Skip to content
Deployment

Deployment

Choose a managed service or run Team Server in your own container environment.

Compare Deployment Models

ConsiderationManagedSelf-hosted
InfrastructureOperated by EnduraOperated by your team
Database, backup, and updatesIncludedYour responsibility
Network and TLSProvisioned during onboardingFully configurable
Configuration changesCoordinated with EnduraApplied directly
Deployment optionsDedicated managed instanceDocker, Podman, or Kubernetes

Choose Managed when you want Endura to own service operations. Choose Docker, Podman, or Kubernetes when you need direct infrastructure control.

Versioning and Release Channels

Team Server uses semantic versions in major.minor.patch form:

  • Major releases may change the Sensor contract.
  • Minor releases add compatible functionality.
  • Patch releases contain compatible fixes.
ChannelIntended use
latestDevelopment and early testing
testingIntegration-tested rolling releases
stableProduction environments that prefer slower promotion

Docker and Podman examples use the mutable testing tag. Kubernetes examples pin an immutable version because Kubernetes does not re-pull an unchanged mutable tag when its underlying image changes.

Runtime Sensor Compatibility

Team Server and the Runtime Sensor are compatible when their major versions match. Minor and patch versions do not gate compatibility and may be updated in either order.

Team Server publishes its version through unauthenticated GET /api/version:

{"version":"1.0.0","build":"f57af95c"}

The Sensor reads this endpoint at startup and every 15 seconds. When major versions differ, the Sensor:

  • warns about the mismatch;
  • continues enforcing its current policies;
  • stops submitting registration, status, heartbeat, violation, and log data;
  • continues reporting its version so Team Server can display the mismatch; and
  • resumes submission automatically when compatible Team Server answers.

endura sensor status reports the mismatch as active (incompatible: team server <version>, ...). Team Server also identifies the incompatible Sensor in its Sensors view.

For a major upgrade, update Team Server and all Sensors in the same maintenance window. Either order is supported. Minor and patch upgrades require no coordinated window.

ENDURA_VERSION_CHECK=false disables the gate. Use it only as a temporary last resort because it allows unsupported cross-major submission.

See Team Server Compatibility for the Sensor-side behavior.

Capacity

Team Server resource needs depend on connected Sensors, telemetry volume, policy size, integrations, and data retention. Start with the resource requests in the deployment guide, monitor database and application usage, and increase capacity before sustained saturation.

Network Requirements

DirectionDestinationPurpose
InboundTeam Server HTTPS endpointUI, API, and Sensor traffic
OutboundPostgreSQL, when externalApplication data
OutboundConfigured identity providersOIDC authentication
OutboundConfigured CI/CD systemsPipeline and build discovery
Outboundslack.com:443, when usedViolation notifications

Private CI/CD endpoints or internal certificate authorities require outbound HTTP configuration.

Choose a Guide