The deployment guide for the UndosaTech FL node, written for institutional IT and information-governance reviewers. Last updated 4 July 2026.
A single Docker container your institution runs on its own infrastructure, next to its data. It lets your institution participate in federated studies without any patient-level data leaving your network. It requires no inbound firewall changes, no VPN, and no public IP.
The node initiates connections to exactly these destinations. The training endpoint is never hard-coded: the orchestrator returns it at study start, and it is always within this list.
| Destination | Port / protocol | Purpose | When |
|---|---|---|---|
undosatech-production.up.railway.app | 443 / HTTPS | Registration, heartbeat, assignment polling, deregistration | Continuous |
undosatech-production.up.railway.app | 8001 / gRPC (TLS) | Federated training session — model weights in, weight updates out | Only while a study your institution accepted is training |
Docker Hub (registry-1.docker.io, auth.docker.io) | 443 / HTTPS | Image pull | Install and updates only |
Institutional egress proxies are supported via standard HTTPS_PROXY / NO_PROXY environment variables.
| Leaves your institution | Never leaves |
|---|---|
| Registration metadata you configure (institution name, domain, contact email, declared capabilities) · heartbeats (status, latency) · during an accepted study only: model weight updates and aggregate metrics (loss, accuracy, sample counts) per round | Patient-level data, images, or files. The data directory is mounted read-only and is read only by the local training loop. Weight updates can additionally carry differential-privacy noise, configured per study and visible in the study invitation. |
Every governance-relevant event — registration, invitation, acceptance, each training round — is recorded in the platform's hash-chained audit trail, and the node's own activity is fully visible locally via docker logs.
curl -O https://app.undosatech.com/docker-compose.node.yml # create .env.node from the template inside that file docker compose -f docker-compose.node.yml up -d
The node appears in the platform's Nodes tab within about 30 seconds, in a pending state. Activation deliberately requires two parties — an institutional email domain alone does not authorise a deployment. First, the institutional authoriser named at registration (a PI, data custodian, or IT/security contact — a different person from the node contact) confirms via an emailed link; then UndosaTech approves the node. Both events are recorded on the tamper-evident audit chain.
Node images are built by GitHub Actions from the public repository, tagged by commit, and signed with Sigstore cosign using the build's GitHub OIDC identity. A CycloneDX software bill of materials (SBOM) is generated for every build and attached as a signed attestation, so your security team can verify exactly what is inside the container before running it:
cosign verify undosatech/fl-node:latest \ --certificate-identity-regexp "^https://github.com/Johnuzo89/undosatech" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com
For production, pin a digest rather than latest.
Stop the container (docker compose down) — it deregisters on shutdown. Remove the credentials volume to destroy the node's API key locally; the key is also invalidated server-side when the node record is removed. Because your data was never copied anywhere, there is nothing remote to delete beyond the registration metadata, which is removed with the node record.
Questions from IT or IG reviewers: security@undosatech.com · See also Trust & Security.