Getting started¶
Launch Chroma, run the sample collection, and repeat the read-only check after a restart.
You need: an AWS account that can subscribe on AWS Marketplace, launch EC2, and open Session Manager. To forward the API to your workstation, install the AWS CLI and the Session Manager plugin. An SSH tunnel is the other path the published guide names.
1. Subscribe¶
Open the Chroma Vector Database listing, choose View purchase options, review the terms, and subscribe. When the subscription is active, choose Launch your software.
2. Launch the instance¶
On the EC2 launch page:
- Choose t3.medium (4 GiB of memory) or larger.
- Under Configure storage, use an encrypted gp3 root volume of at least 32 GiB.
- Require IMDSv2.
- Attach an IAM instance profile that includes
AmazonSSMManagedInstanceCoreif you use Session Manager. - Leave inbound application ports closed.
- Choose Launch instance.
There is no application password. Anyone who can log in to the instance can
reach the API on 127.0.0.1:8000.
3. Connect¶
Session Manager starts as ssm-user. In the
EC2 console, choose Connect, then
Session Manager, then Connect. Or:
Wait for cloud-init, then run the walkthrough as ubuntu:
4. Run the walkthrough¶
The demo creates one collection and writes three explicit two-dimensional vectors, with documents and metadata. It does not download or call an embedding model. You supply embeddings in your own requests. Turning on a default embedding function changes what the instance needs to download and run. Leave that function off.
A separate HTTP reader checks the stored vectors and the count, then queries
[0.95, 0.05]. The expected nearest ID is alpha, with squared L2 distance
0.005. Results are under ~/chroma-results/. Keep the manifest path the
demo prints.
5. Reach the API¶
Forward port 8000 to your workstation, or use an SSH tunnel to the same port. Point clients at the forwarded address. There is no browser UI.
aws ssm start-session --target <instance-id> \
--document-name AWS-StartPortForwardingSession \
--parameters '{"portNumber":["8000"],"localPortNumber":["8000"]}'
Do not forward the port onto a network you do not trust. Local users on the
instance can already call 127.0.0.1:8000. The selected server does not
implement application authentication.
6. Read the saved result¶
After a service restart or a reboot, repeat the read-only check. Replace the directory name with the one the demo printed. This command does not write a new collection.
Next, see Configuration for the listener and the backup paths. Support is info@softwaresushi.com.
Last updated October 27, 2026 · Suggest an improvement