Self-hostedTalon Studio v1.0.2-beta
Deployment Options
Talon Studio is software you run yourself: one container image and one /data volume, on a host you own, a rented VM, or a Kubernetes cluster. Every route ends in the same appliance.
Where it can run
Talon Studio ships as one appliance image. The product is identical wherever it runs — the routes below differ only in what you already have.
There is no hosted edition
Talon Labs does not run Talon Studio for anyone, and holds none of your detections, log samples or SIEM credentials. Every route on this page ends in your own appliance, in your own account.
Which one is right?
You have a Linux host — Docker Compose. It is the simplest thing that works, and everything else in these docs assumes it.
You have no hardware — a small cloud VM with the bootstrap. A 2 vCPU / 4 GB VM is enough, and costs a few euros a month at the cheaper providers.
Your policy says workloads run in a cluster — the Helm chart, or the Terraform Kubernetes stacks. For one appliance a cluster buys node repair and little else, at several times the cost.
You are air-gapped — any of the above. A Community key verifies offline; move the image across with docker save, and turn off the content sync and update check. Offline and air-gapped has the steps.
Nothing forks
Every route runs the identical image, so detections, Git history and the API are the same on all of them. Moving between them is moving the /data volume — plus the encryption key, if you set it yourself rather than letting the appliance generate it onto the volume.
What every option needs
A process that stays running. Content sync and the other background loops run inside the app between requests. A platform that freezes or scales the process to zero between requests — a serverless or function runtime — does not work.
A disk that survives a restart, mounted at /data. Without it every restart starts from an empty database and loses the detection repos with it. 20 GB is a comfortable start.
One instance per volume. No replicas: migrations take no lock.
TLS in front. The container serves plain HTTP on port 3000; terminate TLS at a proxy, load balancer or the platform's router.
Your Community key, from your Talon Labs account. The appliance shows only the key screen until it has one.
Kubernetes and Helm
The chart is served from a plain HTTPS Helm repository on this site — an index and a tarball, with no registry login. It is an advanced route: for a single appliance the Docker path is still the recommended one.