English | 简体中文

octopus-agentos — one-click remote dev-and-ops platform (Cloud Marketplace image)

From a single Packer source, build an AWS / Azure Marketplace-compliant image off Ubuntu LTS. Once deployed it's a browser VS Code + five AI CLIs remote dev-and-ops box with zero setup barrier. Positioning: docs/product-positioning.md.

Part of Octopus Core — the distribution form of the open infrastructure stack for governed AI. The Community edition brings all eight open Octopus modules into the image (the open ecosystem environment) — Evidence · Observe · Experience · Runtime · Replay · Inspect · Scout · Blackboard — and you wire/integrate them yourself.

Editions: Community vs Commercial

The driver is operational trust and accountability, not a regulatory mandate: the more autonomous your agents get, the more your team needs to prove — to itself, its customers, and its board — what the agents did and why, with or without a law. We treat ISO/IEC 42001 (voluntary, international, procurement-driven) as the international anchor; the EU AI Act / NIST AI RMF only as "if you sell into those markets, this aligns too."

Principle: we do not lock features, we sell operations. The core capability is fully open; organisations pay to run, manage, and be supported at organisational scale. This is classic open-core (in the tradition of GitLab / Grafana).

	Community	Commercial
In one line	Everything required to build and run a governed AI system yourself.	Everything required to operate governed AI systems across an organisation.
License	Apache-2.0	Commercial
Form	This repo's AgentOS self-host image + the open Octopus Core packages, in your VPC	Multi-tenancy, SSO/RBAC, enterprise policy center, centralized Evidence Vault, audit retention, compliance reporting, enterprise dashboard, SaaS/hosted, SLA, commercial support
You pay for	Nothing (cloud compute only)	Operations at org scale, and support

Nothing a self-hoster needs to build, run, govern, and prove an AI system sits behind the commercial line. See docs/EDITIONS.md · the engineering seam map docs/OPEN-CORE-SEAMS.md · the commercial spec (planned) docs/COMMERCIAL.md.

Platform capabilities

• All eight open Octopus modules in the image (Apache-2.0, the open ecosystem environment — the Community edition brings them in; you integrate them yourself, they are not auto-wired): octopus-evidence · octopus-observe · octopus-experience (bin octomem, plus octopus-experience-mcp) · octopus-runtime · octopus-replay · octopus-inspect · octopus-scout (plus octopus-scout-mcp) · octopus-blackboard (bins octoboard / blackboard / octopus-blackboard-mcp, wired to the CLIs by step 14). Manifest: config/octopus-modules.env
• Five AI CLIs: claude · codex · gemini · grok · cursor-agent (on the global PATH)
• Shared blackboard: Octopus Blackboard as the multi-agent coordination layer — all five CLIs join one board over MCP out of the box: who's changing what, and every decision / risk / handoff, tamper-evident and replayable
• Browser VS Code: code-server + preinstalled AI extensions + one-click tasks to launch each CLI and the board
• Keyless AI on AWS Bedrock: attach an IAM role and call Bedrock with the instance identity (one-switch octopus-setup bedrock on for Claude Code + a generic bedrock CLI); data never leaves your AWS account
• Secrets via the customer's KMS: octopus-secrets pluggable backends (secretsmanager / ssm / kms-file / env); plaintext lives only in an in-memory tmpfs, never on disk; cost and backend are the customer's choice (see docs/security.md)
• Cost-aware hardening: UFW allows only 22/443 by default, Caddy security headers, SSH hardening; heavier items via octopus-harden on demand
• One-click ready: Caddy automatic HTTPS + a random password generated on first boot; octopus-setup injects API keys
• Zero-barrier ops: docker/kubectl/git/psql preinstalled, passwordless sudo, direct reach inside your VPC's private network
• Compliance: the image contains no secrets; keys are injected after deployment

Layout

packer/    aws.pkr.hcl / azure.pkr.hcl / variables.pkr.hcl (with file uploads of config/)
scripts/   00-base → 10-install(release+EULA) → 11-ai-clis → 12-vscode-server → 13-platform
           → 14-blackboard → 14b-octopus-modules → 15-bedrock → 16-secrets → 17-security
           → 20-cloud-init → 30-harden → 90-cleanup/deprovision
config/    ai-clis.env · octopus-modules.env · vscode/ · code-server.yaml · caddy/ · systemd/ · bin/ · profile.d/
test/      image self-check (during build, FAIL aborts) · smoke-test.sh (post-deploy)
docs/      positioning · requirements matrix · test runbook · both marketplace listing guides

Quick start

brew install packer            # or see the HashiCorp install docs
make init                      # install packer plugins
make fmt                       # validate templates
make check                     # release gate: source preflight + Packer validate + shellcheck

# Configure each cloud's credentials (AWS: env vars / profile; Azure: az login)
make aws     OS_VERSION=octopus-agentos-1.0.0
make azure   OS_VERSION=octopus-agentos-1.0.0 AZ_SUBSCRIPTION_ID=...

Path to listing

1. Run make check to verify package/script sources, Packer templates, and shell scripts.
2. Pin / verify the module and CLI package versions in config/octopus-modules.env and config/ai-clis.env when you need a reproducible marketplace build; leave *_VER empty to track latest.
3. Build with make aws / make azure — the built-in self-check catches common rejection reasons.
4. Submit per docs/aws-listing-guide.md / docs/azure-listing-guide.md.

Compliance details: docs/requirements-matrix.md.

Release readiness

• Source preflight for the five AI CLIs, two installer URLs, Blackboard, and the seven other open Octopus modules (make preflight)
• Bring the open Octopus modules into the image — done: all eight Apache-2.0 modules are installed (blackboard in step 14, the other seven in step 14b); the Community edition is the open ecosystem environment and you integrate them yourself (not auto-wired)
• Integrate Octopus Blackboard (shared board + MCP config for the five CLIs)
• EULA / bundled-license docs (docs/EULA.txt, docs/LICENSES.txt)
• Draft listing copy and marketplace guides (docs/listing-content.md, docs/aws-listing-guide.md, docs/azure-listing-guide.md)
• Marketplace media assets: final logo and screenshots
• Each cloud's build credentials (AWS profile / az login)
• First real-hardware build verification: after make aws, launch an instance and run through "open browser → enter password → use a CLI"; see docs/testing-runbook.md