agent-governance-toolkit Docker & Self-Hosted Deployment

GitHub

AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents.

5,840 stars Python Python 1 file · ~13,301 tokens #agent-framework#ai-agents#ai-safety#compliance#governance#microsoft#owasp#policy-engine
RAW Compose
1. Pull Image (DOCKERHUB) docker pull microsoft/agent-governance-toolkit
2. Docker Run (1-Click Launch) docker run -d --name agent-governance-toolkit -p 8501:8501 --restart always microsoft/agent-governance-toolkit:latest
3. Podman Run podman run -d --name agent-governance-toolkit -p 8501:8501 --restart always microsoft/agent-governance-toolkit:latest
4. Skopeo Inspect (Zero-Pull Manifest) skopeo inspect docker://docker.io/microsoft/agent-governance-toolkit:latest
5. ORAS Pull (OCI Artifact) oras pull microsoft/agent-governance-toolkit:latest
6. Compose Deployment docker compose up -d
docker-compose.yml
Download .yml 
services:
  dev:
    build:
      context: .
      target: dev
    command: ["sleep", "infinity"]
    init: true
    stdin_open: true
    tty: true
    # Match the host UID/GID so files created inside the bind-mounted
    # workspace land with host ownership (not root). Override on the host
    # with `HOST_UID=$(id -u) HOST_GID=$(id -g)` if your IDs differ.
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    working_dir: /workspace
    volumes:
      - .:/workspace
      - typescript_node_modules:/workspace/agent-governance-typescript/node_modules

  test:
    build:
      context: .
      target: test
    command: ["bash", "/workspace/scripts/docker/run-tests.sh"]
    init: true
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    working_dir: /workspace
    volumes:
      - .:/workspace
      - typescript_node_modules:/workspace/agent-governance-typescript/node_modules

  dashboard:
    profiles: ["dashboard"]
    build:
      context: .
      target: dev
    command:
      - streamlit
      - run
      - agent-governance-python/agent-hypervisor/examples/dashboard/app.py
      - --server.address=0.0.0.0
      - --server.port=8501
    init: true
    # Match the host UID/GID so any files Streamlit writes back to the
    # bind-mounted workspace are owned by the host user, not root.
    user: "${HOST_UID:-1000}:${HOST_GID:-1000}"
    ports:
      - "8501:8501"
    working_dir: /workspace
    volumes:
      - .:/workspace
      - typescript_node_modules:/workspace/agent-governance-typescript/node_modules

volumes:
  typescript_node_modules: