Skip to content
Tabby Coding Assistant AI Agents · Tabby v0.32.0 Launch on AWS

Operations

This page covers running Tabby Coding Assistant day to day: how it is secured, how to manage the services, where the logs are, how it is updated, what to back up, and how to get help.

Security model

  • Loopback only. Tabby listens on 127.0.0.1:8080 and the embedding stub on 127.0.0.1:18080. Nothing is reachable from the network.
  • No authentication on the API. Anyone who can reach port 8080 can use it. Keep it on loopback, or put your own authenticated reverse proxy in front.
  • Unprivileged, sandboxed services. Both services run as the tabby system user with no capabilities, NoNewPrivileges, a private /tmp, and a read-only view of the system. Tabby can write only to /var/lib/tabby.
  • Private state. /var/lib/tabby is mode 0700. The ubuntu user cannot read the configuration or any keys in it.
  • No baked secrets or weights. The image contains no model weights, provider keys or passwords.
  • SSH. Password authentication and root login are turned off.
  • No AWS access. Tabby does not call AWS APIs and needs no IAM permissions beyond AmazonSSMManagedInstanceCore for Session Manager.

Manage the services

Unit What it does
sushi-tabby-firstboot.service Creates /var/lib/tabby, config.toml and tabby.env if they are missing. Runs at every boot before the other two.
sushi-tabby-embed.service The loopback embedding stub on port 18080.
tabby.service The Tabby server on port 8080. Requires both units above. 
sudo systemctl status tabby sushi-tabby-embed --no-pager
sudo systemctl restart tabby

Both long-running services restart automatically if they fail.

Logs

The services log to the systemd journal:

sudo journalctl -u tabby --no-pager -n 100
sudo journalctl -u sushi-tabby-embed --no-pager -n 50
sudo journalctl -u sushi-tabby-firstboot --no-pager

Updates

  • Ubuntu packages get security updates automatically through unattended upgrades.
  • Tabby is pinned at v0.32.0 under /opt/tabby/bin. A new Tabby release comes as a new version of the AMI: launch it, restore your backup, and move your users over. A new AMI version does not update running instances.

Backups

Back up these paths together after you add models or change the configuration:

  • /var/lib/tabby, including config.toml and any downloaded models.
  • /etc/tabby.

Stop Tabby while you copy /var/lib/tabby so its files are consistent:

sudo systemctl stop tabby
sudo tar -czf /root/tabby-backup.tar.gz /var/lib/tabby /etc/tabby
sudo systemctl start tabby

Copy the archive off the instance and keep it private: it contains any keys in config.toml. The root volume is the only disk. There is no separate data volume.

Check the installation

The image includes a self-test that runs as root. It checks that the services started on their own at boot, that both listeners are on loopback only, that the configuration is not readable by ubuntu, that /v1/health answers, that completions are refused without a model, and that the embedding stub answers. It then restarts Tabby and waits for it to be healthy again:

sudo /opt/sushi/bin/smoke.sh

The self-test expects the default configuration. After you attach a completion model or replace the embedding stub, it reports a failure even though Tabby is working. Use /v1/health and a real request instead.

Support

Software Sushi provides AMI packaging and setup guidance. Email info@softwaresushi.com with installation questions. Support coverage beyond that requires a separate agreement. This offer does not include TabbyML support or Tabby Enterprise features.

Last updated October 13, 2026 · Suggest an improvement