel	Stateless replicas behind the ingress.

Active-active writers are not supported. One instance has exactly one writer at any time.

Backup, restore, and storage integrity

IncrementalBackupManager writes incremental backups with a manifest and change journal to S3, Google Cloud Storage, Azure Blob Storage, or a local directory. Set P8G_BACKUP_JSONL=1 for streaming line-by-line JSONL archives and P8G_BACKUP_MAX_ARCHIVE_MB (default 2048) to cap maximum archive size during restore. Schedule backups with the built-in scheduler or an external cron, and verify online storage health non-destructively at any time via POST /admin/storage/scrub.

Air-gapped operation

• Inference: Ollama, Hugging Face or SentenceTransformers providers run inside the boundary. No external API calls.
• Licensing: offline Ed25519-signed key. No network validation.
• Container images: mirror to an internal registry.
• Key management: HashiCorp Vault or local KMS provider.

Network requirements

Flow	Protocol	Direction
UI → Purple8 Graph	HTTPS	Inbound to Graph
DocIntel → Purple8 Graph	HTTPS	Internal
Graph primary → follower	Authenticated TLS (P8G_REPLICATION_TLS=1)	Internal, port 8101 by default; plaintext is restricted to explicit loopback development
Graph → IdP	HTTPS	Outbound
Graph → KMS	HTTPS or Vault API	Outbound
Graph → object storage	HTTPS	Outbound
Graph → inference provider	HTTPS or local	Outbound or internal
Graph → SIEM / alert channels	HTTPS	Outbound

When to choose Self-Hosted

• Regulatory or contractual requirement that no third party operates the platform.
• Air-gapped or sovereign environments.
• Existing platform team with Kubernetes or VM operations capability.
• Non-AWS cloud or on-premises data centre.