Install

Pitot ships as a single binary and as a multi-architecture container image. The release packages include the browser assets and embedded databases.

Docker

docker run -d --name pitot --restart unless-stopped \
  -p 7520:7520 \
  -v pitot-data:/var/lib/pitot/data \
  -e PITOT_AUTH_CODE_SECRET=$(openssl rand -hex 32) \
  labstack/pitot:latest

Images are published to Docker Hub as labstack/pitot and mirrored to GitHub Container Registry as ghcr.io/labstack/pitot. The two carry the same digests; pick whichever registry your hosts already pull from.

PITOT_AUTH_CODE_SECRET is required for local sign-in. After setup, enable the built-in agent or connect an external agent over MCP.

Volume ownership

The image is distroless and runs unprivileged as UID/GID 65532. A named volume, as above, is set up correctly for you. A bind-mounted host directory is not: -v "$PWD/data:/var/lib/pitot/data" fails to open its data directory unless that directory is already writable by 65532.

The image sets PITOT_ADDR=:7520 and PITOT_DATA_DIR=/var/lib/pitot/data. Native installs default to 127.0.0.1:7520; set PITOT_ADDR=:7520 to accept connections from other hosts.

Install script

curl -fsSL https://raw.githubusercontent.com/labstack/pitot/main/scripts/install.sh | sh

It resolves the latest release, downloads SHA256SUMS, verifies the archive against it before extracting, and installs to /usr/local/bin when that is writable or ~/.local/bin otherwise. Set PITOT_PREFIX to choose the directory, or PITOT_VERSION to pin a tag instead of taking the latest.

Versions use CalVer format vYYYY.M.N[-alpha|-beta|-rc], numbered from 0 within each month across all maturity suffixes. Pitot is alpha, so v2026.11.0-alpha is the first release of November 2026. GA has no suffix. Container tags omit the leading v, and every release moves latest.

Native binary

Download and extract the archive for your platform from GitHub Releases. For example, with the Linux amd64 archive:

tar -xzf pitot_v2026.11.0-alpha_linux_amd64.tar.gz
chmod +x pitot
export PITOT_AUTH_CODE_SECRET=$(openssl rand -hex 32)
./pitot

Verify what you downloaded

The install script checks the archive for you. If you took one from the releases page by hand, check both the checksum and the build provenance:

sha256sum -c SHA256SUMS
gh attestation verify pitot_v2026.11.0-alpha_linux_amd64.tar.gz \
  --repo labstack/pitot

For containers, record or pin the digest the registry returns rather than trusting a moving tag:

docker buildx imagetools inspect labstack/pitot:2026.11.0-alpha

Release images are multi-architecture for linux/amd64 and linux/arm64, and archives cover Linux and macOS on both. Every artifact is built on a native runner, because DuckDB needs cgo.

See image tags.

See the release contract for the artifact inventory and verification workflow.

What an instance opens

See ports and paths for listener and data-directory defaults.

Complete first boot to create the administrator and ingest token, then configure exporters. Connect telemetry can generate configuration for a private Collector hostname.

If the dashboard is public but ingest must remain LAN-only, keep Pitot’s backend port private and deny /v1, /v1/*, and /opentelemetry.proto.collector.* on the public proxy. Allow collectors through the private network or a restricted proxy route, and verify that neither OTLP transport is reachable through the public origin.

Next

First boot covers configuration validation, administrator setup and sign-in.