---
title: Run Script Setup
url: https://www.tines.com/stories/docs/self-hosted/deploying-tines/aws-fargate/run-script-setup/
updated: 2026-07-01T18:09:05+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Self-Hosted](https://www.tines.com/llm/stories/docs/self-hosted.md) › [Deploying Tines](https://www.tines.com/llm/stories/docs/self-hosted/deploying-tines.md) › [AWS Fargate](https://www.tines.com/llm/stories/docs/self-hosted/deploying-tines/aws-fargate.md)*

# Run Script Setup

*[View on tines.com](https://www.tines.com/stories/docs/self-hosted/deploying-tines/aws-fargate/run-script-setup/)*

We support running Run Script actions on your infrastructure for self-hosted customers and for cloud customers using tunnels. For general details on the Run Script action, refer to the documentation [here](https://www.tines.com/docs/actions/templates/run-python-script/). 

## Overview

Run Script actions are executed locally using `tines-command-runner`. 

Our deployment of tines-command-runner includes two containers:

1. `tines-command-runner`
2. `pypi-server`([https://github.com/pypiserver/pypiserver)](https://github.com/pypiserver/pypiserver)

The `tines-command-runner` container handles executing scripts.

Usage of `pypi-server` is **optional. **The `pypi-server` acts as a local python package index, making the installation of packages efficient and easily configurable. For details on configuring tines-command-runner, including available environment variables and options for configuring your own custom package index, see our [tines-command-runner configuration reference](https://www.tines.com/stories/docs/run-script-tines-command-runner/).

### Recommended System Requirements

> **INFO:**
> -   2 vCPU
> -   1.5GB Memory
> -   10-20GB disk space
> -   For heavier workloads, you may need to allocate more CPU and memory.
> -   CPU will improve the performance of compute-intensive tasks. Memory will allow for more concurrent tasks to run.
> -   Disk space will need to be increased based on the size and number of dependencies used, or any storage that your Run Scripts themselves make use of. Note that we pre-package a number of Python dependencies in our Python image, listed in the configuration reference linked in the overview above.
> -   A private network. Tines-command-runner does not have a built-in authentication system, and is meant to be reachable from a Tines tenant only.
> -   **Note that dependencies will be installed multiple times if multiple teams or multiple distinct scripts are using the same dependencies. Three teams using the same dependencies will result in three copies of those dependencies being stored on disk by tines-command-runner.**

### Privilege Escalation

The tines-command-runner image generates a unique Linux user for each Tines team using Run Script actions. To ensure each team's scripts are isolated from one another, tines-command-runner uses `sudo` to switch between these users when running scripts for a particular team.

If your environment restricts privilege escalation by default, you can explicitly grant only the minimum required Linux capabilities to the container.

 Required capabilities

- `SETUID`
  
  -  Allows the container to change the effective user ID (required for `sudo` to switch users)
- `SETGID`
  
  - Allows the container to change the effective group ID (required for `sudo` to switch groups)
- `AUDIT_WRITE`
  
  - Allows writing to the kernel audit log (required by PAM/sudo for security logging)

## Deployment

### Step 1. Prepare the tines-command-runner Docker image 

To simplify deployment, we mirror the image from Docker Hub into an ECR repository:

```bash
aws --profile test ecr create-repository --repository-name tines-command-runner

# Replace this with the address of the registry output in the previous command:
REGISTRY=306378194054.dkr.ecr.eu-west-1.amazonaws.com

aws ecr get-login-password --region eu-west-1 | \
  docker login --username AWS --password-stdin $REGISTRY

TCR_IMAGE=tines-command-runner:latest

docker pull tines/$TCR_IMAGE
docker tag tines/$TCR_IMAGE $REGISTRY/$TCR_IMAGE
docker push $REGISTRY/$TCR_IMAGE
```

### Step 2. Update the ECS task definitions 

Deploy the `tines-command-runner` container alongside your existing containers by adding it to the `tines-sidekiq` task. You can update the JSON payload in the AWS ECS UI by locating the latest task definition and add the following container definition:

```json
{
  "name": "tines-command-runner",
  "image": "$REGISTRY/tines-command-runner:latest",
  "environment": [
    {
      "name": "PORT",
      "value": "4400"
    }
  ],
  "logConfiguration": {
    "logDriver": "awslogs",
    "options": {
      "awslogs-group": "tines",
      "awslogs-region": "$AWS_REGION",
      "awslogs-stream-prefix": "tines"
    }
  },
  "portMappings": [
    {
      "containerPort": 4400
    }
  ]
}
```

### Step 3. Set a new environment variable

You also need to set the following environment variable on the Tines containers : `TINES_COMMAND_RUNNER_HOST=localhost`. This should be done on your [.env file](/docs/self-hosted/deploying-tines/aws-fargate/deployment-guide/#step-7-create-a-env-file) or task definition.

### Step 4. Restart the services 

```bash
aws ecs update-service --cluster <cluster_name> --service tines-sidekiq --force-new-deployment
```

### Run Script Timeout Configuration

The default timeout for scripts is 60 seconds. In Fargate, you can override this by setting the `RUN_SCRIPT_MAX_TIMEOUT` environment variable on your [.env file](/docs/self-hosted/deploying-tines/aws-fargate/deployment-guide/#step-7-create-a-env-file)  or on the tines-sidekiq and tines-app application.

For more information on tuning tines-command-runner for longer timeouts, see our [configuration reference](https://www.tines.com/stories/docs/run-script-tines-command-runner/).

This should be done on your [.env file](/docs/self-hosted/deploying-tines/aws-fargate/deployment-guide/#step-7-create-a-env-file) or in your AWS task definition.

**.env file**

```bash
# Other tines-app env vars
RUN_SCRIPT_MAX_TIMEOUT=90
```

**AWS Fargate (add to the tines-sidekiq task definition):**

```json
{
  "environment": [
    {
      "name": "RUN_SCRIPT_MAX_TIMEOUT",
      "value": "90"
    }
  ]
}
```