Skip to content

Operations

This page covers the security model, service management, backups, upgrades and support for Agent Zero Core.

Security model

  • The web UI is published only on 127.0.0.1:5080. Reach it through an SSH or Session Manager tunnel, never through the security group.
  • The container runs as UID/GID 10000:10000 with a read-only root file system, all Linux capabilities dropped and privilege escalation blocked. It has no access to the host Docker socket or home folders.
  • No provider key, bot token or account is baked into the image.
  • Settings and plugin state contain secrets. They are protected by file permissions, not by a separate application-level vault. EBS encryption and file permissions are both your controls.
  • Your model provider receives the prompts and tool context the agent sends. Telegram receives messages only if you turn it on.
  • Use a separate instance for each trust domain.

Service

agent-zero-core.service runs the sushi-agent-zero-core container and starts it on boot. If the container fails, systemd restarts it.

sudo systemctl is-active agent-zero-core.service
sudo systemctl show agent-zero-core.service -p ActiveState -p SubState -p NRestarts
sudo journalctl -u agent-zero-core.service --no-pager -n 50

Restart it with:

sudo systemctl restart agent-zero-core.service

Do not start a second container to work around a failing service.

Backups

All of your data is in /var/lib/agent-zero-core/usr: settings, model configuration, projects and plugin state, including Telegram. Treat it as secret.

For a consistent backup, wait for running tasks to finish, then:

sudo systemctl stop agent-zero-core.service
# Take and verify your backup, for example an EBS snapshot.
sudo systemctl start agent-zero-core.service

Keep the 10000:10000 ownership and 0700 mode when you restore. Backups contain credentials and your content: restrict access to them, and test a restore on a separate instance. State survives service restarts. It does not survive instance termination or deletion of the EBS volume.

Do not copy state from the full Agent Zero workbench into Core.

Upgrades

A new AMI version does not update running instances. To upgrade:

  1. Launch the new version on a separate instance.
  2. Restore only the state you need from a protected backup.
  3. Repeat the test task, and the Telegram check if you use it.
  4. Switch over. Keep only one instance polling the bot at a time.
  5. Keep the old instance and its backup until the new one is verified.

Costs

Stop instances you are not using to stop software and compute charges. Retained EBS volumes and snapshots still cost money. Watch your model provider's usage and quotas separately.

Licenses

Agent Zero is MIT-licensed. Its license notice is at /opt/sushi/licenses/agent-zero-core-LICENSE.

Support

Software Sushi provides AMI packaging and setup guidance at info@softwaresushi.com. Include the product version, sanitized steps to reproduce and the kind of error. Never send provider keys, bot tokens, configuration files or your files. Guaranteed response times need a separate agreement. Model provider credits and upstream Agent Zero support are not included.