Operations

Production Deployment

Deploy SurfaceProxy with security-first defaults for shared environments and team traffic.

Last updated: June 10, 2026

Deployment checklist

  1. Use a dedicated config for production allowlists and policy rules.
  2. Terminate TLS at your edge and restrict inbound source IP ranges.
  3. Run SurfaceProxy behind your internal gateway or private network.
  4. Enable centralized logging and alerting for blocked or high-risk sessions.

Example container start

docker run -d   --name surfaceproxy   -p 8443:8443   -p 8080:8080   -v $(pwd)/surface-proxy.json:/app/surface-proxy.json   ghcr.io/sentrysurface/surfaceproxy-core:latest   --config /app/surface-proxy.json

Scaling guidance

  • Start with one instance per environment and load test real browser workloads.
  • Scale horizontally with session-aware routing at the edge.
  • Track dashboard health and proxy latency before increasing concurrency limits.