Skip to content
AnythingLLM RAG Workbench AI Platform & Data · AnythingLLM v1.17.0 Launch on AWS

Operations

This page covers running AnythingLLM day to day: how it is secured, how to manage the service, where logs go, what to back up, how updates work and how to get help.

Security model

  • Loopback only. The container publishes port 3001 on 127.0.0.1. Nothing listens on a public interface.
  • Password. The UI requires the admin password. A wrong password is refused.
  • Per-instance secrets. The password and the signing secrets are created on first boot. The image contains none of them, no documents and no provider keys.
  • File permissions. The ubuntu user cannot read server.env or the password file. The storage directory belongs to the container's user (UID 1000) with mode 0700.
  • Container hardening. The container runs with all Linux capabilities dropped, no-new-privileges and a process limit.
  • No telemetry. DISABLE_TELEMETRY=true.

Keep the security group closed to inbound traffic, and connect with Session Manager or SSH restricted to your administrative range.

Manage the service

sudo systemctl status anythingllm
sudo systemctl restart anythingllm
sudo systemctl stop anythingllm

Check that AnythingLLM answers:

curl -sS http://127.0.0.1:3001/api/ping

The first-boot service, sushi-anythingllm-firstboot, runs before AnythingLLM on every boot. It creates the password and secrets only if they are missing.

Logs

The container's output goes to the systemd journal:

sudo journalctl -u anythingllm -n 100 --no-pager
sudo journalctl -u sushi-anythingllm-firstboot --no-pager

Backups

Back up these together, over a private channel:

  • /var/lib/anythingllm/ (documents, settings, database, vectors and the provider keys you entered)
  • /etc/anythingllm/ (password and signing secrets)

Stop the service first so the data is consistent:

sudo systemctl stop anythingllm
sudo tar -czf /root/anythingllm-backup.tar.gz /var/lib/anythingllm /etc/anythingllm
sudo systemctl start anythingllm

Move the archive off the instance, or take an EBS snapshot instead. Restore with the same ownership: /var/lib/anythingllm belongs to UID and GID 1000, /etc/anythingllm to root. The archive contains your documents and keys: keep it private.

Updates

  • Ubuntu packages, including Docker and OpenSSL, receive unattended security updates.
  • AnythingLLM itself is not updated by apt, and you should not pull a new container image. A new AnythingLLM release comes as a new version of the image. There is no in-place upgrade: launch the new version, restore /var/lib/anythingllm and /etc/anythingllm, and switch your users to the new instance.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with your product version and the steps you took. Never include the password, provider keys or private documents. Guaranteed response times require a separate agreement. Mintplex Labs and Google support are not included.

Last updated October 13, 2026 · Suggest an improvement