FAQ
General
What exactly is Open Laboratory?
Open Laboratory is a Docker container that turns a machine into a remotely accessible AI workstation. It includes a desktop environment, an app manager for open-source AI tools, a model library, and a browser terminal. Remote access can use managed Uplink, a self-hosted Uplink edge, Tailscale, or a combination.
Is there a managed cloud option?
No. Open Laboratory is self-hosted software. You run the container on your own hardware or cloud account. We provide the software, tunnel infrastructure, and model library — you provide the compute.
What hardware do I need?
Any machine that runs Docker. For AI workloads, an NVIDIA GPU is strongly recommended. The minimum useful setup is a GPU with 8 GB of VRAM. CPU-only works for LLM inference (slowly) but is impractical for image generation.
Does it work on AMD GPUs or Apple Silicon?
AMD ROCm support and Apple Silicon (Metal) support are on the roadmap. Currently only NVIDIA GPUs are supported for accelerated inference.
Accounts
Do I need an account?
Only for managed Uplink. Create a device token in the
Uplink console. You can instead use
your own Uplink edge with UPLINK_EDGE and UPLINK_EDGE_API_KEY, or join a
tailnet with TS_AUTHKEY, without an Uplink account.
Can I use one device token on multiple machines?
No. A device token binds to the first host that uses it. Create one token per Laboratory host. You can reset a token’s host binding from the Uplink console when deliberately moving it.
What happens if I lose my internet connection while the container is running?
The container and its apps keep running locally. Uplink and Tailscale reconnect automatically after network connectivity returns.
Access and Security
How does the tunnel work?
When the container starts, it opens an outbound Uplink connection, joins a Tailscale tailnet, or does both. No inbound ports need to be open on the Laboratory host.
Who can access my instance?
In device-token mode, the managed edge admits the owner, invited accounts, and holders of applicable access tokens. A self-hosted edge uses the lab access token printed during boot. Tailscale uses your tailnet ACLs.
Do I need to manage an access token?
Not for managed Uplink account access. A self-hosted edge does require the lab access token printed during boot. Apps published through Uplink can be public or protected with route-scoped tokens from the lab’s Network panel. Tailnet access is controlled by Tailscale ACLs.
How do I revoke access?
Revoke the device token from the Uplink console to prevent the host from renewing managed credentials. For a self-hosted edge, rotate its API key or the applicable lab access token. For Tailscale, expire the device or change your ACLs.
Is traffic encrypted?
Managed Uplink edges serve public hosts over HTTPS, and the connector-to-edge tunnel is encrypted. TLS and public-host configuration for a self-hosted edge are the edge operator’s responsibility. Tailscale encrypts traffic within the tailnet.
Networking
Do I need to open any ports?
No. Both Uplink and Tailscale establish outbound connections, so no inbound ports need to be open on the container host. Restrictive networks still need to permit the relevant outbound traffic.
Can I use a custom domain?
Managed Uplink supports the domains and aliases available to the account. A
self-hosted edge uses its configured domain. Tailscale uses the station’s
*.ts.net name.
Container and Data
How do I update Open Laboratory?
Pull the latest image and recreate the container:
docker pull openlaboratoryorg/laboratory-os
docker stop laboratory
docker rm laboratory
docker run -d --restart unless-stopped \
--gpus all \
--pid host \
--name laboratory \
-e UPLINK_DEVICE_TOKEN='your-device-token' \
-v laboratory_os_workspace:/workspace \
openlaboratoryorg/laboratory-osThe named volume preserves /workspace when the old container is removed.
Support
How do I get help?
- Browse this documentation
- Email support@openlaboratory.ai