---
title: Run Script Setup
url: https://www.tines.com/stories/docs/self-hosted/deploying-tines/docker-compose/run-script-setup/
updated: 2026-07-01T18:08:18+00:00
---

*[tines.com](https://www.tines.com/llms.txt) › [Docs](https://www.tines.com/stories/docs/llms.txt) › [Self-Hosted](https://www.tines.com/llm/stories/docs/self-hosted.md) › [Deploying Tines](https://www.tines.com/llm/stories/docs/self-hosted/deploying-tines.md) › [Docker Compose](https://www.tines.com/llm/stories/docs/self-hosted/deploying-tines/docker-compose.md)*

# Run Script Setup

*[View on tines.com](https://www.tines.com/stories/docs/self-hosted/deploying-tines/docker-compose/run-script-setup/)*

We support running Run Script actions on your infrastructure for self-hosted customers and for cloud customers using tunnels. For general details on the Run Script action, refer to the documentation [here](https://www.tines.com/docs/actions/templates/run-python-script/). 

## Overview

Run Script actions are executed locally using `tines-command-runner`. 

Our deployment of tines-command-runner includes two containers:

1. `tines-command-runner`
2. `pypi-server`([https://github.com/pypiserver/pypiserver)](https://github.com/pypiserver/pypiserver)

The `tines-command-runner` container handles executing scripts.

Usage of `pypi-server` is **optional. **The `pypi-server` acts as a local python package index, making the installation of packages efficient and easily configurable. For details on configuring tines-command-runner, including available environment variables and options for configuring your own custom package index, see our [tines-command-runner configuration reference](https://www.tines.com/stories/docs/run-script-tines-command-runner/).

### Recommended System Requirements

> **INFO:**
> -   2 vCPU
> -   1.5GB Memory
> -   10-20GB disk space
> -   For heavier workloads, you may need to allocate more CPU and memory.
> -   CPU will improve the performance of compute-intensive tasks. Memory will allow for more concurrent tasks to run.
> -   Disk space will need to be increased based on the size and number of dependencies used, or any storage that your Run Scripts themselves make use of. Note that we pre-package a number of Python dependencies in our Python image, listed in the configuration reference linked in the overview above.
> -   A private network. Tines-command-runner does not have a built-in authentication system, and is meant to be reachable from a Tines tenant only.
> -   **Note that dependencies will be installed multiple times if multiple teams or multiple distinct scripts are using the same dependencies. Three teams using the same dependencies will result in three copies of those dependencies being stored on disk by tines-command-runner.**

### Privilege Escalation

The tines-command-runner image generates a unique Linux user for each Tines team using Run Script actions. To ensure each team's scripts are isolated from one another, tines-command-runner uses `sudo` to switch between these users when running scripts for a particular team.

If your environment restricts privilege escalation by default, you can explicitly grant only the minimum required Linux capabilities to the container.

 Required capabilities

- `SETUID`
  
  -  Allows the container to change the effective user ID (required for `sudo` to switch users)
- `SETGID`
  
  - Allows the container to change the effective group ID (required for `sudo` to switch groups)
- `AUDIT_WRITE`
  
  - Allows writing to the kernel audit log (required by PAM/sudo for security logging)

### Docker Compose Configuration

##### Step 1. Prepare the docker-compose.yml

Use the below Docker Compose configuration as a starting point for your deployment of tines-command-runner:

```yaml
services:
  tines-command-runner:
    image: tines/tines-command-runner:latest
    ports:
      - "4400:4400"
    depends_on:
      - pypi-server
    networks:
      - tines-net
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:4400/health"]
      interval: 30s
      retries: 3
      start_period: 10s
      timeout: 10s
    restart: always

  pypi-server:
    image: pypiserver/pypiserver:latest
    hostname: pypi-server
    volumes:
      - python-packages:/data/packages
    expose:
      - "8080"
    networks:
      - tines-net
    command: run -P . -a . /data/packages
    restart: always

volumes:
  python-packages:

networks:
  tines-net:
```

**CPU & Memory for docker-compose:**

We recommend configuring resource limits for tines-command-runner to ensure that run script execution doesn't impact other containers on your host. For example, to dedicate 2 of the host's CPU cores and 1GB of memory:

```yaml
services:
  tines-command-runner:
    mem_limit: 1g
    cpus: '2.0'
```

##### Step 2. Run the container via Docker compose

```bash
docker compose up -d
```

### Docker Configuration

Adapt the below commands to run tines-command-runner directly via Docker.

```bash
docker network create tines-net

docker run -d \
  --name tines-command-runner \
  -p 4400:4400 \
  --network tines-net \
  --health-cmd "curl -f http://localhost:4400/health" \
  --health-interval 30s \
  --health-retries 3 \
  --health-start-period 10s \
  --health-timeout 10s \
  --restart always \
  tines/tines-command-runner:latest

docker run -d \
  --name pypi-server \
  -v python-packages:/data/packages \
  --hostname pypi-server \
  --expose 8080 \
  --network tines-net \
  --restart always \
  pypiserver/pypiserver:latest run -P . -a . /data/packages
```