Installation

Containment Chamber ships as a single statically-linked binary with no runtime dependencies. Choose the installation method that fits your workflow.

Choose a runtime mode

Before you configure the server, decide whether you need the stateless Web3Signer-compatible path or the state-backed control-plane path:

Mode	Configure signer_state?	Use it for
Stateless Web3Signer-compatible	No	Drop-in signing with filesystem keys, Web3Signer public-key discovery, SQLite/PostgreSQL/DynamoDB anti-slashing, and optional static_auth from config (named policies, an anonymous binding, and static client tokens).
State-backed	Yes	Runtime auth policies and tokens, operator seal/unseal state, DynamoDB-backed key generation and persistent import/lifecycle, and cross-replica control-plane refresh.

Caution

The anti-slashing backend is separate from the signer state backend. Configuring SQLite, PostgreSQL, or DynamoDB anti-slashing protects signing history, but it does not enable runtime auth policies, tokens, or chamber key generation. Those features require signer_state.

Prerequisites

• Build from source: Rust 1.96+ and just (command runner)
• Docker: Any OCI-compatible runtime (Docker, Podman)
• Binary download: Linux amd64 or arm64

Install

Choose one installation method:

Build from Source

git clone https://github.com/unforeseen-consequences/containment-chamber
cd containment-chamber

# Development build (fast compilation)
just build-dev

# Production build (optimized)
just build-maxperf

The resulting binary is at:

• Development: target/debug/containment-chamber
• Production: target/maxperf/containment-chamber

Tip

Use just build-maxperf for production deployments. It produces a ~3.5 MB optimized binary.

Docker

# Pull the latest image from GitHub Container Registry
docker pull ghcr.io/unforeseen-consequences/containment-chamber:latest

# Run it with a config file
docker run -d \
  -p 9000:9000 \
  -v ./config.yaml:/config.yaml:ro \
  ghcr.io/unforeseen-consequences/containment-chamber:latest \
  server -c /config.yaml

Multi-arch images are available for linux/amd64 and linux/arm64.

Tip

See the Docker guide for Docker Compose examples and environment variable configuration.

Binary Download

# Download the latest release (replace with your architecture)
curl -LO https://github.com/unforeseen-consequences/containment-chamber/releases/latest/download/containment-chamber-linux-amd64

# Make it executable
chmod +x containment-chamber-linux-amd64

# Move to a directory in your PATH
sudo mv containment-chamber-linux-amd64 /usr/local/bin/containment-chamber

Pre-built binaries are available for:

• linux/amd64
• linux/arm64

Cargo Install

Install directly from the repository using cargo install:

cargo install --git https://github.com/unforeseen-consequences/containment-chamber --bin containment-chamber

This compiles from source and installs to ~/.cargo/bin/. Requires Rust 1.96+.

Verify Installation

Confirm the binary is working:

containment-chamber --version

Shell Completions

Generate shell completion scripts for tab-completion of commands and flags:

Bash

containment-chamber completions bash > /etc/bash_completion.d/containment-chamber

Zsh

containment-chamber completions zsh > "${fpath[1]}/_containment-chamber"

Fish

containment-chamber completions fish > ~/.config/fish/completions/containment-chamber.fish

You should see the version number printed to the console. Head to the Quick Start to configure and run your first signer instance.

Next Steps

• Quick Start — create a config file and start signing in under 5 minutes
• Zero to Production — a guided path from install to hardened production deployment
• Docker Deployment — run with Docker or Docker Compose