Deployment Overview

fh build produces a deployable artifact for a chosen target. The same agent code runs on every target — only the build output and runtime differ.

Targets at a glance

Target	What it produces	Deployment requirement	Best for
Node	`dist/server.mjs` HTTP server	Configure auth, durable stores, limits, and monitoring.	Local services, internal automation, container wrapping.
Docker	`Dockerfile` + Node bundle	Configure registry, secrets, network policy, and persistent stores.	CI smoke tests, ECS / Kubernetes, generic container hosts.
AWS	Docker artifact for ECS/App Runner/EKS	Provision the AWS container control plane around the artifact.	AWS container platforms with external durable state.
Fly.io	Docker artifact	Configure the application, secrets, port, health checks, and volume/database.	Regional container applications.
Railway	Docker artifact	Configure service variables, port, health checks, and durable database.	Managed container deployment.
SST	Node/Docker artifact	Provision a long-running AWS container service.	AWS infrastructure defined from TypeScript.
Temporal worker	Worker entrypoint + activities	Provide a Temporal namespace, task queue, identity, and worker operations.	Durable, replayable, approval-gated agent sessions.
Cloudflare Workers + Sandbox	Worker + DO + Sandbox container binding	Configure Worker, Durable Object, R2, and optional Sandbox bindings.	Edge-triggered webhooks, per-tenant Durable Object sessions.
Foundry Hosted Agents	`Dockerfile` + `azure.yaml` + Bicep; Agent Service client/tools	Configure Azure identity, role assignments, project, networking, and region.	Azure-native agents with per-session isolation, Entra Agent ID, OBO auth.
Azure Container Apps / ACI / AKS	ARM control-plane tools; Docker deploy path	Configure subscription identity, registry, network, and compute resources.	Azure customers without Foundry availability or with K8s mandates.
Databricks	Databricks App/Serving artifacts, governed tools, OAuth, and Lakebase stores	Configure workspace identity, UC grants, App resources, and certification.	Data, analytics, ML, and governance agents.
E2B	Control-plane helpers for E2B sandbox runtime	Provide provider credentials and validate lifecycle and cleanup.	Ephemeral sandbox execution for untrusted code.
Daytona	Control-plane helpers for Daytona workspace runtime	Provide provider credentials and validate workspace lifecycle.	Reproducible dev environments as agent sandboxes.
Modal	Native TypeScript SDK sandbox adapter	Configure Modal credentials, image, resources, network policy, and cleanup.	Serverless GPU/CPU tasks from agent sessions.
Azure Container Instances (ACI)	ARM control-plane helpers for ACI	Configure ACR, managed identity, resource group, and networking.	Lightweight container instances for single-shot agents.

What remains portable

The source definition stays the same while the build manifest records the selected runtime, capabilities, policy, package versions, digest, and provenance for the target-specific artifact.

RevenueOpsAgent source becoming a verified build manifest and portable Node, Docker, Temporal, Cloudflare, and Databricks targets — Representative UIThe build manifest binds definitions, policy, runtime requirements, capabilities, package versions, digest, and provenance.

Diagram flow: graph TD; Where will the agent run? leads to Local / on-prem?; Local leads Yes Node; Local leads No Cloud preference?; Cloud leads Edge / per-tenant Cloudflare; Cloud leads Azure-native Foundry available?; Azure leads Yes Foundry Hosted Agent; Azure leads No Azure Container Apps; Cloud leads Data / ML Databricks tools; Cloud leads Other Docker / K8s; Cloud leads Serverless GPU/CPU Modal; Cloud leads Ephemeral sandbox E2B.

graph TD
    Start[Where will the agent run?] --> Local{Local / on-prem?}
    Local -->|Yes| Node
    Local -->|No| Cloud{Cloud preference?}
    Cloud -->|Edge / per-tenant| Cloudflare
    Cloud -->|Azure-native| Azure{Foundry available?}
    Azure -->|Yes| Foundry[Foundry Hosted Agent]
    Azure -->|No| ACA[Azure Container Apps]
    Cloud -->|Data / ML| Databricks[Databricks tools]
    Cloud -->|Other| Docker[Docker / K8s]
    Cloud -->|Serverless GPU/CPU| Modal[Modal]
    Cloud -->|Ephemeral sandbox| E2B[E2B]
    Cloud -->|Reproducible dev env| Daytona[Daytona]
    Cloud -->|Lightweight containers| ACI[Azure Container Instances]
    Node --> Durable{Need durability?}
    Durable -->|Yes| Temporal[+ Temporal worker]
    Durable -->|No| NodeOnly[Node server]

Build invocation

fh build --target node
fh build --target docker --docker-build --docker-tag myorg/agents:latest
fh build --target temporal-worker
fh build --target cloudflare
fh build --target foundry-hosted-agent
fh build --target databricks-app
fh build --target databricks-serving

Each target writes to .fabricharness/build/<target>/ and emits a manifest.json next to the artifact. See Build manifest.

For the v2 artifact layout, route examples, and production environment controls, follow Build and run artifacts. For an end-to-end workspace deployment, use the Databricks App tutorial.

CI/CD recipes

GitHub Actions — build, sign, deploy on push.
GitLab CI — equivalent pipeline.

Hardening checklist

Before promoting any target to production, walk through Security hardening: provenance, attestation, secret handling, network egress, approval gating, and rate limits.