Skip to content
Aider AI Pair Programmer AI Agents · Aider 0.86.2+sushi.2 Launch on AWS

Operations

This page covers running Aider AI Pair Programmer day to day: how it is secured, how it is updated, what to back up, and how to get help.

Security model

  • No listening ports. Aider is a command-line tool you start yourself. The image adds no web UI, background service or network listener.
  • No baked secrets. The image contains no provider key, password or private key. You add your key after launch.
  • Restricted secrets directory. /etc/aider/secrets is root:aider, mode 0750. The ubuntu user is not in the aider group and cannot read it.
  • SSH. Password authentication and root login are turned off.
  • No AWS access by default. Aider does not call AWS APIs unless you choose a Bedrock model. Attach only AmazonSSMManagedInstanceCore until you need more.
  • Your code goes to your provider. When you chat, Aider sends the files and repository map it needs to the model provider you chose. Check that provider's data policy before you use it with private code.

First-boot service

sushi-aider-firstboot.service runs once at boot. It creates /etc/aider/aider.conf.yml, /etc/aider/secrets and the sample workspace. It leaves existing files unchanged. There is no Aider service to start or stop.

systemctl status sushi-aider-firstboot --no-pager
sudo journalctl -u sushi-aider-firstboot --no-pager

Updates

  • Ubuntu packages get security updates automatically through unattended upgrades.
  • Aider and its Python dependencies are pinned in /opt/aider/venv. A new Aider release comes as a new version of the AMI: launch it, move your repositories over, and retire the old instance. A new AMI version does not update running instances.

Do not upgrade Aider in place

Installing a different Aider version into /opt/aider/venv replaces the tested, pinned build. Launch a new version of the AMI instead.

Backups

Your work lives in git repositories on the root volume, such as /var/lib/aider/workspace and anything you cloned under /home/ubuntu.

  • Push your branches to your git host often. That is the simplest backup.
  • Snapshot the root volume if you also need local state, such as Aider's .aider* chat history files.
  • Keep a copy of /etc/aider/aider.conf.yml if you changed it.

The root volume is the only disk. There is no separate data volume.

Check the installation

The image includes a self-test that runs as root. It checks the pinned Aider build, the workspace and secrets permissions, that no provider key is set, the offline repository tools, and one chat with a stand-in model on 127.0.0.1:

sudo /opt/sushi/bin/smoke.sh

Run it from a shell with no provider key exported: it stops if OPENAI_API_KEY, ANTHROPIC_API_KEY or OPENROUTER_API_KEY is set. It expects the sample hello.py to be unchanged.

Support

Software Sushi provides installation and configuration guidance for this image. Email info@softwaresushi.com with your product version and the steps you took. Never send credentials or private code. Guaranteed response times require a separate agreement. This offer does not include support from the Aider project.

Last updated October 13, 2026 · Suggest an improvement