Deployment

A machine that works on your laptop needs to work in production. Deploying is what the CLI calls turning a machine on: it pins the version you promoted to a computer, with the machine’s declared surfaces up, until you turn it off. The same code, the same governance, the same behavioral ledger. No rewriting, no reconfiguration, no surprises.

Deploying is not a bigger run. It executes nothing by itself. What it changes is where the machine lives, who can reach it, and what holds while you are not watching. If all you want is one execution on a computer that is not your laptop, run it there instead. See Running and Turning On for the distinction and for the case where leaving a machine on is not what you meant.

Deployment targets

Target	Best for	How it works
mashin.live	Fastest path to production	Managed cloud computer, push and run
mashin.cloud	Sharing and demos	Public URLs for individual machines
Docker	Self-hosted, enterprise	Container with computer mounted as volume
Desktop (Mac Mini, server)	Always-on local computer	Headless background process

mashin.live

The managed cloud platform. Push a machine to your cloud computer and it runs there:

mashin deploy greeting.mashin

Cloud is the default. Add --local to run the same machine as a persistent process on this computer instead.

Your machines are accessible via API, MCP, WebSocket, and A2A. Governance, the behavioral ledger, and credentials all work the same as on your laptop. mashin.live manages scaling, uptime, and infrastructure.

Computer mapping

Each organization gets one cloud computer on mashin.live. It mirrors the structure of your local computer:

• Same machines
• Same governance rules
• Same credential requirements (you set production credentials separately)
• Same behavioral ledger (production runs recorded)

Custom domains

Map your own domain to a deployed machine:

mashin domain add api.mycompany.com --machine greeting
mashin domain verify api.mycompany.com

domain add prints the CNAME and TXT records to create at your DNS provider. Once they resolve, domain verify checks them and provisions the TLS certificate.

mashin.cloud

For sharing individual machines with a public URL. Useful for demos, prototypes, and quick integrations:

mashin deploy greeting.mashin --public

Your machine gets a URL like https://email-triage.mashin.cloud that anyone can invoke.

Docker

Run a computer as a Docker container for self-hosted deployment. Pull the published computer image and run it directly, no build step required:

docker run -d --name my-computer \
  -v mashin-data:/data \
  -p 4000:4000 \
  -e MASHIN_APP_MODE=computer \
  -e MASHIN_BASE_URL=https://computer.example.com \
  -e SECRET_KEY_BASE=$(openssl rand -base64 64 | tr -d '\n') \
  -e MASHIN_OAUTH2_SIGNING_SECRET=$(openssl rand -base64 48) \
  -e ANTHROPIC_API_KEY=sk-... \
  ghcr.io/mashin-live/mashin-computer:latest

SECRET_KEY_BASE and MASHIN_OAUTH2_SIGNING_SECRET are required; the process refuses to boot without them. Set MASHIN_BASE_URL to the address you’ll actually reach the computer on. The computer’s database, ledger, and git history persist in the mounted volume. API keys are passed as environment variables or mounted from a secrets manager.

Check that it’s up:

curl http://localhost:4000/health/live

Desktop deployment

Run a headless computer on any always-on machine (Mac Mini, Linux server):

mashin computer start

Daemon mode is the default; the computer runs as a background process. Pass --foreground to run it attached instead. Machines respond to events, schedules, and API calls. Use Koda remotely to monitor and manage.

What gets deployed

When you deploy, mashin packages:

• Machine definitions (compiled .mashin files)
• Governance rules (the ensures section, compiled into the artifact)
• Test suite (the verifies section, for verification before promotion)
• Metadata (version, dependencies, signatures)

Credentials are not deployed. You set production credentials in the target computer separately. This separation ensures secrets never leave their environment.

The deployment flow

1. Compile: mashin compile turns machines into frozen artifacts
2. Test: mashin test runs the verifies suite
3. Deploy: mashin deploy <file.mashin> pushes the artifact to your cloud computer
4. Verify: The target computer runs verification checks before accepting
5. Activate: The new version goes live

Each step is recorded in the evolution ledger. You can always see what version is running, when it was deployed, and what changed.

Governance in production

Production computers enforce the same governance as development. If a machine is not allowed to db_write, that holds in production too. Governance is compiled into the artifact, not configured at the deployment layer.

The behavioral ledger in production records every execution with the same detail as in development: steps, decisions, costs, hash chains. This is how mashin delivers production auditability.

Try it

Deploy your first machine to mashin.live:

mashin compile greeting.mashin
mashin test greeting.mashin
mashin deploy greeting.mashin

Then invoke it via the API URL that mashin.live provides. Check the behavioral ledger in the cloud computer to see the production run.

Next steps

• Publishing - Share machines via the registry
• Computers - Understanding the deployment unit
• Governance - How governance applies in production