Skip to content
Msty SailMsty SailDocs

Requirements

Sail is one Docker image plus Postgres. There’s no Redis, no search engine, no Python, no office suite. That keeps the list short.

What you need

Section titled “What you need”
Requirement
ServerLinux, x86-64 (amd64), with Docker Engine and the Docker Compose plugin
DatabasePostgres 16 or later. The bundled Compose file runs Postgres 18 for you.
DomainA name for Sail, such as sail.example.com, with HTTPS
Sign-inAn OpenID Connect identity provider, such as Microsoft Entra ID, Okta, Google Workspace or Keycloak
ModelsMsty Nexus 0.7 or later, reachable from the server
BrowsersChrome, Edge and Firefox from the last two years, and Safari 16.4 or later

The image is built for x86-64 only for now. ARM servers, like AWS Graviton, aren’t supported yet.

Sizing

Section titled “Sizing”

Sail itself is light. An idle server uses little memory, and a chat costs Sail almost nothing: the heavy lifting happens in the model, behind Nexus.

What does take memory is showing files. Turning a big spreadsheet or a long deck into a preview can briefly take several hundred megabytes. Sail runs at most two previews at once, so the peak stays bounded.

As a starting point, give Sail and Postgres together 2 GB of memory and 2 CPU cores for a pilot, and 4 GB once the whole company uses it. These are starting points, not tested limits: watch the server in the first weeks and adjust.

Disk grows with what people upload and what assistants make. Plan on what people will store, plus room for backups.

Network

Section titled “Network”

Inbound, only what people need to reach Sail:

  • 443 (TCP, plus UDP for HTTP/3) and 80 for the bundled Caddy, which redirects to HTTPS.
  • Or nothing at all, if your own HTTPS proxy runs on the same server and forwards to 127.0.0.1:8484.

Outbound, Sail calls only two things:

  • Your identity provider, to sign people in and re-check them hourly.
  • Your Nexus, for models, web search and tools.

Sail never calls Msty, and sends no telemetry. The bundled Caddy also needs internet access to get its certificate, unless you bring your own.

If your identity provider or Nexus sits on a private network, list it in SAIL_OUTBOUND_ALLOW. Sail refuses private addresses unless you allow them, so a mistyped URL can’t reach into your internal network.

Section titled “A second domain for pages, recommended”

Assistants can make interactive pages, like dashboards. For safety, Sail runs them on a separate address, so they can never touch Sail’s cookies or data.

Use a different domain, not a subdomain, such as sail-pages.example.net next to sail.example.com. Without one, pages show as source code instead of running. See Install with Docker Compose.

If you run your own HTTPS proxy

Section titled “If you run your own HTTPS proxy”

Make sure it:

  • doesn’t buffer responses. Replies stream to the browser as they’re written.
  • allows uploads up to your limit, at most 512 MB.
  • passes X-Forwarded-For, and set SAIL_TRUSTED_PROXIES, so the audit log records real IP addresses.