## Secure Agent vs self-deployed runtime

URL: https://docs.atlan.com/secure-agent/references/secure-agent-vs-sdr

> Detailed comparison of Secure Agent and Self-Deployed Runtime architecture, security, deployment, and configuration.

This page provides a detailed comparison between Secure Agent and Self-Deployed Runtime (SDR) to help you understand what changes—and what stays the same—when you migrate.

## Architecture comparison

<table>
<thead>
<tr><th>Aspect</th><th>Secure Agent</th><th>SDR Single App</th><th>SDR Orchestrator (recommended)</th></tr>
</thead>
<tbody>
<tr><td>**Core components**</td><td>K3s + Argo Workflows + Agent Orchestrator + Health Monitor</td><td>App container + Dapr sidecar + Temporal Worker</td><td>SDR Orchestrator container + per-app containers + Dapr + Temporal Worker</td></tr>
<tr><td>**Orchestration engine**</td><td>Argo Workflows</td><td colSpan="2">Atlan-managed Temporal</td></tr>
<tr><td>**Job pickup**</td><td>Polling every 5 minutes</td><td colSpan="2">Persistent gRPC (near-instant)</td></tr>
<tr><td>**Communication model**</td><td>Outbound only (HTTPS)</td><td colSpan="2">Outbound only (HTTPS + gRPC)</td></tr>
<tr><td>**Atlan endpoints**</td><td>`&lt;tenant&gt;.atlan.com:443`</td><td colSpan="2">`&lt;tenant&gt;.atlan.com:443` + `&lt;tenant&gt;-temporal.atlan.com:443`</td></tr>
<tr><td>**App support per deployment**</td><td>Yes (single deployment for multiple apps)</td><td>One app per source type</td><td>Yes (single deployment for multiple apps)</td></tr>
</tbody>
</table>

## Security comparison

<table>
<thead>
<tr><th>Aspect</th><th>Secure Agent</th><th colSpan="2">Self-Deployed Runtime</th></tr>
</thead>
<tbody>
<tr><td>**Authentication**</td><td>API key (shared across all workflows)</td><td colSpan="2">Per-app OAuth 2.0 client credentials</td></tr>
<tr><td>**Token lifecycle**</td><td>90–180 day API key (manual rotation)</td><td colSpan="2">15-minute JWT (auto refresh)</td></tr>
<tr><td>**Image security**</td><td>Public Docker Hub repository, no image signing</td><td colSpan="2">Private Docker Hub repository, Cosign-signed, Sigstore transparency log</td></tr>
<tr><td>**Container hardening**</td><td>Standard K3s defaults</td><td colSpan="2">Non-root, read-only filesystem, no shell, distroless base</td></tr>
<tr><td>**Credential isolation**</td><td>Shared API key for all connectors</td><td colSpan="2">Unique OAuth credentials per app</td></tr>
</tbody>
</table>

## Deployment comparison

<table>
<thead>
<tr><th>Aspect</th><th>Secure Agent</th><th>SDR Single App</th><th>SDR Orchestrator (recommended)</th></tr>
</thead>
<tbody>
<tr><td>**Supported platforms**</td><td>K3s on VM, AWS EKS</td><td colSpan="2">Docker, Podman, or Kubernetes</td></tr>
<tr><td>**Installation method**</td><td>K3s bootstrap + Helm chart</td><td>Docker Compose or Helm</td><td>Download package, configure, `docker compose up`</td></tr>
<tr><td>**Kubernetes required**</td><td>Yes</td><td colSpan="2">Optional</td></tr>
<tr><td>**Scaling model**</td><td>Argo parallelism settings</td><td>Deploy additional app containers</td><td>Deploy additional app instances from Atlan UI</td></tr>
<tr><td>**App lifecycle management**</td><td>Base images manual updates</td><td>Manual (docker/kubectl commands)</td><td>Automated from Atlan UI (install, update, remove)</td></tr>
<tr><td>**Container runtime**</td><td>K3s (embedded containerd)</td><td colSpan="2">Docker Engine 20.10+ or Podman 4.0+ or K8s 1.24+</td></tr>
</tbody>
</table>

## What's new in SDR

These capabilities are available in SDR but have no Secure Agent equivalent:

| Capability | Description |
|-----------|-------------|
| **HashiCorp Vault support** | Use HashiCorp Vault as your secret store via Dapr integration |
| **Podman support** | Deploy on Podman 4.0+ (rootless) as an alternative to Docker |
| **Automated app lifecycle** | SDR Orchestrator manages install, update, and removal of apps from the Atlan UI |
| **Per-app OAuth credentials** | Each app gets unique OAuth 2.0 credentials, limiting blast radius if compromised |
| **Environment variable secrets** | Use local environment variables as a lightweight secret store option |
| **Distroless containers** | Minimal container images with no shell access, reducing attack surface |

## See also

- [Configuration mapping](https://docs.atlan.com/llms/platform/secure-agent/secure-agent-config-mapping/llms.txt): Translate your existing Secure Agent settings to SDR equivalents
- [SDR Architecture](https://docs.atlan.com/llms/platform/self-deployed-runtime/architecture/llms.txt): Deep dive into SDR components and data flow
- [SDR Orchestrator Architecture](https://docs.atlan.com/product/connections/self-deployed-runtime/references/sdr-orchestrator): How the Orchestrator manages app containers
- [SDR Security](https://docs.atlan.com/llms/platform/self-deployed-runtime/security/llms.txt): Security model, container hardening, and compliance
- [Secure Agent Deployment Architecture](https://docs.atlan.com/llms/platform/secure-agent/deployment-architecture/llms.txt): Current Secure Agent architecture for reference
- [Migration guide](https://docs.atlan.com/llms/platform/secure-agent/migrate-to-sdr/llms.txt): Ready to migrate? Follow the end-to-end guide

---