Deploying

marimohub ships as a single container image (apps/server/Dockerfile) that serves both the API and the web UI. Pick a platform below; each guide covers the image, configuration, the three backends (storage / compute / auth), and background maintenance.

• Helm — install/upgrade any cluster from the published, versioned marimohub chart (single-tenant).
• Single instance — one Linux box (cloud VM or on-prem) with fs storage + docker compute; no object store, no cluster.
• CoreWeave (CKS) — CAIOS + CoreWeave Sandboxes + OIDC.
• Kubernetes — any cluster (EKS/GKE/AKS/self-managed) with native Pod kernels via the kubernetes compute backend.
• GCP — GKE or Cloud Run + GCS.
• AWS — EKS or ECS/Fargate + native S3.
• Cloudflare — Workers + R2 + Containers + Access (serverless).

Path prefix

To publish the Node deployment at https://hub.example.com/marimohub/, set:

MARIMOHUB_APP_BASE_URL=https://hub.example.com/marimohub
MARIMOHUB_AUTH_OIDC_REDIRECT_URI=https://hub.example.com/marimohub/api/auth/callback

Configure nginx to strip the prefix and forward WebSocket connections:

location = /marimohub {
    return 308 /marimohub/;
}

location /marimohub/ {
    proxy_http_version 1.1;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
    proxy_buffering off;
    proxy_pass http://marimohub:3000/;
}

The redirect adds the trailing slash to the public URL. The trailing slash on proxy_pass strips the prefix. X-Forwarded-Proto preserves HTTPS in public links. The timeouts permit one hour between WebSocket I/O operations. nginx passes streamed responses without buffering. The path prefix is runtime configuration, so one image can serve different prefixes.

After deploy, validate the same core flow on every platform:

1. Check /api/health.
2. Sign in through the configured auth backend.
3. Create a project and notebook.
4. Start a kernel.
5. Save the notebook and confirm it survives a server restart.

See Configuration for every variable and Troubleshooting for common startup, login, and kernel failures.