Docker

Package the Blaise CLI agent as a Docker image for self-hosted or cloud deployments.

Running blaise-agent inside Docker makes it easy to deploy on any cloud provider, keep the agent isolated from the host, and manage secrets via environment variables.

How it works

Dockerfile

FROM node:22-slim

# Install Claude Code globally
RUN npm install -g @anthropic-ai/claude-code

# Install the Blaise agent
RUN npm install -g @blaise/agent

# Non-root user for security
RUN useradd -m agent
USER agent
WORKDIR /home/agent

EXPOSE 3001

CMD ["blaise-agent", "listen", \
     "--command", "blaise-agent start claude", \
     "--port", "3001"]

Build it:

docker build -t blaise-agent:latest .

Running the container

Pass secrets as environment variables — never bake them into the image.

docker run -d \
  --name blaise-agent \
  -p 3001:3001 \
  -e BLAISE_WEBHOOK_SECRET="your-secret-here" \
  -e LOG_FORMAT=json \
  blaise-agent:latest

docker-compose example

For a typical production setup with automatic restarts and a named secret:

services:
  blaise-agent:
    image: blaise-agent:latest
    build: .
    restart: unless-stopped
    ports:
      - "3001:3001"
    environment:
      BLAISE_WEBHOOK_SECRET: "${BLAISE_WEBHOOK_SECRET}"
      LOG_FORMAT: json
      LOG_LEVEL: info

Run with:

BLAISE_WEBHOOK_SECRET=your-secret docker compose up -d

Environment variables reference

Variable	Required	Default	Description
`BLAISE_WEBHOOK_SECRET`	Yes	—	HMAC secret for webhook signature verification
`PORT`	No	`3001`	TCP port the webhook listener binds to
`LOG_LEVEL`	No	`info`	Log verbosity (`debug`, `info`, `warn`, `error`)
`LOG_FORMAT`	No	`json`	Log format (`json` recommended in containers)
`BLAISE_TLS_CERT`	No	—	Path to TLS certificate (enables HTTPS)
`BLAISE_TLS_KEY`	No	—	Path to TLS private key
`BLAISE_API_URL`	No	`https://askblaise.com/`	Only needed for self-hosted Blaise deployments

Exposing the agent publicly

Blaise must be able to reach the agent's webhook endpoint. Options:

Static IP / VM: Open port 3001 in your firewall and register the public IP in the Blaise dashboard.
Reverse proxy (nginx, Caddy): Terminate TLS at the proxy and forward to the container on port 3001.
Tunnel (e.g. Cloudflare Tunnel, ngrok): Useful for local development without a public IP — wrap the tunnel URL in the Blaise dashboard instead of a static IP.

Once the URL is reachable, add it under Settings → Agents in the Blaise dashboard, paste your BLAISE_WEBHOOK_SECRET, and Blaise will start dispatching tasks.