Skip to content
Agent Mask

Run with Docker

Agent Mask ships as a Docker image on Docker Hub. The image includes the selected language models and can run without outbound internet at runtime. Submitted payloads are processed inside your deployment boundary; Agent Mask does not send them to Agent Mask servers or external redaction APIs.

This section covers Docker-specific runtime setup: image tags, GPU/container requirements, async-result storage, and HTTP endpoint access. The detection engine, operators, entity types, and document handling match the features documented in the shared Operators, Entities, and Documents sections.

Run with GPU

Section titled “Run with GPU”

Get a free 7-day trial key at agentmask.io/get-license, then start the default GPU path. This example assumes the NVIDIA Container Toolkit is installed and includes Docker’s GPU flag: --gpus all.

Terminal window
docker run -d --gpus all -p 8000:8000 \
  -e LICENSE_KEY="<your key>" \
  raccoondata/agent-mask:latest

The service is ready when GET /health returns 200. First startup loads models into GPU memory and typically takes a few minutes.

Terminal window
curl http://localhost:8000/health

Run without GPU

Section titled “Run without GPU”

For evaluation or low-throughput use without a GPU, omit --gpus all. Agent Mask uses CPU fallback for detection and document processing when no GPU is available:

Terminal window
docker run -d -p 8000:8000 \
  -e LICENSE_KEY="<your key>" \
  raccoondata/agent-mask:latest

GPU-backed identity grouping is unavailable in this mode. Leave entity_collapse unset, or set it to -1, for CPU-only evaluation. Detection and document processing run on CPU and are slower.

Tags

Section titled “Tags”
TagContents
latest, en-latest, X.Y.Z-enEnglish image with identity grouping
<lang>-latest, X.Y.Z-<lang>Single-language image such as fr-latest
<lang>-<lang>-latest, X.Y.Z-<lang>-<lang>Selected language subset such as en-fr-latest
multi-latest, X.Y.Z-multiAll supported languages with identity grouping

latest points at the English image. Pin a semantic version tag (X.Y.Z-en, X.Y.Z-fr, X.Y.Z-multi) in production.

Minimum system requirements

Section titled “Minimum system requirements”

Default GPU run:

  • Docker host running Linux amd64 containers.
  • NVIDIA GPU with at least 16 GB VRAM.
  • NVIDIA driver compatible with the image’s CUDA runtime.
  • NVIDIA Container Toolkit installed, then run the container with --gpus all.

The selected language model, identity grouping, OCR, and document-processing components share GPU memory. Use 24 GB+ for multi-language images, document-heavy workloads, or higher concurrency.

CPU-only run:

  • Docker host running Linux amd64 containers.
  • 8 GB system RAM minimum; 16 GB+ recommended.

CPU-only mode is supported for evaluation and low-throughput deployments.

Persisting results

Section titled “Persisting results”

Async results are stored in a SQLite database at /data/agent_mask.db inside the container. Mount a volume to keep them across restarts:

Terminal window
docker run -d --gpus all -p 8000:8000 \
  -e LICENSE_KEY="<your key>" \
  -v agent-mask-data:/data \
  raccoondata/agent-mask:latest

Securing the endpoint

Section titled “Securing the endpoint”

Set API_KEY to require bearer authentication on the mask endpoints (diagnostics like /health do not require API key authentication):

Terminal window
docker run -d --gpus all -p 8000:8000 \
  -e LICENSE_KEY="<your key>" \
  -e API_KEY="<a long random secret>" \
  raccoondata/agent-mask:latest

Clients then send Authorization: Bearer <API_KEY>. Leave it unset for local evaluation.

Next steps

Section titled “Next steps”