## Install SDR Orchestrator on Docker/Podman

URL: https://docs.atlan.com/product/connections/self-deployed-runtime/how-tos/install-with-orchestrator

> Install Self-Deployed Runtime using the SDR Orchestrator for automated app lifecycle management on Docker or Podman

# Install SDR Orchestrator on Docker/Podman

:::warning Use the guided install wizard instead
**New Self-Deployed Runtime setups are encouraged to use the [guided install wizard](https://docs.atlan.com/llms/platform/self-deployed-runtime/install-guided/llms.txt).** It assembles a complete guide tailored to your lifecycle mode, platform, and image procurement on a single page—and it's where new setup options (for example, HTTP proxy and custom CA trust) are documented going forward.

This page is kept for existing users who already reference it and may not include the latest steps.
:::

:::warning Important!
Some capabilities shown here may require additional enablement or licensing. Contact your Atlan representative for details.
:::

This guide walks you through the one-time setup of the SDR Orchestrator on a Linux VM. You download the SDR package, fill in your credentials and infrastructure config, start the orchestrator with Docker Compose (or Podman Compose), and verify the connection in the Atlan UI. For more information about the SDR Orchestrator, see [SDR Orchestrator](https://docs.atlan.com/llms/platform/self-deployed-runtime/orchestrator-architecture/llms.txt).

## System requirements

- **CPU**
 - SDR Orchestrator: **0.5 vCPU**
 - Per app: **0.5–1 vCPU** (varies by app)
- **Memory**
 - SDR Orchestrator: **256 MB**
 - Per app: **512 MB–1 GB** (varies by app)
- **Disk**
 - SDR Orchestrator: **~500 MB** (SDR image)
 - Per app: **~1–2 GB** (image + artifacts)
- **VM sizing guidance**
 - Size the VM based on the **number of apps you plan to run** by adding the SDR Orchestrator requirements and the per-app requirements. For example, a VM running the **SDR Orchestrator + 3 apps** requires at least **2 vCPUs, 4 GB RAM, and 20 GB disk**.

## Prerequisites

Setup takes 15–30 minutes. Gather credentials and storage details from your infrastructure team beforehand.

Before you begin, verify you have:
- **Linux host** (x86_64 or arm64)—Amazon EC2, on-premises VM, or bare metal. Windows and macOS aren't supported because the SDR requires a native Docker or Podman socket.
- **Docker Engine 20.10+** with Docker Compose plugin, or **Podman 4.0+** (rootless) with `podman-compose`. See [Docker Engine install](https://docs.docker.com/engine/install/) or [Podman installation guide](https://podman.io/docs/installation).
- A **Docker Hub Personal Access Token (PAT)** from your Atlan representative. Required to pull private app images (`atlanhq/*`).
 - The PAT is regenerated periodically—contact Atlan representative for the latest token.
- **Object storage:** AWS S3, Google Cloud Storage, Azure Blob Storage, or local file path. See [Dapr object store docs](https://docs.dapr.io/reference/components-reference/supported-bindings/).
- **Secret store:** AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault, local file, or environment variables. See [Dapr secret store docs](https://docs.dapr.io/reference/components-reference/supported-secret-stores/).
- **Outbound network connectivity** (HTTPS + gRPC) to Atlan's Temporal endpoint, Docker Hub (or your private registry), and S3 for configurator artifacts and source-systems.
- **Private image registry** (optional)—If you replicate Atlan images to your own registry, it must maintain the same image tags and versioning as the Atlan Docker Hub repository. If the registry requires authentication, only basic auth (username/password) is supported.

## Download SDR package

Download the SDR package from Atlan. This archive contains everything you need: `docker-compose.yaml`, `.env`, and `config.yaml`.

### Docker

```bash
curl -fSL -o sdr-orchestrator-docker.tar.gz \
 https://atlan-public.s3.eu-west-1.amazonaws.com/sdr-orchestrator-app/sdr-orchestrator-docker.tar.gz
tar -xzf sdr-orchestrator-docker.tar.gz
cd sdr-orchestrator-docker
```

### Podman

```bash
curl -fSL -o sdr-orchestrator-podman.tar.gz \
 https://atlan-public.s3.eu-west-1.amazonaws.com/sdr-orchestrator-app/sdr-orchestrator-podman.tar.gz
tar -xzf sdr-orchestrator-podman.tar.gz
cd sdr-orchestrator-podman
```

The extracted directory contains the following files:

```
sdr-orchestrator-docker/ # (or sdr-orchestrator-podman/)
├── docker-compose.yaml # Container definition (image tag pre-filled)
├── .env # Atlan credentials and runtime settings
├── config.yaml # Infrastructure config (domain, components)
└── deployments/ # Auto-populated per-app directories
```

## Prepare host environment

Authenticate with Docker Hub so the SDR can pull private app images.

### Docker

```bash
docker login -u atlanhq

# When prompted for password, enter the PAT provided by Atlan

```

A "Login Succeeded" message confirms successful authentication.

### Podman

```bash
podman login -u atlanhq docker.io

# When prompted for password, enter the PAT provided by Atlan

```

A "Login Succeeded" message confirms successful authentication.

## Generate OAuth credentials

SDR uses per-deployment OAuth credentials to authenticate with Atlan. Generate them before filling in `.env`.

1. **Obtain an API token**: [Create an API token](https://docs.atlan.com/get-started/references/api-access#create-api-token) from the Atlan UI.

2. **Register your SDR deployment**: Using the API token from the previous step, run the following command:

 ```bash
 curl --location 'https://<tenant>.atlan.com/api/service/oauth-clients' \
 --header 'Content-Type: application/json' \
 --header 'Authorization: Bearer YOUR_API_TOKEN' \
 --data '{
 "displayName": "sdr-orchestrator",
 "description": "OAuth client for SDR Orchestrator",
 "scopes": ["events-app-permissions-scope","temporal-app-permissions-scope"]
 }'
 ```

 Replace `<tenant>` with your Atlan tenant name and `YOUR_API_TOKEN` with the token from step 1.

3. Save the `clientId` and `clientSecret` from the response—use them as `ATLAN_AUTH_CLIENT_ID` and `ATLAN_AUTH_CLIENT_SECRET` in `.env`.

## Configure .env file

Open `.env` and fill in the required values:

### Docker

1. Find your Docker group ID:

 ```bash
 getent group docker | cut -d: -f3
 ```

 Common values: **988** (Amazon Linux/RHEL), **999** (Ubuntu/Debian).

2. Get the absolute path to your deployments directory:

 ```bash
 echo "$(pwd)/deployments"
 ```

3. Set `DOCKER_GID` and `SDR_DEPLOYMENTS_HOST_DIR` in `.env` using the values from steps 1 and 2:

 :::note Naming rules for `SDR_DEPLOYMENT_NAME`
 Choose a unique identifier for this SDR installation (for example, `mycompany-ec2`). Letters, numbers, hyphens, and underscores only—must start and end with a letter or number. This value must match `atlan.deployment_name` in `config.yaml`.
 :::

 ```bash title=".env"
 # OAuth credentials provisioned by Atlan for this SDR deployment.
 ATLAN_AUTH_CLIENT_ID=oauth-client-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ATLAN_AUTH_CLIENT_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

 # Must match atlan.deployment_name in config.yaml.
 SDR_DEPLOYMENT_NAME=my-env

 # Docker group ID from step 1.
 DOCKER_GID=988

 # Absolute host path to the deployments directory (e.g. /home/ubuntu/sdr-orchestrator-docker/deployments).
 SDR_DEPLOYMENTS_HOST_DIR=/home/ubuntu/sdr-orchestrator-docker/deployments

 LOG_LEVEL=INFO
 ```

### Podman

1. Enable lingering so containers keep running after SSH disconnect:

 ```bash
 sudo loginctl enable-linger $(whoami)
 ```

2. Enable the Podman socket:

 ```bash
 systemctl --user enable --now podman.socket
 ```

3. Verify the socket exists:

 ```bash
 ls -la /run/user/$(id -u)/podman/podman.sock
 ```

4. Get the absolute path to your deployments directory:

 ```bash
 echo "$(pwd)/deployments"
 ```

5. Set `SDR_DEPLOYMENTS_HOST_DIR` in `.env` using the output from step 4, and adjust `CONTAINER_RUNTIME_SOCKET` if your uid isn't 1000:

 :::note Naming rules for `SDR_DEPLOYMENT_NAME`
 Choose a unique identifier for this SDR installation (for example, `mycompany-ec2`). Letters, numbers, hyphens, and underscores only—must start and end with a letter or number. This value must match `atlan.deployment_name` in `config.yaml`.
 :::

 ```bash title=".env"
 # OAuth credentials provisioned by Atlan for this SDR deployment.
 ATLAN_AUTH_CLIENT_ID=oauth-client-xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
 ATLAN_AUTH_CLIENT_SECRET=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

 # Must match atlan.deployment_name in config.yaml.
 SDR_DEPLOYMENT_NAME=my-env

 # Path to the rootless Podman socket. Adjust uid if your user is not 1000.
 CONTAINER_RUNTIME_SOCKET=unix:///run/user/1000/podman/podman.sock

 # Absolute host path to the deployments directory (e.g. /home/ubuntu/sdr-orchestrator-podman/deployments).
 SDR_DEPLOYMENTS_HOST_DIR=/home/ubuntu/sdr-orchestrator-podman/deployments

 LOG_LEVEL=INFO
 ```

## Prepare config.yaml file

Open `config.yaml` and fill in your infrastructure settings. The file has four sections: **Atlan** (your tenant domain and deployment name), **object storage** (where apps transfer data), **secret store** (where apps retrieve secrets at runtime), and **container registry** (how to pull private app images).

### Atlan identity

- **deployment_name**: A unique identifier for this SDR installation (for example, `mycompany-ec2`). Letters, numbers, hyphens, and underscores only. Must start and end with a letter or number. Must match `SDR_DEPLOYMENT_NAME` in `.env`.
- **domain**: Your Atlan tenant domain (for example, `mycompany.atlan.com`). Don't include `https://`.

```yaml
atlan:
 deployment_name: "mycompany-ec2"
 domain: "mycompany.atlan.com"
```

### Object storage

Self-Deployed Runtime needs a store for reading or writing files. Configure the object storage under the `components:` section that matches your environment.

:::tip Don't see your preferred object store?
If your preferred object store isn't listed here, [reach out to Atlan support](https://docs.atlan.com/support/submit-request). Support for additional object stores may be available.
:::

### AWS S3

Add AWS S3 configuration. For more information, see [AWS S3 Binding Spec](https://docs.dapr.io/reference/components-reference/supported-bindings/s3/).

```yaml
components:
 objectstore:
 type: bindings.aws.s3
 version: v1
 metadata:
 - name: accessKey #optional, leave this empty for IAM authentication
 value: ""
 - name: secretKey #optional, leave this empty for IAM authentication
 value: ""
 - name: bucket #required, name of the bucket where application can write
 value: "<bucket-name>"
 - name: region #required, region of the bucket where application can write
 value: "<bucket-region>"
 - name: forcePathStyle
 value: "true"
```

#### IAM permissions for instance role authentication

When `accessKey` and `secretKey` are empty, the SDR uses the EC2 instance role to access S3. Attach the following minimum policy to the role:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": ["s3:ListBucket"],
 "Resource": "arn:aws:s3:::<bucket-name>"
 },
 {
 "Effect": "Allow",
 "Action": [
 "s3:PutObject",
 "s3:GetObject",
 "s3:DeleteObject"
 ],
 "Resource": "arn:aws:s3:::<bucket-name>/*"
 }
 ]
}
```

- Replace `<bucket-name>` with your objectstore bucket name.
- If the bucket uses SSE-KMS encryption, also grant `kms:GenerateDataKey` and `kms:Decrypt` on the KMS key used to encrypt the bucket.

:::caution
Connection checks pass without these permissions. Extraction activities fail with `AccessDenied` only when the SDR writes metadata to the bucket during a crawl.
:::

### Google Cloud Storage

Add Google Cloud Storage configuration. For more information, see [GCP Storage Bucket binding spec](https://docs.dapr.io/reference/components-reference/supported-bindings/gcpbucket/).

```yaml
components:
 objectstore:
 type: bindings.gcp.bucket
 version: v1
 metadata:
 - name: bucket
 value: "<your-gcs-bucket-name>"
 - name: type
 value: "service_account"
 - name: project_id
 value: "<your-gcp-project-id>"
```

### Azure Blob Storage

Add Azure Blob Storage configuration. For more information, see [Azure Blob Storage binding spec](https://docs.dapr.io/reference/components-reference/supported-bindings/blobstorage/).

```yaml
components:
 objectstore:
 type: bindings.azure.blobstorage
 version: v1
 metadata:
 - name: accountName
 value: "<your-storage-account-name>"
 - name: accountKey
 value: "<your-storage-account-key>"
 - name: containerName
 value: "<your-container-name>"
```

### Local file path

Add local file path configuration for volume mounts.

```yaml
components:
 objectstore:
 type: bindings.localstorage
 version: v1
 metadata:
 - name: rootPath
 value: "/data/storage"
```

### Secret store

Self-Deployed Runtime fetches secrets from a secret store to connect to the source systems. Configure the secret store under the same `components:` section that aligns with your security infrastructure.

:::info Did you know?
Dapr supports additional secret stores which aren't mentioned below. For more information, see [Dapr secret store documentation](https://docs.dapr.io/reference/components-reference/supported-secret-stores/) for other configurations.
:::

### AWS Secrets Manager

Add AWS Secrets Manager configuration. For more information, see [AWS Secrets Manager](https://docs.dapr.io/reference/components-reference/supported-secret-stores/aws-secret-manager/).

```yaml
components:
 secretstore:
 type: secretstores.aws.secretmanager
 version: v1
 metadata:
 - name: region #required, region in which secret is hosted
 value: "<secret-region>"
 # Needed if IAM authentication is not used
 - name: accessKey
 value: ""
 - name: secretKey
 value: ""
```

If you are using IAM role authentication, leave `accessKey` and `secretKey` empty.

If you are using an IAM user instead, set:
- `accessKey` to the IAM user's access key ID
- `secretKey` to the IAM user's secret access key

That IAM user must have permission to read the target secret from AWS Secrets Manager:

```json
{
 "Version": "2012-10-17",
 "Statement": [
 {
 "Effect": "Allow",
 "Action": [
 "secretsmanager:GetSecretValue",
 "secretsmanager:DescribeSecret"
 ],
 "Resource": "arn:aws:secretsmanager:<region>:<account-id>:secret:<secret-name>*"
 }
 ]
}
```

:::note
Include the trailing `*` in the secret ARN. AWS appends a random suffix to secret names in the ARN, so omitting it can cause access failures.
:::

### Azure Key Vault

Add Azure Key Vault configuration. For more information, see [Azure Key Vault secret store](https://docs.dapr.io/reference/components-reference/supported-secret-stores/azure-keyvault/).

```yaml
components:
 secretstore:
 type: secretstores.azure.keyvault
 version: v1
 metadata:
 - name: vaultName
 value: "<your-keyvault-name>"
 - name: azureTenantId
 value: "<your-tenant-id>"
 - name: azureClientId
 value: "<your-client-id>"
 - name: azureClientSecret
 value: "<your-client-secret>"
 - name: azureEnvironment
 value: "AZUREPUBLICCLOUD" # Optional: AZUREPUBLICCLOUD, AZURECHINACLOUD, AZUREUSGOVERNMENTCLOUD, AZUREGERMANCLOUD
```

Azure Key Vault supports multiple authentication methods:
- **Client Secret**: Use `azureClientSecret` with tenant ID and client ID
- **Certificate**: Use `azureCertificateFile` instead of client secret
- **Managed Identity**: Omit authentication fields and use Azure managed identity

For detailed authentication setup, see the [Authenticating to Azure](https://docs.dapr.io/developing-applications/integrations/azure/azure-authentication/authenticating-azure/) documentation.

### GCP Secret Manager

Add Google Cloud Secret Manager configuration. For more information, see [GCP Secret Manager](https://docs.dapr.io/reference/components-reference/supported-secret-stores/gcp-secret-manager/).

```yaml
components:
 secretstore:
 type: secretstores.gcp.secretmanager
 version: v1
 metadata:
 - name: type
 value: "service_account"
 - name: project_id
 value: "<project-id>"
 - name: private_key_id
 value: "<private-key-id>"
 - name: private_key
 value: "<private-key>"
 - name: client_email
 value: "<client-email>"
 - name: client_id
 value: "<client-id>"
 - name: auth_uri
 value: "https://accounts.google.com/o/oauth2/auth"
 - name: token_uri
 value: "https://oauth2.googleapis.com/token"
 - name: auth_provider_x509_cert_url
 value: "https://www.googleapis.com/oauth2/v1/certs"
 - name: client_x509_cert_url
 value: "https://www.googleapis.com/robot/v1/metadata/x509/<client-email>"
```

### HashiCorp Vault

Add HashiCorp Vault configuration. For more information, see [HashiCorp Vault](https://docs.dapr.io/reference/components-reference/supported-secret-stores/hashicorp-vault/).

```yaml
components:
 secretstore:
 type: secretstores.hashicorp.vault
 version: v1
 metadata:
 - name: vaultAddr
 value: "[vault_address]" # Optional. Default: "https://127.0.0.1:8200"
 - name: caCert # Optional. This or caPath or caPem
 value: "[ca_cert]"
 - name: caPath # Optional. This or CaCert or caPem
 value: "[path_to_ca_cert_file]"
 - name: caPem # Optional. This or CaCert or CaPath
 value: "[encoded_ca_cert_pem]"
 - name: skipVerify # Optional. Default: false
 value: "[skip_tls_verification]"
 - name: tlsServerName # Optional.
 value: "[tls_config_server_name]"
 - name: vaultTokenMountPath # Required if vaultToken not provided. Path to token file.
 value: "[path_to_file_containing_token]"
 - name: vaultToken # Required if vaultTokenMountPath not provided. Token value.
 value: "[vault_token]"
 - name: vaultKVPrefix # Optional. Default: "dapr"
 value: "[vault_prefix]"
 - name: vaultKVUsePrefix # Optional. default: "true"
 value: "[true/false]"
 - name: enginePath # Optional. default: "secret"
 value: "secret"
 - name: vaultValueType # Optional. default: "map"
 value: "map"
```

### Environment variables

Add local environment variables as the secret store. For more information, see [Local Environment Variables](https://docs.dapr.io/reference/components-reference/supported-secret-stores/envvar-secret-store/).

```yaml
components:
 secretstore:
 type: secretstores.local.env
 version: v1
```

### Container registry

App images on Docker Hub (`atlanhq/*`) are private. The SDR needs credentials to pull them when deploying apps.

:::note
The `container_registry` section is **not** included in the default `config.yaml` extracted from the SDR package. Add this section manually to the end of your `config.yaml` file.
:::

:::warning PAT rotation
For security reasons, the Docker Hub PAT is regenerated on a periodic basis. If the token is embedded in automation scripts or CI/CD pipelines, those jobs may fail. Contact your Atlan representative for the latest token.
:::

### Docker Hub (default)

- **base**: The Docker Hub image prefix. Use `docker.io/atlanhq` for Docker Hub (default).
- **username**: Your Docker Hub username.
- **password**: The Docker Hub PAT provided by Atlan representative.

```yaml
container_registry:
 base: "docker.io/atlanhq"
 username: "<your-dockerhub-username>"
 password: "<your-dockerhub-pat>"
```

### Private registry (replicated)

If you replicate Atlan images to your own registry, set `base` to rewrite image references. For example, `atlanhq/monte-carlo:1.2.3` becomes `<your-registry-host>/atlan/monte-carlo:1.2.3`.

:::tip Renamed images or a pollable workflow?
The `base` rewrite assumes your registry keeps the same image names and tags. If your registry renames images or tags during replication—or you want a machine-readable source of truth for which images to mirror—use an image map in object storage instead. See [Keep a private registry in sync](https://docs.atlan.com/llms/platform/self-deployed-runtime/mirror-images-to-private-registry/llms.txt).
:::

- **base**: Your private registry prefix (for example, `registry.mycompany.com/atlan`).
- **username**: Your private registry username.
- **password**: Your private registry token.

```yaml
container_registry:
 base: "<your-registry-host>/atlan"
 username: "<your-registry-username>"
 password: "<your-registry-token>"
```

To replicate images to your private registry:

```bash

# Pull the required app image (requires Docker Hub PAT from Atlan)

docker pull atlanhq/atlan-saperp-app:latest

# Tag and push to your enterprise registry

docker tag atlanhq/atlan-saperp-app:latest registry.mycompany.com/atlan/atlan-saperp-app:latest
docker push registry.mycompany.com/atlan/atlan-saperp-app:latest
```

### Sample config.yaml files

Below are complete, copy-paste-ready `config.yaml` files for common infrastructure combinations. Replace placeholder values with your actual credentials.

### AWS

```yaml
atlan:
 deployment_name: "mycompany-ec2"
 domain: "mycompany.atlan.com"

components:
 objectstore:
 type: bindings.aws.s3
 version: v1
 metadata:
 - name: accessKey #optional, leave this empty for IAM authentication
 value: ""
 - name: secretKey #optional, leave this empty for IAM authentication
 value: ""
 - name: bucket
 value: "<your-bucket-name>"
 - name: region
 value: "us-east-1"
 - name: forcePathStyle
 value: "true"

 secretstore:
 type: secretstores.aws.secretmanager
 version: v1
 metadata:
 - name: region
 value: "<secret-region>"
 - name: accessKey
 value: ""
 - name: secretKey
 value: ""

container_registry:
 base: "docker.io/atlanhq"
 username: "<your-dockerhub-username>"
 password: "<your-dockerhub-pat>"
```

### GCP

```yaml
atlan:
 deployment_name: "mycompany-gce"
 domain: "mycompany.atlan.com"

components:
 objectstore:
 type: bindings.gcp.bucket
 version: v1
 metadata:
 - name: bucket
 value: "<your-gcs-bucket-name>"
 - name: type
 value: "service_account"
 - name: project_id
 value: "<your-gcp-project-id>"

 secretstore:
 type: secretstores.gcp.secretmanager
 version: v1
 metadata:
 - name: type
 value: "service_account"
 - name: project_id
 value: "<your-gcp-project-id>"
 - name: private_key_id
 value: "<private-key-id>"
 - name: private_key
 value: "<private-key>"
 - name: client_email
 value: "<client-email>"
 - name: client_id
 value: "<client-id>"
 - name: auth_uri
 value: "https://accounts.google.com/o/oauth2/auth"
 - name: token_uri
 value: "https://oauth2.googleapis.com/token"
 - name: auth_provider_x509_cert_url
 value: "https://www.googleapis.com/oauth2/v1/certs"
 - name: client_x509_cert_url
 value: "https://www.googleapis.com/robot/v1/metadata/x509/<client-email>"

container_registry:
 base: "docker.io/atlanhq"
 username: "<your-dockerhub-username>"
 password: "<your-dockerhub-pat>"
```

### Azure

```yaml
atlan:
 deployment_name: "mycompany-azure"
 domain: "mycompany.atlan.com"

components:
 objectstore:
 type: bindings.azure.blobstorage
 version: v1
 metadata:
 - name: accountName
 value: "<your-storage-account-name>"
 - name: accountKey
 value: "<your-storage-account-key>"
 - name: containerName
 value: "<your-container-name>"

 secretstore:
 type: secretstores.azure.keyvault
 version: v1
 metadata:
 - name: vaultName
 value: "<your-keyvault-name>"
 - name: azureTenantId
 value: "<your-tenant-id>"
 - name: azureClientId
 value: "<your-client-id>"
 - name: azureClientSecret
 value: "<your-client-secret>"

container_registry:
 base: "docker.io/atlanhq"
 username: "<your-dockerhub-username>"
 password: "<your-dockerhub-pat>"
```

### AWS + private registry

```yaml
atlan:
 deployment_name: "mycompany-ec2"
 domain: "mycompany.atlan.com"

components:
 objectstore:
 type: bindings.aws.s3
 version: v1
 metadata:
 - name: bucket
 value: "<your-bucket-name>"
 - name: region
 value: "us-east-1"
 - name: forcePathStyle
 value: "true"

 secretstore:
 type: secretstores.aws.secretmanager
 version: v1
 metadata:
 - name: region
 value: "us-east-1"

container_registry:
 base: "<your-registry-host>/atlan"
 username: "<your-registry-username>"
 password: "<your-registry-token>"
```

### On-premises

```yaml
atlan:
 deployment_name: "mycompany-onprem"
 domain: "mycompany.atlan.com"

components:
 objectstore:
 type: bindings.localstorage
 version: v1
 metadata:
 - name: rootPath
 value: "/data/storage"

 secretstore:
 type: secretstores.local.env
 version: v1

container_registry:
 base: "docker.io/atlanhq"
 username: "<your-dockerhub-username>"
 password: "<your-dockerhub-pat>"
```

## Start SDR Orchestrator

### Docker

```bash
docker compose up -d
```

### Podman

```bash
podman compose up -d
```

## Verify installation

After starting the SDR:

### Docker

1. **Check container is running:**

 ```bash
 docker ps | grep atlan-sdr
 ```

2. **Check logs:** Look for "SDR worker listening on task_queue" which confirms Temporal connectivity:

 ```bash
 docker logs atlan-sdr-<deployment-name>
 ```

3. **Verify in Atlan UI:** Go to **Settings** > **Self-Deployed Runtimes**. Your deployment appears as "Connected."

4. **Install apps:** From the Atlan UI, select apps to deploy to this SDR. The SDR automatically provisions OAuth credentials, runs the configurator, starts the app container, and notifies Atlan on success.

### Podman

1. **Check container is running:**

 ```bash
 podman ps | grep atlan-sdr
 ```

2. **Check logs:** Look for "SDR worker listening on task_queue" which confirms Temporal connectivity:

 ```bash
 podman logs atlan-sdr-<deployment-name>
 ```

3. **Verify in Atlan UI:** Go to **Settings** > **Self-Deployed Runtimes**. Your deployment appears as "Connected."

4. **Install apps:** From the Atlan UI, select apps to deploy to this SDR. The SDR automatically provisions OAuth credentials, runs the configurator, starts the app container, and notifies Atlan on success.

## Need help

If you see "permission denied," "Disconnected" in the Atlan UI, or image pull failures, see the [SDR Orchestrator FAQ](https://docs.atlan.com/llms/platform/self-deployed-runtime/orchestrator-faq/llms.txt) for troubleshooting steps.

## Next steps

Once the SDR shows as **Connected** in Atlan UI:

1. Navigate to the **Marketplace** and pick an app (for example, SAP ERP connector).
2. Click **Install** and select your SDR as the deployment target.
3. The SDR handles everything from there—provisioning credentials, running the configurator, starting the app container, and reporting success back to Atlan. No terminal commands needed.

## See also

- [SDR Orchestrator](https://docs.atlan.com/llms/platform/self-deployed-runtime/orchestrator-architecture/llms.txt): Components, communication model, and how container management works.
- [SDR Orchestrator FAQ](https://docs.atlan.com/llms/platform/self-deployed-runtime/orchestrator-faq/llms.txt): Troubleshooting, monitoring, VM state, and backup guidance.
- [Configure network security](https://docs.atlan.com/llms/platform/self-deployed-runtime/configure-network-security/llms.txt): Firewall rules for outbound-only communication.
- [Configure workflow execution](https://docs.atlan.com/llms/platform/self-deployed-runtime/configure-workflow-execution/llms.txt): Set up workflow execution with secret retrieval.

---