Self-Hosted Production on Linux

Run Engine in a Docker container on a GPU Linux host. Schedule batch execution with systemd while keeping models, outputs and credentials outside the image.

Prepare the Linux host

Adapt these steps to your host configuration. This guide runs the Engine Python library in Docker and schedules it with systemd.

Provision resources

1. Select a supported Linux host and compatible GPU stack using Linux setup.
2. Install Docker and the NVIDIA Container Toolkit.
3. Create separate directories for local SSD scratch, retained models and prediction outputs.
4. Assign a service account to operate the job and a non-root container UID with access to the required mounted directories.

Size compute and storage

1. Use GPU sizing to select CPU, RAM and local SSD capacity for one job. For 100 GiB of source Parquet, the guidance recommends 32 vCPUs, at least 150 GiB RAM and 400 GiB free scratch, increasing to 800 GiB for graphs with many edges.
2. Select GPU memory for your model and measure peak use with representative data. The source-data sizing estimates do not specify GPU memory requirements.
3. Place scratch on local SSD and retain models and accepted outputs in durable storage. Network storage and cloud block volumes are not supported as Engine working storage.
4. Size concurrent jobs for their combined resource use. Additional workers do not automatically distribute one Engine graph.

Configure access

1. Provide connectivity to the approved package index, source data, artifact storage and tracking endpoints. For restricted environments, stage dependencies through your organization’s package and image repositories.
2. Configure workload identity or read-only credential mounts. Keep secrets outside the image and command-line arguments.
3. Grant the container UID read access to models and write access to scratch and output directories.
4. Configure backups and retention for models, accepted outputs and acceptance records.

Build the job image

1. Select a CUDA/Python base compatible with the approved Engine build.
2. Install that Engine build with the extras for your sources and tracking. For example, use kumo-engine[s3,mlflow] for S3 and MLflow, or kumo-engine[gcs,mlflow] for GCS and MLflow. For local files without MLflow, install kumo-engine.
3. Include required text embedding packages or custom assets used during training.
4. Copy predict_batch.py and its graph/query modules into the image. Set the entrypoint to run the script.
5. Record the image digest and dependency versions. Run the import and GPU checks from the Linux setup guide inside the container.

Prepare the model and prediction script

1. Select an evaluated model and retain its complete bundle, exact version and required text embedding assets. Store these outside temporary scratch. See Publish and Retrieve Models.

2. Move the working prediction code into predict_batch.py, including imports, connector setup, graph definitions and predictive-query definitions. The production script illustrates the structure; adapt its connectors to your data sources.

3. Supply the following inputs through your script arguments or job configuration:

   Input	Value
   Model	Exact accepted registry version or bundle path
   Data	Source tables and recorded source version or retained snapshot
   Prediction time	Fixed UTC anchor for temporal queries; omitted for static queries
   Batch identifier	One identifier for the scoring request, retained across retries
   Attempt destination	A separate output table or path for each attempt
   Scratch	Writable node-local SSD directory

   These are application inputs, not built-in Engine CLI flags. A model bundle does not contain the source data or graph snapshot.

4. Load the model and build or reload the intended snapshot. Regenerate the prediction population for the batch.

5. Call Trainer.predict inside the Kumo MLOps context to retain prediction records for monitoring. Configure a durable artifact root and the tracking destination for your environment.

6. Export predictions to the attempt destination. Check the saved keys, population and task-specific row counts before making the output available to the application.

Run the container

1. Replace the image and mount paths below with your deployment values. The image entrypoint runs predict_batch.py; the final arguments are defined by that script.

   docker run --rm --gpus all \
     --mount type=bind,src=/srv/kumo/scratch,dst=/scratch \
     --mount type=bind,src=/srv/kumo/models,dst=/models,readonly \
     --mount type=bind,src=/srv/kumo/outputs,dst=/outputs \
     --env KUMO_SCRATCH=/scratch \
     your-registry/engine-job:validated \
     --prediction-time 2026-11-01T00:00:00 \
     --output-table scores_attempt_001

2. Adapt the output argument for file-based delivery. Supply the intended batch anchor and a new attempt destination on each invocation.

3. Restrict GPU visibility to the assigned device when sharing a host.

4. Review the container exit status, logs, saved output and tracking records. Retained models and accepted outputs must remain available after container removal.

Configure systemd scheduling

1. Create a wrapper that determines the logical batch, allocates an attempt destination and runs the container. Have it propagate the container exit code and publish output only after validation.
2. Create a systemd oneshot service with the wrapper’s absolute path in ExecStart, a dedicated service account, a timeout and an OnFailure handler connected to your alerting system.
3. Store non-secret configuration in an EnvironmentFile. Prevent overlapping runs through the service or a lock.
4. Create a timer with OnCalendar in the agreed timezone. Enable Persistent only when the wrapper handles missed batches.
5. Start the service manually and review its exit status and journal. Complete the checks below before enabling the timer.

For bare-metal execution, run the same script in a pinned virtual environment. For Kubernetes, adapt it to a GPU Job/CronJob with secrets, durable artifact access and node-local scratch appropriate to that environment.

Run the job before scheduling

1. Run the job from a fresh runtime with the intended execution identity.
2. Review terminal job status, saved predictions and tracking records. Read the saved output through the application’s access path.
3. Measure peak RAM, GPU memory, scratch use and job duration on representative data. Adjust capacity before increasing concurrency.
4. Test an interrupted run and retry before publishing its output. Keep the same model, data version, population and prediction anchor across attempts. Accept only one output for each logical batch.
5. Test rollback to the previous model version and accepted output.

Schedule predictions and monitor results

1. Schedule the job after the upstream data refresh, or configure a dependency on the refresh task.
2. Record the model version, data or snapshot version, prediction anchor, batch identifier, accepted output location and job status together.
3. Configure operational alerts for failed jobs and missed freshness deadlines. Track job duration, resource use and requested, scored and skipped rows.
4. Compute score drift from retained Kumo prediction records. Evaluate model performance when labels become available and the prediction outcome window has completed.
5. Export monitoring results to governed tables and configure their refresh schedule, alert thresholds and responsible operator.

Job logs describe execution health; drift and labeled outcomes describe model behavior. Investigate data freshness and population changes before deciding to retrain. Registry-native scoring may use a different monitoring path from jobs calling Trainer.predict inside Kumo MLOps.

For output delivery, keep each attempt separate until validation succeeds. Publish the accepted location once per batch and retain the previous accepted output on failure. See Schedule Prediction Jobs.

Promote and refresh models

1. Train and register a candidate without changing the production alias.
2. Compare the candidate with the current model using the same evaluation population and outcome definition.
3. Run the candidate in the production job environment, then promote the accepted version. Record the exact version used for each prediction batch.
4. Retain the previous model, embedding assets and runtime configuration. To roll back, select that version for subsequent jobs and restore the previous accepted output where needed.

See Refresh a Model for refresh cadence and evaluation guidance.

Assign ISV operating responsibilities

1. Assign the following responsibilities before deployment:

   Owner	Responsibility
   Customer administrator	Compute, storage, networking, identities and resource grants
   ISV deployer	Compatible runtime, job code and deployment configuration
   Production operator	Schedules, alerts, promotion, rollback, retention and support

2. For ISV-operated environments, separate customer credentials, artifact roots, outputs and execution resources. A shared Python process does not provide tenant isolation.

3. Store credentials in managed secrets or use workload identity. Define credential rotation and revocation procedures, and exclude tokens and customer rows from diagnostic logs.

4. Agree on compute ownership, artifact retention and deletion permissions.

Troubleshoot jobs