# Loch.sh Docs

> Documentation for the Loch.sh infrastructure

This file contains links to documentation sections following the llmstxt.org standard.

## Loch Panel

- [Audit trail](https://docs.loch.sh/panel/admin/audit.md): See what the Loch Panel audit trail records, consult it, and keep it safe from tampering.
- [Configuration](https://docs.loch.sh/panel/admin/configuration.md): The essential environment variables of the Loch Panel API, grouped by purpose, and how the API checks them at startup.
- [Functions module](https://docs.loch.sh/panel/admin/functions.md): Enable the Functions module, provide the Loch Lambda Runtime binary, set the limits and budgets, and understand the networks, egress and credential...
- [Websites](https://docs.loch.sh/panel/admin/hosting.md): Enable the Hosting module, then create, update, redeploy and delete PHP or static websites served by Traefik.
- [Installation](https://docs.loch.sh/panel/admin/installation.md): Deploy the Loch Panel API and web interface with Docker, connect an OIDC provider and log in as the first admin.
- [Private networks](https://docs.loch.sh/panel/admin/networks.md): Decide which websites reach which service instances and functions with private Docker networks, attach and detach members.
- [Security](https://docs.loch.sh/panel/admin/security.md): What a Loch Panel admin must know about API keys, the origin check, the protected API container and network exposure.
- [Managed services](https://docs.loch.sh/panel/admin/services.md): Enable the services module, create databases, caches, brokers and object storage for your websites, resize, update and publish them.
- [SFTP accounts](https://docs.loch.sh/panel/admin/sftp.md): Enable the SFTP module (SFTPGo) and give website owners SFTP access to their files.
- [Users and access](https://docs.loch.sh/panel/admin/users.md): Understand the admin and restricted profiles, grant containers to a user, promote, demote or delete users.
- [Architecture](https://docs.loch.sh/panel/developer/architecture.md): The three Loch Panel projects, how they talk to each other and the main packages of each.
- [Conventions](https://docs.loch.sh/panel/developer/conventions.md): The rules to follow when you change the Loch Panel code: images, languages, translations, configuration and security.
- [Local development](https://docs.loch.sh/panel/developer/local-development.md): Run the Loch Panel API, the web interface and SFTPGo on your machine.
- [Testing](https://docs.loch.sh/panel/developer/testing.md): Run the Go tests, the engine integration tests, Vitest and the Playwright end-to-end tests of Loch Panel.
- [Translations](https://docs.loch.sh/panel/developer/translations.md): Update a text of the Loch Panel interface, add a translation key or add a new language.
- [Loch Panel](https://docs.loch.sh/panel.md): Manage Docker containers, websites, managed services and functions from a web interface, a CLI or an AI assistant.
- [API reference](https://docs.loch.sh/panel/reference/api.md): Authentication, error format, every REST route with its scope, and the WebSocket events of the Loch Panel API.
- [Configuration reference](https://docs.loch.sh/panel/reference/configuration.md): Every environment variable of the Loch Panel API, with its default value and description, grouped by module.
- [API key scopes](https://docs.loch.sh/panel/reference/scopes.md): Every permission an API key can carry, what it allows and whether it needs an admin profile.
- [Services engines](https://docs.loch.sh/panel/reference/services-engines.md): Every engine of the managed services module, with its versions, topology, port, images and options with their allowed values.
- [API keys](https://docs.loch.sh/panel/user-guide/api-keys.md): Create an API key for the Loch CLI or a script, limit its permissions and revoke it.
- [Manage containers](https://docs.loch.sh/panel/user-guide/containers.md): Find a container, start or stop it, read its logs, open a terminal and watch its resource usage.
- [Functions](https://docs.loch.sh/panel/user-guide/functions.md): Create a function from a handler written for AWS Lambda, deploy its code, test it, set its secrets, credentials and networks, and schedule invocati...
- [Scheduled tasks](https://docs.loch.sh/panel/user-guide/scheduled-tasks.md): Run a container action, a command in a container, an HTTP request or a function invocation on a cron schedule.
- [Sign in and the home page](https://docs.loch.sh/panel/user-guide/sign-in.md): Sign in to Loch Panel with your organization account and read the home page.
- [Stack actions](https://docs.loch.sh/panel/user-guide/stacks.md): Start, stop or restart every container of a compose stack in one click.

## Loch CLI

- [Containers](https://docs.loch.sh/cli/guides/containers.md): List, inspect, start, stop, restart, kill and remove containers, act on a whole stack and watch live resource usage.
- [Scheduled jobs](https://docs.loch.sh/cli/guides/cron.md): List, create, run, enable, disable and delete scheduled jobs (cron) from the terminal.
- [Endpoints and namespaces](https://docs.loch.sh/cli/guides/endpoints-and-namespaces.md): Add Loch Panel servers to loch, switch between them, save an API key and choose the active Docker Compose stack.
- [Files, shell, logs and tunnels](https://docs.loch.sh/cli/guides/files-and-shell.md): Copy files to and from a container, open a shell, read logs and log files, and reach a container port from your machine.
- [Functions](https://docs.loch.sh/cli/guides/functions.md): Create functions from handlers written for AWS Lambda, deploy code, invoke them, read their logs, set secrets and credentials, and run them locally...
- [Web hosting](https://docs.loch.sh/cli/guides/hosting.md): Create, change, redeploy and delete PHP, Nginx and Apache websites from the terminal.
- [Private networks](https://docs.loch.sh/cli/guides/networks.md): Create private networks and choose which hosted sites reach which service instances.
- [Databases and services](https://docs.loch.sh/cli/guides/services.md): Create databases, caches, message brokers, queues and object storage, reset their passwords, resize, update and publish them.
- [SFTP users](https://docs.loch.sh/cli/guides/sftp.md): Create, enable, disable and delete the SFTP accounts of hosted sites, and reset their passwords.
- [Shell completion](https://docs.loch.sh/cli/guides/shell-completion.md): Enable tab completion of loch commands, container names and namespaces in bash, zsh, fish or PowerShell.
- [Users](https://docs.loch.sh/cli/guides/users.md): List users, grant or revoke access to containers, promote or demote admins and delete users.
- [Install](https://docs.loch.sh/cli/install.md): Install the loch binary on macOS or Linux, or build it from source.
- [Loch CLI](https://docs.loch.sh/cli.md): The loch command line manages Loch Panel servers and runs an MCP server for AI assistants.
- [Connect an AI assistant](https://docs.loch.sh/cli/mcp.md): Connect Claude Code, Codex, OpenCode or LM Studio to Loch Panel through the loch MCP server.
- [loch](https://docs.loch.sh/cli/reference/commands/loch.md): CLI to manage your containers via Host Panel
- [loch ai:howto](https://docs.loch.sh/cli/reference/commands/loch-ai-howto.md): Display how to use this tool with AI
- [loch completion](https://docs.loch.sh/cli/reference/commands/loch-completion.md): Generate shell completion script
- [loch config](https://docs.loch.sh/cli/reference/commands/loch-config.md): Configure an endpoint
- [loch config ls](https://docs.loch.sh/cli/reference/commands/loch-config-ls.md): List configured endpoints
- [loch cp](https://docs.loch.sh/cli/reference/commands/loch-cp.md): Copy files between local filesystem and a container
- [loch cron](https://docs.loch.sh/cli/reference/commands/loch-cron.md): Manage scheduled jobs
- [loch cron create](https://docs.loch.sh/cli/reference/commands/loch-cron-create.md): Create a scheduled job (interactive, or with flags for a function invocation)
- [loch cron disable](https://docs.loch.sh/cli/reference/commands/loch-cron-disable.md): Disable a scheduled job
- [loch cron enable](https://docs.loch.sh/cli/reference/commands/loch-cron-enable.md): Enable a scheduled job
- [loch cron ls](https://docs.loch.sh/cli/reference/commands/loch-cron-ls.md): List scheduled jobs
- [loch cron rm](https://docs.loch.sh/cli/reference/commands/loch-cron-rm.md): Delete a scheduled job
- [loch cron run](https://docs.loch.sh/cli/reference/commands/loch-cron-run.md): Run a scheduled job immediately
- [loch domains](https://docs.loch.sh/cli/reference/commands/loch-domains.md): Show Traefik domains (admin)
- [loch functions](https://docs.loch.sh/cli/reference/commands/loch-functions.md): Manage functions: handlers written for AWS Lambda (Node.js, Python, Go/Rust bootstraps) run on the endpoint
- [loch functions activate](https://docs.loch.sh/cli/reference/commands/loch-functions-activate.md): Activate a kept deployment (rollback)
- [loch functions config](https://docs.loch.sh/cli/reference/commands/loch-functions-config.md): Show the runtimes, limits and defaults of the endpoint
- [loch functions create](https://docs.loch.sh/cli/reference/commands/loch-functions-create.md): Create a function (invoke credentials shown once)
- [loch functions credentials](https://docs.loch.sh/cli/reference/commands/loch-functions-credentials.md): Manage the invoke credentials of a function
- [loch functions credentials rotate](https://docs.loch.sh/cli/reference/commands/loch-functions-credentials-rotate.md): Generate new invoke credentials (shown once; the old ones stop working)
- [loch functions delete](https://docs.loch.sh/cli/reference/commands/loch-functions-delete.md): Delete a function, its code, secrets and credentials
- [loch functions deploy](https://docs.loch.sh/cli/reference/commands/loch-functions-deploy.md): Deploy code (a directory, zipped here, or a zip file) and activate it
- [loch functions deployments](https://docs.loch.sh/cli/reference/commands/loch-functions-deployments.md): List the kept deployments of a function (newest first)
- [loch functions dev](https://docs.loch.sh/cli/reference/commands/loch-functions-dev.md): Run a function locally with Docker and the loch runtime (no panel)
- [loch functions dev down](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-down.md): Remove a local function: container, network and cache files
- [loch functions dev event](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-event.md): Print a sample event (JSON) to pipe into loch functions dev invoke
- [loch functions dev info](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-info.md): Print the endpoint, credentials and invoke commands of a local function
- [loch functions dev invoke](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-invoke.md): Invoke a local function (docker exec, no credential)
- [loch functions dev logs](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-logs.md): Show the logs of a local function
- [loch functions dev ls](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-ls.md): List the local functions, and the files left in the loch cache
- [loch functions dev runtime](https://docs.loch.sh/cli/reference/commands/loch-functions-dev-runtime.md): Show the loch function runtime binary loch functions dev uses, and where it comes from
- [loch functions egress](https://docs.loch.sh/cli/reference/commands/loch-functions-egress.md): Allow or block the outbound Internet access of a function
- [loch functions invoke](https://docs.loch.sh/cli/reference/commands/loch-functions-invoke.md): Invoke a function with a JSON event and print its response
- [loch functions logs](https://docs.loch.sh/cli/reference/commands/loch-functions-logs.md): Show the logs (stdout and stderr) of a function
- [loch functions ls](https://docs.loch.sh/cli/reference/commands/loch-functions-ls.md): List the functions
- [loch functions networks](https://docs.loch.sh/cli/reference/commands/loch-functions-networks.md): Show or replace the networks of a function
- [loch functions restart](https://docs.loch.sh/cli/reference/commands/loch-functions-restart.md): Restart a function
- [loch functions secrets](https://docs.loch.sh/cli/reference/commands/loch-functions-secrets.md): List the secret names of a function, set or remove a secret
- [loch functions secrets rm](https://docs.loch.sh/cli/reference/commands/loch-functions-secrets-rm.md): Remove a secret
- [loch functions secrets set](https://docs.loch.sh/cli/reference/commands/loch-functions-secrets-set.md): Set a secret (value typed without echo, or read from stdin)
- [loch functions show](https://docs.loch.sh/cli/reference/commands/loch-functions-show.md): Show a function: configuration, variables, secret names, deployments, endpoint
- [loch functions start](https://docs.loch.sh/cli/reference/commands/loch-functions-start.md): Start a function
- [loch functions stop](https://docs.loch.sh/cli/reference/commands/loch-functions-stop.md): Stop a function (it stays stopped until started)
- [loch functions update](https://docs.loch.sh/cli/reference/commands/loch-functions-update.md): Change the resources, handler or variables of a function
- [loch hosting](https://docs.loch.sh/cli/reference/commands/loch-hosting.md): Manage hosted web stacks (admin)
- [loch hosting check-name](https://docs.loch.sh/cli/reference/commands/loch-hosting-check-name.md): Check whether a stack name is available
- [loch hosting create](https://docs.loch.sh/cli/reference/commands/loch-hosting-create.md): Create and deploy a hosted stack
- [loch hosting delete](https://docs.loch.sh/cli/reference/commands/loch-hosting-delete.md): Delete a hosted stack
- [loch hosting deploy](https://docs.loch.sh/cli/reference/commands/loch-hosting-deploy.md): Redeploy a hosted stack as it is on disk
- [loch hosting get](https://docs.loch.sh/cli/reference/commands/loch-hosting-get.md): Show the settings, containers and last operation of a stack
- [loch hosting list](https://docs.loch.sh/cli/reference/commands/loch-hosting-list.md): List hosted stacks
- [loch hosting php-modules](https://docs.loch.sh/cli/reference/commands/loch-hosting-php-modules.md): List the PHP modules of an image (may pull the image on first use)
- [loch hosting sites](https://docs.loch.sh/cli/reference/commands/loch-hosting-sites.md): List site directories and the stack using each
- [loch hosting templates](https://docs.loch.sh/cli/reference/commands/loch-hosting-templates.md): List the available templates and PHP versions
- [loch hosting update](https://docs.loch.sh/cli/reference/commands/loch-hosting-update.md): Change the settings of a hosted stack and redeploy it
- [loch inspect](https://docs.loch.sh/cli/reference/commands/loch-inspect.md): Display detailed information on a container
- [loch kill](https://docs.loch.sh/cli/reference/commands/loch-kill.md): Kill one or more containers
- [loch login](https://docs.loch.sh/cli/reference/commands/loch-login.md): Configure API token interactively
- [loch logs](https://docs.loch.sh/cli/reference/commands/loch-logs.md): Display container logs
- [loch networks](https://docs.loch.sh/cli/reference/commands/loch-networks.md): Manage the private networks between sites and services
- [loch networks attach](https://docs.loch.sh/cli/reference/commands/loch-networks-attach.md): Connect a site or a service instance to a network
- [loch networks config](https://docs.loch.sh/cli/reference/commands/loch-networks-config.md): Show the creation rules of the networks
- [loch networks create](https://docs.loch.sh/cli/reference/commands/loch-networks-create.md): Create a private network
- [loch networks delete](https://docs.loch.sh/cli/reference/commands/loch-networks-delete.md): Delete a private network without members
- [loch networks detach](https://docs.loch.sh/cli/reference/commands/loch-networks-detach.md): Disconnect a site or a service instance from a network
- [loch networks disconnect](https://docs.loch.sh/cli/reference/commands/loch-networks-disconnect.md): Disconnect a container the panel does not manage from a network
- [loch networks docker](https://docs.loch.sh/cli/reference/commands/loch-networks-docker.md): Show the other Docker networks (read-only)
- [loch networks ls](https://docs.loch.sh/cli/reference/commands/loch-networks-ls.md): List the networks
- [loch networks show](https://docs.loch.sh/cli/reference/commands/loch-networks-show.md): Show a network and its members
- [loch networks update](https://docs.loch.sh/cli/reference/commands/loch-networks-update.md): Change the description of a network
- [loch ns](https://docs.loch.sh/cli/reference/commands/loch-ns.md): List or switch namespace (Docker Compose stack)
- [loch proxy](https://docs.loch.sh/cli/reference/commands/loch-proxy.md): Forward local ports to a container via WebSocket tunnel (i.e. get container port 80 on port 8000 in your machine)
- [loch ps](https://docs.loch.sh/cli/reference/commands/loch-ps.md): List containers in the active namespace
- [loch restart](https://docs.loch.sh/cli/reference/commands/loch-restart.md): Restart one or more containers
- [loch rm](https://docs.loch.sh/cli/reference/commands/loch-rm.md): Remove one or more containers
- [loch services](https://docs.loch.sh/cli/reference/commands/loch-services.md): Manage services: databases, caches and message brokers
- [loch services create](https://docs.loch.sh/cli/reference/commands/loch-services-create.md): Create a database, cache or message broker resource (password shown once)
- [loch services delete](https://docs.loch.sh/cli/reference/commands/loch-services-delete.md): Delete a resource (database, vhost or dedicated instance)
- [loch services engines](https://docs.loch.sh/cli/reference/commands/loch-services-engines.md): List the engines and versions available on the endpoint
- [loch services expose](https://docs.loch.sh/cli/reference/commands/loch-services-expose.md): Publish the port of an instance on the host (admin, services:expose scope)
- [loch services instances](https://docs.loch.sh/cli/reference/commands/loch-services-instances.md): List the instances (shared: one per engine version; dedicated: one per resource)
- [loch services ls](https://docs.loch.sh/cli/reference/commands/loch-services-ls.md): List the resources (databases, vhosts, dedicated instances)
- [loch services networks](https://docs.loch.sh/cli/reference/commands/loch-services-networks.md): Replace the networks of an instance (it is recreated)
- [loch services purge](https://docs.loch.sh/cli/reference/commands/loch-services-purge.md): Delete an instance edited by hand, with its data
- [loch services reset-password](https://docs.loch.sh/cli/reference/commands/loch-services-reset-password.md): Generate a new password for a resource user (shown once)
- [loch services retire](https://docs.loch.sh/cli/reference/commands/loch-services-retire.md): Remove an empty instance (containers and data)
- [loch services unexpose](https://docs.loch.sh/cli/reference/commands/loch-services-unexpose.md): Close the published port of an instance (admin, services:expose scope)
- [loch services update](https://docs.loch.sh/cli/reference/commands/loch-services-update.md): Change the options of a dedicated instance (Redis, Valkey, NATS, S3, ElasticMQ, Mosquitto)
- [loch services updates](https://docs.loch.sh/cli/reference/commands/loch-services-updates.md): List the updates available for the dedicated instances
- [loch services upgrade](https://docs.loch.sh/cli/reference/commands/loch-services-upgrade.md): Update a dedicated instance to the latest image of its version, or to a newer version
- [loch sftp](https://docs.loch.sh/cli/reference/commands/loch-sftp.md): Manage SFTPGo users
- [loch sftp create](https://docs.loch.sh/cli/reference/commands/loch-sftp-create.md): Create an SFTP user
- [loch sftp delete](https://docs.loch.sh/cli/reference/commands/loch-sftp-delete.md): Delete an SFTP user
- [loch sftp disable](https://docs.loch.sh/cli/reference/commands/loch-sftp-disable.md): Disable an SFTP user
- [loch sftp enable](https://docs.loch.sh/cli/reference/commands/loch-sftp-enable.md): Enable an SFTP user
- [loch sftp reset-password](https://docs.loch.sh/cli/reference/commands/loch-sftp-reset-password.md): Reset an SFTP user's password
- [loch sftp sites](https://docs.loch.sh/cli/reference/commands/loch-sftp-sites.md): List hosted sites
- [loch sftp users](https://docs.loch.sh/cli/reference/commands/loch-sftp-users.md): List SFTP users
- [loch shell](https://docs.loch.sh/cli/reference/commands/loch-shell.md): Open an interactive shell in a container
- [loch stack](https://docs.loch.sh/cli/reference/commands/loch-stack.md): Start, stop or restart a whole Docker Compose stack
- [loch stack restart](https://docs.loch.sh/cli/reference/commands/loch-stack-restart.md): Restart every container of a stack
- [loch stack start](https://docs.loch.sh/cli/reference/commands/loch-stack-start.md): Start every container of a stack
- [loch stack stop](https://docs.loch.sh/cli/reference/commands/loch-stack-stop.md): Stop every container of a stack
- [loch start](https://docs.loch.sh/cli/reference/commands/loch-start.md): Start one or more containers
- [loch stats](https://docs.loch.sh/cli/reference/commands/loch-stats.md): Live resource monitoring for the active namespace
- [loch stop](https://docs.loch.sh/cli/reference/commands/loch-stop.md): Stop one or more containers
- [loch update](https://docs.loch.sh/cli/reference/commands/loch-update.md): Update loch to the latest version
- [loch use](https://docs.loch.sh/cli/reference/commands/loch-use.md): Switch active endpoint
- [loch users](https://docs.loch.sh/cli/reference/commands/loch-users.md): Manage users (admin)
- [loch users demote](https://docs.loch.sh/cli/reference/commands/loch-users-demote.md): Demote a user to restricted
- [loch users grant](https://docs.loch.sh/cli/reference/commands/loch-users-grant.md): Grant access to one or more services
- [loch users ls](https://docs.loch.sh/cli/reference/commands/loch-users-ls.md): List users
- [loch users promote](https://docs.loch.sh/cli/reference/commands/loch-users-promote.md): Promote a user to admin
- [loch users revoke](https://docs.loch.sh/cli/reference/commands/loch-users-revoke.md): Revoke access to one or more services
- [loch users rm](https://docs.loch.sh/cli/reference/commands/loch-users-rm.md): Delete a user
- [loch version](https://docs.loch.sh/cli/reference/commands/loch-version.md): Show loch version
- [MCP tools](https://docs.loch.sh/cli/reference/mcp-tools.md): Every tool of the loch MCP server, with its parameters, the API key scope it needs and whether it is admin only.

## Loch S3

- [Backup and restore](https://docs.loch.sh/s3/admin/backup.md): Back up the data directory, the users file and the master key of Loch S3, and restore them.
- [Production deployment](https://docs.loch.sh/s3/admin/production.md): Run Loch S3 behind a TLS reverse proxy in a hardened container, with a storage quota, health checks and connection limits.
- [Security](https://docs.loch.sh/s3/admin/security.md): Security checklist for a Loch S3 server and summary of the protections built into it.
- [Upgrade to 1.4.1](https://docs.loch.sh/s3/admin/upgrade.md): Upgrade a Loch S3 server to 1.4.1 and check the behavior changes that can affect existing clients and buckets.
- [Users and admin API](https://docs.loch.sh/s3/admin/users.md): Manage Loch S3 users with the users file, the loch-s3 CLI or the /_loch/users admin API.
- [Architecture](https://docs.loch.sh/s3/developer/architecture.md): How the Loch S3 code is organized and how buckets and objects are stored on disk.
- [Build and test](https://docs.loch.sh/s3/developer/build-and-test.md): Build the Loch S3 binaries and Docker image from source and run the test suite.
- [Access control](https://docs.loch.sh/s3/guides/access-control.md): Understand authentication modes, bucket ownership, canned ACLs and bucket policies in Loch S3.
- [Buckets and objects](https://docs.loch.sh/s3/guides/buckets-and-objects.md): Create buckets, upload and download objects, use metadata, presigned URLs, multipart uploads and versioning.
- [Connect a client](https://docs.loch.sh/s3/guides/connect-a-client.md): Configure the AWS CLI, an S3 SDK or Cyberduck to use a Loch S3 server with path-style URLs.
- [CORS](https://docs.loch.sh/s3/guides/cors.md): Allow web pages on other origins to call a Loch S3 bucket from the browser.
- [Encryption](https://docs.loch.sh/s3/guides/encryption.md): Encrypt objects at rest with SSE-S3 (server key) or SSE-C (client key), per request, per bucket or for every write.
- [Install](https://docs.loch.sh/s3/install.md): Run Loch S3 with Docker or as a binary, then create a first bucket with the AWS CLI.
- [Loch S3](https://docs.loch.sh/s3.md): Loch S3 is a self-hosted, S3-compatible object storage server written in Rust that stores objects on the local filesystem.
- [Admin API reference](https://docs.loch.sh/s3/reference/admin-api.md): Endpoints of the Loch S3 user management API (/_loch/users) and the service endpoints /_loch/health and /_loch/usage.
- [Bucket policy reference](https://docs.loch.sh/s3/reference/bucket-policies.md): Syntax, principals, actions, resources and evaluation rules of Loch S3 bucket policies.
- [Configuration reference](https://docs.loch.sh/s3/reference/configuration.md): Every environment variable of the Loch S3 server and of the loch-s3 CLI, with its default value.
- [Error codes](https://docs.loch.sh/s3/reference/errors.md): S3 error codes returned by Loch S3, with their HTTP status and the usual cause.
- [Limits](https://docs.loch.sh/s3/reference/limits.md): Size, time and connection limits enforced by Loch S3 1.4.1.
- [S3 API compatibility](https://docs.loch.sh/s3/reference/s3-api.md): Every S3 operation that Loch S3 supports, with its HTTP route, and the operations it does not support.

## Loch Lambda Runtime

- [Architecture](https://docs.loch.sh/lambda-runtime/developer/architecture.md): The layout of the Loch Lambda Runtime source code and the role of each package.
- [Build and test](https://docs.loch.sh/lambda-runtime/developer/build-and-test.md): Build loch-lambda-runtime from source and run its unit and integration tests.
- [Releases](https://docs.loch.sh/lambda-runtime/developer/releases.md): How a release is built reproducibly, described by an SBOM, signed with cosign and attested by GitHub.
- [Authentication](https://docs.loch.sh/lambda-runtime/guides/authentication.md): Protect the Invoke API with a bearer token stored as its SHA-256, a plain token or AWS SigV4, and rotate credentials without a restart.
- [Custom runtimes and images](https://docs.loch.sh/lambda-runtime/guides/custom-runtimes.md): Run a Go bootstrap on provided.al2023, pass any image's command after --, or build an image that contains the runtime.
- [Invoke a function](https://docs.loch.sh/lambda-runtime/guides/invoke.md): Invoke a function with curl and a bearer token, the AWS CLI or an AWS SDK with SigV4, or the invoke subcommand through docker exec.
- [Logs and metrics](https://docs.loch.sh/lambda-runtime/guides/logs-and-metrics.md): Read the function's START, END and REPORT log lines, switch them to JSON, check health and scrape Prometheus metrics.
- [Run in production](https://docs.loch.sh/lambda-runtime/guides/production.md): Run a function with credentials, a read-only non-root container, resource limits and a Docker healthcheck.
- [Troubleshooting](https://docs.loch.sh/lambda-runtime/guides/troubleshooting.md): Fix the common problems - refused startup, 403 behind a proxy, refused credential files, failing healthchecks, bootstraps that do not start.
- [Install](https://docs.loch.sh/lambda-runtime/install.md): Download the loch-lambda-runtime binary, verify its signature and provenance, and run a first Node.js function with the AWS base image.
- [Loch Lambda Runtime](https://docs.loch.sh/lambda-runtime.md): Run handlers written for AWS Lambda in plain Docker containers, with the AWS base images, behind a small static binary that implements the Runtime ...
- [Command line reference](https://docs.loch.sh/lambda-runtime/reference/command-line.md): The subcommands of loch-lambda-runtime (run, health, invoke, version), their options and exit codes.
- [Configuration reference](https://docs.loch.sh/lambda-runtime/reference/configuration.md): Every LOCH_RUNTIME_* setting with its flag and default, the function variables, and the environment the bootstrap receives.
- [Invoke API reference](https://docs.loch.sh/lambda-runtime/reference/invoke-api.md): The Invoke API endpoint, its headers, function results, error shapes and status codes.
- [Metrics reference](https://docs.loch.sh/lambda-runtime/reference/metrics.md): Every Prometheus metric served on /_loch/metrics, with its type and labels.
- [Security model](https://docs.loch.sh/lambda-runtime/reference/security-model.md): What the function's code, a network caller and a web page can and cannot do, and the protections that follow.

## Loch Queue Manager

- [Capacity and timeouts](https://docs.loch.sh/queue/guides/capacity.md): Choose how many visitors use the service at once, when an idle visitor loses their slot and how fast the queue moves.
- [Limits and troubleshooting](https://docs.loch.sh/queue/guides/good-to-know.md): What to know before production (in-memory state, abandoned places, reloads) and how to fix the common problems.
- [JSON clients and single-page apps](https://docs.loch.sh/queue/guides/json-api.md): Get the queue status as JSON instead of the HTML waiting page, from a single-page application or an API client.
- [Rate limit and client IP](https://docs.loch.sh/queue/guides/rate-limit.md): How the plugin limits requests without the queue cookie, which IP address it uses, and how to configure Traefik behind a proxy.
- [Waiting page and translations](https://docs.loch.sh/queue/guides/waiting-page.md): Replace the waiting page with your own HTML template and add or edit the languages it is shown in.
- [Install](https://docs.loch.sh/queue/install.md): Declare the plugin in the Traefik static configuration, give Traefik the waiting page files, then attach the middleware to a router.
- [Loch Queue Manager](https://docs.loch.sh/queue.md): A Traefik middleware plugin that caps the number of concurrent visitors of a service and puts the others in a first-come, first-served waiting room.
- [Configuration reference](https://docs.loch.sh/queue/reference/configuration.md): Every option of the Loch Queue Manager middleware, with its type, default value and validation rule.
- [JSON response reference](https://docs.loch.sh/queue/reference/json-response.md): Fields and headers of the JSON responses sent to queued and rate-limited clients.
- [Template reference](https://docs.loch.sh/queue/reference/template.md): Variables, function and translation keys available in the waiting page template.

## Loch Deploy

- [Configuration and hardening](https://docs.loch.sh/deploy/admin/configuration.md): Set the essential Loch Deploy variables and check the eleven deployment assumptions the security model depends on.
- [Operations](https://docs.loch.sh/deploy/admin/operations.md): Read the Loch Deploy audit log, back up its state and data, and upgrade the server.
- [Security model](https://docs.loch.sh/deploy/admin/security.md): Who Loch Deploy trusts, why it runs as root with the Docker socket, the residual risks and what never to do.
- [Architecture](https://docs.loch.sh/deploy/developer/architecture.md): The Go packages of deploy-server and the path of a request through its middleware and handlers.
- [Build and test](https://docs.loch.sh/deploy/developer/build-and-test.md): Build deploy-server and its container image from source and run the test suite.
- [Release process](https://docs.loch.sh/deploy/developer/release.md): How a deploy-server release is built and published - GHCR image, binaries, SBOM and provenance attestations.
- [Write a compliant compose file](https://docs.loch.sh/deploy/guides/compose-file.md): Write a docker-compose.yml that passes the Loch Deploy policy - names, bind mounts, env files, networks and Traefik labels.
- [Deploy from GitLab CI](https://docs.loch.sh/deploy/guides/gitlab-ci.md): Request an ID token in a GitLab CI job, create bind directories, deploy a compose stack, schedule an auto-stop and stop the stack.
- [Migrate from SSH deployment](https://docs.loch.sh/deploy/guides/migrate-from-ssh.md): Move stacks deployed over SSH to Loch Deploy - import ownership, stop the legacy stack, move data to the service/name layout and redeploy.
- [Troubleshooting](https://docs.loch.sh/deploy/guides/troubleshooting.md): Fix the common Loch Deploy errors seen in GitLab CI jobs - 400, 401, 403, 409, 5xx and silent failures.
- [Install](https://docs.loch.sh/deploy/install.md): Run Loch Deploy behind Traefik and a Docker socket proxy with the reference compose file, then check its health.
- [Loch Deploy](https://docs.loch.sh/deploy.md): Loch Deploy is a minimal HTTP server that lets GitLab CI pipelines deploy docker compose stacks with a short-lived OIDC token instead of SSH.
- [API reference](https://docs.loch.sh/deploy/reference/api.md): The Loch Deploy HTTP endpoints - health, deploy, stack, directories, exec - with their fields and status codes.
- [Configuration reference](https://docs.loch.sh/deploy/reference/configuration.md): Every Loch Deploy environment variable with its default and validation, the command-line flags and the fixed HTTP and docker limits.
- [Deployment policy](https://docs.loch.sh/deploy/reference/deployment-policy.md): Full list of the Loch Deploy compose policy rules, the validation steps of a deploy and the pre-deploy check of existing containers.
- [Stack key and layout](https://docs.loch.sh/deploy/reference/stack-key-and-layout.md): How Loch Deploy derives the stack key from the token, where it stores compose files, data and state, and the registry.json and autostop.json formats.