Install The Face SDK Prod Edition

System Requirements

	Minimum
Operating system	Linux x86_64 with AVX2 (Ubuntu 22.04 or newer, Debian 12, RHEL 9 or similar)
Docker	Docker Engine with the Compose plugin, run as root (sudo)
Memory	4 GB, plus about 2 KB for each stored face template
Disk	2 GB for the CPU image, 6 GB for the NVIDIA image, plus your data
NVIDIA GPU (optional)	Driver 535 or newer and the NVIDIA Container Toolkit
Intel GPU (optional)	Access to /dev/dri
Cameras (optional)	RTSP or RTSPS (H.264 or H.265)

Pick an image for your hardware:

Image	Hardware
<ver>-prod-cpu	Any x86_64 CPU with AVX2
<ver>-prod-openvino	Intel CPU and integrated GPU
<ver>-prod-cuda	NVIDIA GPU

[CONFIRM] Where Prod customers pull the image from (registry address and how they get access) is set at release.

Option 1: One Command

The same command as the Demo, with your Prod licence key and a Prod image:

sudo docker run -d --name face-sdk --restart unless-stopped -p 8080:8080 \
  -e ARSA_LICENCE_KEY=<your key> \
  -v face-data:/data \
  -v /sys:/host/sys:ro -v /etc/machine-id:/host/etc/machine-id:ro \
  <registry>/face-sdk:<ver>-prod-cpu

On NVIDIA add --gpus all and use the -prod-cuda image; on an Intel GPU add --device /dev/dri and use -prod-openvino. Then read sudo docker logs face-sdk and continue with First Run.

This runs the API, the dashboard and camera recognition. Live camera video in the dashboard needs a media server next to it: use option 2.

Option 2: Docker Compose (Install Bundle)

The install bundle holds the compose files, an install script and the release’s checksums and signature key.

1. Unpack the bundle and run the installer from its folder:

   NF_LICENSE_KEY=<your key> ./scripts/install.sh prod cpu   # or: prod openvino | prod cuda

   The script checks the host and the bundle against its checksums, prepares the licence for this machine once (with sudo), pulls the image by digest, checks its signature when cosign is installed (a failed check stops the install) and starts it. Settings are kept in compose/.env.

2. For live camera video, add the address browsers use to reach the server:

   NF_PUBLIC_HOST=192.168.10.20 NF_LICENSE_KEY=<your key> ./scripts/install.sh prod cpu

   Open UDP port 8000 to the browsers that watch video. See Live Video.

Ports

Port	Protocol	Used for
8080	TCP	API and dashboard
8000	UDP	Live camera video (Compose install with video only)

The licence check-in needs outbound HTTPS to ARSA’s licence server, unless the licence was activated offline (see Licensing).

Network

Inside the container the server listens on all its interfaces, port 8080. -p 8080:8080 publishes that port on every address of the host, so the API and dashboard answer on any IP the server has.

• To publish on one address only, name it in the port mapping, for example -p 192.168.10.20:8080:8080.
• Behind a reverse proxy on the same machine, publish on the loopback address only: -p 127.0.0.1:8080:8080.
• Docker writes its own firewall rules: a host firewall such as ufw does not block a published port. Restrict access with the address in the port mapping or with Docker’s DOCKER-USER chain.
• Outbound, the server needs HTTPS to ARSA’s licence server for activation and check-ins (not after an offline activation). Nothing else connects in or out, except cameras you add and webhooks you configure.
• Live video (Compose install) also needs NF_PUBLIC_HOST, the one address browsers use to reach the server, and UDP 8000 open to them.

Serve It Over HTTPS

The container speaks plain HTTP. For anything beyond a local test, put it behind a reverse proxy with TLS (for example nginx or Caddy) and start the container with -e NF_SECURE_COOKIES=1, so the dashboard’s session cookie is only sent over HTTPS.

Settings

Variable	Default	Meaning
ARSA_LICENCE_KEY	(none)	Licence key, activated at the first start
NF_WORKERS	half the CPU cores, 1 on a GPU	Parallel analysis jobs
NF_SECURE_COOKIES	0	1 behind HTTPS
NF_LICENCE_SERVER	ARSA’s	off on a machine activated offline
NF_LOG	info	Log level