# Enterprise connector > The Enterprise connector sits beside your app and connects out to LayerV: requirements, tested CPU and memory profiles, storage, networking, and deployment. Source: https://layerv.ai/platform/connector/ --- Platform / Connector # Enterprise connector The Connector runs beside your app, connects out to LayerV, and carries approved traffic. What it needs to run in production, typically in Docker: CPU, memory, storage, network, and the deployment steps. **Start with 1 vCPU and 256 MiB RAM for the Connector.** Runs on Linux AMD64 and ARM64\. Add your app’s resources separately. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") [Deploy the Connector](https://layerv.ai/platform/connector/#deploy) [Sources](https://layerv.ai/platform/connector/#specification-sources) Sharing an app from your own machine? [Use the qURL™ CLI →](https://layerv.ai/cli/) [Environment requirements](https://layerv.ai/platform/connector/#environment) [Storage capacity](https://layerv.ai/platform/connector/#storage) [CPU and memory](https://layerv.ai/platform/connector/#cpu-memory) [Container configuration](https://layerv.ai/platform/connector/#container-config) [Network requirements](https://layerv.ai/platform/connector/#network) [Deploy the Connector](https://layerv.ai/platform/connector/#deploy) ## Environment requirements Confirm your infrastructure can run the Connector. __Host and platform__ | Requirement | Detail | | ----------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Host | Linux Docker host with permission to create containers and persistent storage. [\[1\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/Dockerfile "[1] Source: Released container definition") [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | | OS & CPU | Docker with 64-bit Linux containers. The released image includes linux/amd64 (x86-64) and linux/arm64. Docker selects the matching platform from the multi-platform image digest. [\[8\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/.github/workflows/cli.yml "[8] Source: Two-platform image checks") [Measured v2.5.3 image manifest.](https://layerv.ai/docs/connector-evidence/image-verification.json) | | GPU | None required. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") | | Diagnostics | The Connector image contains no shell or package manager. Use host tools for diagnostics. [\[1\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/Dockerfile "[1] Source: Released container definition") | ## Storage capacity Plan the storage the Connector container needs on the host. __Connector storage budget__ | Storage | Starting allocation | Detail | | ---------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Image cache | 128 MiB | Planning allowance for the measured v2.5.3 image plus a second copy during an update. Check the image size again when selecting a newer release. Measured Docker image storage: arm64 39.4 MiB ; amd64 43.8 MiB. This excludes Docker’s own data and your app image. [Image details.](https://layerv.ai/docs/connector-evidence/image-verification.json) | | Persistent state | 1 GiB per deployment | Suggested starting allowance, not measured state consumption. Mount persistent state at /var/lib/qurl and pass that path as \--state-dir. Monitor disk use. Keep it across restarts and upgrades. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[3\]](https://docs.docker.com/engine/storage/bind-mounts/ "[3] Source: Persistent container storage") | | Temporary files | 64 MiB maximum | Mount /tmp as memory-backed storage with size=64m. This is a ceiling, not a permanent 64 MiB allocation, and it shares the container RAM budget. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[11\]](https://docs.docker.com/engine/storage/tmpfs/ "[11] Source: Docker memory-backed temporary storage") | | Container logs | 3 files × 10 MB | Use Docker’s JSON logging driver with max-size=10m and max-file=3 for a bounded local starting policy. This is separate from persistent state; use your log platform for longer retention. [\[10\]](https://docs.docker.com/engine/logging/drivers/json-file/ "[10] Source: Docker log rotation") | ## CPU and memory Choose a starting allocation for the Connector container. These allocations were tested on Linux AMD64 and ARM64 with the same controlled workload. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") Light workloads ### 0.25 vCPU 128 MiB RAM A compact allocation for small HTTP responses. Recommended starting point ### 1 vCPU 256 MiB RAM Start here for more CPU and memory headroom. Additional capacity ### 2 vCPU 512 MiB RAM A larger budget as your deployment grows. Sizing notes These are planning allocations, not production capacity guarantees. The tests exercise the Connector runtime with small responses, loopback networking, and scripted admission; they do not measure the complete deployed service or live enrollment. Load-test your deployment before production. Payload size, concurrent connections, and sustained request rate affect resource use. Temporary files share the RAM budget. Reserve separate capacity for Linux, Docker, your app, and other containers. [\[7\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/proof%5Froutes%5Ftest.go "[7] Source: Runtime workload test") ## Container configuration Configure the image, security settings, runtime limits, and lifecycle behavior. __Container configuration__ | Configuration | Detail | | --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Container image | ghcr.io/layervai/qurl, published in GitHub Container Registry. This public image contains the Connector runtime. Configure the container to run the service with daemon run; the image alone does not start or enroll a Connector. No source build is required. Pin an approved release digest in your deployment manifest. [\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v3.5.0/qurl-image.txt "[9] Source: Published container image digest (text download)") [\[1\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/Dockerfile "[1] Source: Released container definition") | | Runtime user | UID/GID 65532:65532. Use a read-only root filesystem, \--cap-drop=ALL, and \--security-opt=no-new-privileges:true. A privileged container is not required. [\[1\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/Dockerfile "[1] Source: Released container definition") [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | | Persistent state | Create the Docker state directory with owner 65532:65532 and mode 0700. Store it on persistent storage and treat it as secret material. Give each independent deployment its own state directory. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | | Process & file limits | Start with \--pids-limit=512 and \--ulimit nofile=4096:4096. These are tested allocations; increase them if your measured workload needs more. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") | | Restart behavior | Use \--restart=unless-stopped or your orchestrator’s restart policy. If you use \--network container:APP\_CONTAINER, recreate the Connector with the new app container’s network namespace when you replace the app container. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | ## Network requirements ### Outbound access, without a public app port The Connector opens a reverse tunnel to LayerV and forwards approved requests to your app. Do not publish the app port just to make the Connector work. An app port you already expose still needs to be closed separately. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") __Network checklist__ | Connection | Destination | Requirement | | ------------------------ | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DNS | Your configured resolver | Resolve the API, Hub, and assigned tunnel endpoints. [\[4\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/internal/connector/hub/hub.go "[4] Source: Hub and UDP port requirements") [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") | | Outbound HTTPS (TCP 443) | api.layerv.ai | Allow account and sharing-state requests to the configured qURL API endpoint. Use the endpoint for your deployment environment. [\[15\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go#L54 "[15] Source: Container account and sharing-state requests") | | Outbound UDP 443 | hub.nhp.layerv.ai and assigned NHP cells | Direct UDP for admission and registration. An HTTP-only proxy is not sufficient. Use the endpoint and trust settings for your deployment environment. [\[4\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/internal/connector/hub/hub.go "[4] Source: Hub and UDP port requirements") | | Outbound TCP tunnel | Assigned server host and port | Allow direct TCP to the endpoint returned by authenticated admission. Do not assume its port is 443 or hard-code an address copied from another deployment. UDP and TCP must use the same source-IP egress path. [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") [\[12\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/internal/connector/daemon/runtime.go "[12] Source: Direct tunnel egress") [\[13\]](https://github.com/layervai/frp/blob/9a0e4ee61964/pkg/config/v1/client.go#L148 "[13] Source: Pinned tunnel TCP default") | | Local HTTP | Your app’s localhost port | With \--network container:APP\_CONTAINER, the app and Connector share a network namespace. The configured HTTP port must accept connections there. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | | Image downloads | Container registry | The Docker host must be able to pull the pinned image. This is host access for installation and updates, separate from the running Connector’s tunnel. [\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v3.5.0/qurl-image.txt "[9] Source: Published container image digest (text download)") | Bandwidth must cover the application traffic carried through the Connector. There is no fixed Mbps requirement independent of payload size and request rate. Include any additional endpoints required by your account setup or optional cloud key provider. ## Deploy the Connector Pull the approved image, prepare its inputs, start the Connector, and verify the route. 1. **Pull the approved image.** Use your container registry workflow and deployment pipeline. The published release includes `qurl-image.txt` with the immutable image reference. Review the release, then pin that reference in Docker, Compose, or your orchestrator. [\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v3.5.0/qurl-image.txt "[9] Source: Published container image digest (text download)") This example pulls release v3.5.0. It downloads the image without starting a service. Docker pull ``` docker pull ghcr.io/layervai/qurl@sha256:361b597963844bce729aa17ba8fa5490dc2b11723a35e412e626ee532c4e4d5b ``` 2. **Provide the enrollment token.** Provide a one-time enrollment-token file for first startup. Mount it read-only and make it readable only by UID 65532 or its dedicated group. Do not put the token in image layers, command arguments, or source control. [\[5\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") The share configuration is generated by the platform (the qURL Slack app's admin command today) or by LayerV for your deployment. [Contact LayerV](https://layerv.ai/contact/) before starting the container if you do not have it. 3. **Mount persistent state.** Mount a separate persistent state directory for each Connector instance. Use the state directory created with owner `65532:65532` and mode `0700`, and keep it on persistent storage across restarts and upgrades. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") 4. **Start the Connector.** Start the container with the account configuration LayerV provides for your deployment. With plain Docker, use bind mounts for the configuration and token files. [\[5\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") 5. **Verify access.** Confirm outbound access and the local app connection. After enrollment, verify access to the protected app with an authorized qURL link. A running container alone does not confirm that the route serves traffic. Note Keep state. Remove the one-time enrollment secret after a verified warm start. First startup uses the supplied enrollment-token file. Follow the documented transition: remove the token argument, verify a warm start with saved state, then remove the secret mount and delete the secret. [\[5\]](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") ## Sources Review the Connector container release assets on the [container releases page](https://github.com/layervai/qurl-integrations/releases/latest). Deploy the exact image digest approved for your deployment pipeline. The specification sources record the versions behind each measurement. Specification sources [CPU and RAM sizing basis (Markdown download)](https://layerv.ai/docs/connector-evidence/README.md) · [Container image manifest](https://layerv.ai/docs/connector-evidence/image-verification.json) 1. [Released container definition](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/Dockerfile) 2. [Docker runtime, networking, and resource options](https://docs.docker.com/reference/cli/docker/container/run/) 3. [Persistent container storage](https://docs.docker.com/engine/storage/bind-mounts/) 4. [Hub and UDP port requirements](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/internal/connector/hub/hub.go) 5. [Container enrollment and warm-start implementation](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go) 6. [Assigned tunnel and local app connection](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go) 7. [Runtime workload test](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/proof%5Froutes%5Ftest.go) 8. [Two-platform image checks](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/.github/workflows/cli.yml) 9. [Published container image digest (text download)](https://github.com/layervai/qurl-integrations/releases/download/v3.5.0/qurl-image.txt) 10. [Docker log rotation](https://docs.docker.com/engine/logging/drivers/json-file/) 11. [Docker memory-backed temporary storage](https://docs.docker.com/engine/storage/tmpfs/) 12. [Direct tunnel egress](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/internal/connector/daemon/runtime.go) 13. [Pinned tunnel TCP default](https://github.com/layervai/frp/blob/9a0e4ee61964/pkg/config/v1/client.go#L148) 14. [CPU and RAM sizing basis (Markdown download)](https://layerv.ai/docs/connector-evidence/README.md) 15. [Container account and sharing-state requests](https://github.com/layervai/qurl-integrations/blob/3da4ba34df029c31e86dc2ed00997d015b1bac8d/apps/cli/cmd/daemon.go#L54) --- *This markdown version is auto-generated from [https://layerv.ai/platform/connector/](https://layerv.ai/platform/connector/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*