| title | Start Here |
|---|---|
| mode | wide |
| icon | rabbit |
| description | Deploy your first agent |
```bash
curl -sSfL install.command.ockam.io | bash && source "$HOME/.ockam/env"
```
```bash
mkdir hello && cd hello && ockam
```
This will generate an Ockam Identity for your workstation and store its secret keys in a file system based Ockam Vault. It will then ask you to authenticate with Ockam Orchestrator to make your workstation’s new Ockam Identity an administrator of your Cluster.

Finally, the above command will download the code for a template `hello` app and create a production-ready deployment Zone in your Cluster on our serverless Runtime. Withing seconds, it will put your first AI Agent into production and you can immediately start interacting with it.
```
Welcome to Ockam 👋
You are connected to your agent - 25df35de/66a48b60
Ask it a question or give it a task.
Type ':help' or ':h' to see this message again.
Type ':quit' or ':q' to disconnect.
>
```
This agent is running on Ockam's serverless runtime.
The REPL you access on your local machine runs in the cloud, and you connect to it over a secure & private connection using Ockam's messaging protocols.
```
> Who are you?
```
Within the hello directory, ockam has created the following three files:
» tree
├── ockam.yaml
└── images
└── main
├── Dockerfile
└── main.py- The
ockam.yamlconfiguration file defines how to deploy a Zone in your Cluster in Ockam AI. - The
imagesdirectory contains the source code of docker images that will be used to run containers in your Zone.- Inside
images, there is a directory for themainimage.Dockerfiledescribe how the main image will be compiled.main.pyis the Python program that is run by the main image.
- Inside
Let's examine each file:
name: hello
pods:
- name: main-pod
containers:
- name: main
image: main
args: [localhost:9000]
portals:
outlets:
- to: localhost:9000The ockam.yaml configuration file defines how to deploy your Zone:
- Create a Zone named
01. - Create a Pod named
main-podinside the01Zone. - Make the HTTP server, in the
maincontainer in this pod, public. - Run a
maincontainer using themainimage. - Set up a portal outlet that will allow you to reach
localhost:9000in this pod.
FROM ghcr.io/build-trust/ockam-python:latest
COPY . .
ENTRYPOINT ["python", "main.py"]The Dockerfile bases the main image on the ockam-python image which already contains the ockam python package. The Dockerfile then copies the contents of the images/main directory into the image and sets main.py as the program to run when the container is started.
from ockam import Agent, Node, Repl
from sys import argv
async def main(node):
agent = await Agent.start(node, "You are Jack Sparrow.")
await Repl.start(agent, argv[1])
Node.start(main)The main.py file:
- Turns your Python app into an Ockam Node. An Ockam Node in your Cluster can connect with and deliver messages to any other Ockam Node in your Cluster that is running in Ockam AI.
- After the Node is initialized, it invokes the
mainfunction defined in yourmain.pyfile. Themainfunction starts an agent with specific instructions (“You are Jack Sparrow”). - It then starts a REPL (interactive shell) server for that agent.
. Deploying zone hello in cluster 25df35de87aa441b88f22a6c2a830a17...
✔ Created a repository for the image main
✔ Built image main
✔ Pushed image main
✔ Deployed zone hello in cluster 25df35de87aa441b88f22a6c2a830a17
✔ Opened a portal to the outlet main-pod on main-pod from tcp://localhost:9000
✔ Opened a portal to the outlet http on main-pod from tcp://localhost:8000
✔ Opened a portal to the outlet logs on logs-pod from tcp://localhost:3000
When you run ockam:
- It builds the code in
images/maininto a container image and pushes that image to a container registry available to your Zone. It then deploys the Zone into your Cluster, in Ockam AI, based on configuration that is specified above inockam.yaml. - Next, it opens a portal inlet on your workstation that connects to the outlet in the
main-pod. This creates a portal to the REPL server in yourmaincontainer and makes that server available on a local port on your workstation. - Finally, it connects a REPL client to the REPL server through this secure portal.