Install with Docker

The short way

If you can run either of these, stop here — they do every step on this page, including the checks, and they refuse to start anything that fails one.

# macOS and Linux
curl -fsSL https://veox.ai/install.sh | bash

# Windows, in PowerShell
irm https://veox.ai/install.ps1 | iex

Before you start

You need Docker, and nothing else. On Windows and macOS that means Docker Desktop; on Linux, Docker Engine. The workspace binds to 127.0.0.1, so it is reachable from your machine and not from your network.

Everything here downloads roughly 50 MB. No model weights are included, because the Free tier runs every session in Jain Cloud — see the overview for what that means for your data.

Finding the current release

Releases are published behind a channel pointer rather than a URL you have to keep up with. latest.json always describes the current release:

https://downloads.neverhuman.org/jain/latest.json

It is a small JSON document naming the version, the image tarball, that tarball's SHA-256, the image reference to run, and the image id Docker should end up holding:

{
  "schemaVersion": "jain.free-release/v1",
  "version": "...",
  "image_ref": "jain/workspace:...",
  "image_id": "sha256:...",
  "image_tar": "jain-cpu-....tar.gz",
  "image_tar_sha256": "...",
  "cloud": "https://cloud.veox.ai"
}

The commands below read those fields instead of hard-coding them, which is why none of them names a version. Paste them as they are and they install whatever is current on the day you run them.

To pin a release instead of following the channel, ask for it by name: a <version>.json manifest sits beside latest.json and never moves, and the installers take the same argument — --channel <version> on install.sh, -Channel <version> on install.ps1.

Windows — PowerShell

PowerShell parses JSON natively, so this is short. It downloads, checks the digest, refuses to go on if the digest does not match, then loads and starts the workspace.

$base = 'https://downloads.neverhuman.org/jain'
$r    = Invoke-RestMethod "$base/latest.json"

# download the image this release names
Invoke-WebRequest "$base/$($r.version)/$($r.image_tar)" -OutFile $r.image_tar

# verify it BEFORE loading it; stop here if these do not match
$have = (Get-FileHash $r.image_tar -Algorithm SHA256).Hash.ToLower()
if ($have -ne $r.image_tar_sha256) { throw "digest mismatch - do not load this file" }

docker load -i $r.image_tar

# clears any previous one; harmless the first time
docker rm -f ai-veox-jain
docker run -d --name ai-veox-jain --restart unless-stopped `
  -p 127.0.0.1:8369:8080 $r.image_ref

macOS and Linux — shell

The same steps. sed reads the fields rather than jq, so this works on a machine with nothing installed on it.

base=https://downloads.neverhuman.org/jain
json=$(curl -fsSL "$base/latest.json")
field() { printf '%s' "$json" | sed -n "s/.*\"$1\"[[:space:]]*:[[:space:]]*\"\([^\"]*\)\".*/\1/p" | head -1; }

version=$(field version); tar=$(field image_tar)
sha=$(field image_tar_sha256); ref=$(field image_ref)

curl -fsSL -o "$tar" "$base/$version/$tar"

# verify it BEFORE loading it; this exits non-zero on a mismatch
printf '%s  %s\n' "$sha" "$tar" | sha256sum -c -

docker load -i "$tar"
docker rm -f ai-veox-jain 2>/dev/null || true
docker run -d --name ai-veox-jain --restart unless-stopped \
  -p 127.0.0.1:8369:8080 "$ref"

Checking the signature

The digest above proves the bytes match a manifest served by the same host. A signature proves the release came from us. If you have cosign, check it — and if it fails, do not load the image. Continuing from the shell variables above:

curl -fsSL -o "$tar.sig" "$base/$version/$tar.sig"
curl -fsSL -o cosign.pub "$base/cosign.pub"
cosign verify-blob --key cosign.pub --insecure-ignore-tlog=true \
  --signature "$tar.sig" "$tar"

Opening it

However you installed it, the workspace comes up on http://localhost:8369 — 8369 is "VEOX" on a keypad. Open it and sign in with your Veox account, or register at https://cloud.veox.ai/register — a priority access code admits you immediately, otherwise you join the waitlist (1–3 weeks).

A new session opens on an empty console asking for a table. Drop a .csv or .tsv anywhere on the page — see Upload your data for what it accepts.

Managing it

The container is started with --restart unless-stopped, so it comes back when Docker does. Removing it with the command above is what stops that.

Changing the port or the binding

The left-hand half of -p 127.0.0.1:8369:8080 is yours to change; the 8080 on the right is the port inside the container and must stay. To use a different host port, change 8369. To expose the workspace to your network — which puts a sign-in page on it that anyone who can reach the port may attempt, so think first — replace 127.0.0.1 with 0.0.0.0.