OpenHands · jlav · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026 · Jul 15, 2026
diff --git a/docs.json b/docs.json
@@ -500,7 +500,11 @@
             "group": "K8s Install",
             "pages": [
               "enterprise/k8s-install/index",
-              "enterprise/k8s-install/resource-limits"
+              "enterprise/k8s-install/installation",
+              "enterprise/k8s-install/sysbox",
+              "enterprise/k8s-install/dns-and-tls",
+              "enterprise/k8s-install/resource-limits",
+              "enterprise/k8s-install/eks"
             ]
           }
         ]

diff --git a/enterprise/analytics.mdx b/enterprise/analytics.mdx
@@ -16,7 +16,7 @@

 Laminar helps you understand what your OpenHands deployment is doing in production:

 - Inspect prompts, tool calls, answers, and nested agent behavior in Laminar's [trace views](https://laminar.sh/docs/platform/viewing-traces).
 - Use [session replay for browser agents](https://laminar.sh/docs/tracing/browser-agent-observability) when conversations drive browser automation.
 - For Helm installs, define [signals](https://laminar.sh/docs/signals/introduction) to classify failures, measure outcomes, and monitor recurring patterns across many traces.

@@ -93,7 +93,7 @@
     Apply your updated `values.yaml` override file:
 
     ```bash
-    helm upgrade openhands oci://ghcr.io/openhands/helm-charts/openhands \
+    helm upgrade openhands oci://registry.replicated.com/openhands/openhands \
       --namespace openhands \
       --values values.yaml
     ```
@@ -107,13 +107,13 @@
 Once the deployment status shows **Ready**, navigate to the Laminar frontend URL:

 - VM install: `https://analytics.app.<your-base-domain>`
 - Kubernetes install: the hostname configured in `laminar.frontend.ingress.hostname`

 Click the **Continue with Keycloak** button:

 ![Laminar Keycloak Auth](./images/laminar-keycloak-auth.png)

 If you want more background on Laminar Cloud versus self-hosting outside OHE, see Laminar's official [hosting options](https://laminar.sh/docs/hosting-options).

 ## Create a Laminar Project

@@ -249,7 +249,7 @@
     Apply your updated `values.yaml` override file:
 
     ```bash
-    helm upgrade openhands oci://ghcr.io/openhands/helm-charts/openhands \
+    helm upgrade openhands oci://registry.replicated.com/openhands/openhands \
       --namespace openhands \
       --values values.yaml
     ```
@@ -270,11 +270,11 @@

 ## What to Do Next in Laminar

 Once traces are flowing, use Laminar's official docs to go deeper:

 - [Viewing Traces](https://laminar.sh/docs/platform/viewing-traces) to inspect a single conversation in transcript, tree, or timeline views.
 - For Helm installs, [Signals](https://laminar.sh/docs/signals/introduction) to extract structured outcomes or failure modes across many traces.
 - [Session replay for browser agents](https://laminar.sh/docs/tracing/browser-agent-observability) to debug browser-based automations.
 - [Observability for OpenHands Software Agent SDK](https://laminar.sh/docs/tracing/integrations/openhands-sdk) for the OpenHands-specific tracing model.

 ## Next Steps

diff --git a/enterprise/k8s-install/dns-and-tls.mdx b/enterprise/k8s-install/dns-and-tls.mdx
@@ -0,0 +1,148 @@
+---
+title: DNS and TLS
+description: Automate DNS records and TLS certificates with external-dns and cert-manager
+icon: lock
+---
+
+OpenHands needs DNS records and TLS certificates for its hostnames. We recommend automating both with
+**external-dns** and **cert-manager** — they run on any Kubernetes distribution and support the major
+cloud DNS providers. If you can't run them, provision the records and certificates by hand — see
+[Manual Setup](#manual-setup).
+
+## Hostnames
+
+OpenHands serves these hostnames, using `openhands.example.com` as the base domain (matching the
+[Helm install](/enterprise/k8s-install/installation)):
+
+| Hostname | Purpose |
+|---|---|
+| `app.openhands.example.com` | Application |
+| `auth.app.openhands.example.com` | Login (Keycloak) |
+| `runtime-api.openhands.example.com` | Runtime API |
+| `*.runtime.openhands.example.com` | Per-session sandboxes |
+
+All of these resolve to your ingress load balancer. The sandbox entry must be a **wildcard** — each
+session gets its own subdomain.
+
+## external-dns
+
+external-dns watches your Ingresses and Services and creates the matching DNS records automatically.
+It supports many providers, including Amazon Route 53, Google Cloud DNS, Azure DNS, and Cloudflare.
+
+- Install it from its [Helm chart](https://kubernetes-sigs.github.io/external-dns/).
+- Set `provider` to your DNS provider and grant it access to your zone (the access mechanism is
+  provider-specific).
+- Recommended settings:
+
+```yaml
+provider:
+  name: aws                   # or google, azure, cloudflare, ...
+policy: upsert-only           # only ever create/update, never delete
+registry: txt
+txtOwnerId: openhands
+domainFilters:
+  - openhands.example.com     # only manage names under your base domain
+```
+
+With `upsert-only` and a TXT registry, external-dns only ever touches records it created.
+
+<Note>
+  **Amazon EKS / Route 53.** Grant access with IRSA or EKS Pod Identity:
+  `route53:ChangeResourceRecordSets` on the zone, plus `route53:ListHostedZones` and
+  `route53:ListResourceRecordSets`. If your hosted zone is a *parent* of the domain filter (zone
+  `example.com`, filter `openhands.example.com`), add the `--aws-zone-match-parent` flag, or
+  external-dns matches no zone and creates nothing.
+</Note>
+
+## cert-manager
+
+cert-manager issues and renews certificates from Let's Encrypt. Use the **DNS-01** challenge — it's
+the only one that can issue the **wildcard** certificate the sandbox hostnames need.
+
+<Steps>
+  <Step title="Install cert-manager">
+    Install it from its [Helm chart](https://cert-manager.io/docs/installation/helm/), and grant it
+    access to your DNS provider so it can solve DNS-01 challenges.
+  </Step>
+  <Step title="Create a ClusterIssuer">
+    The `solvers` block is specific to your DNS provider — the Route 53 solver is shown here.
+
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: ClusterIssuer
+    metadata:
+      name: letsencrypt-prod
+    spec:
+      acme:
+        server: https://acme-v02.api.letsencrypt.org/directory
+        email: you@example.com
+        privateKeySecretRef:
+          name: letsencrypt-prod
+        solvers:
+          - dns01:
+              route53:                 # swap for cloudDNS, azureDNS, cloudflare, ...
+                hostedZoneID: <your-zone-id>
+    ```
+
+    <Tip>
+      Start with the staging server (`https://acme-staging-v02.api.letsencrypt.org/directory`) while
+      you get the setup working — it has generous rate limits — then switch to production.
+    </Tip>
+  </Step>
+  <Step title="Request a wildcard certificate">
+    A single wildcard covers every sandbox host. With Traefik, serve it as the default `TLSStore` so
+    no per-ingress TLS config is needed.
+
+    ```yaml
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: runtime-wildcard
+      namespace: openhands
+    spec:
+      secretName: runtime-wildcard-tls
+      issuerRef:
+        name: letsencrypt-prod
+        kind: ClusterIssuer
+      dnsNames:
+        - "*.runtime.openhands.example.com"
+    ```
+
+    Issue certificates for the `app`, `auth`, and `runtime-api` hosts the same way.
+  </Step>
+</Steps>
+
+<Note>
+  **Amazon EKS / Route 53.** Grant cert-manager Route 53 access with IRSA or EKS Pod Identity:
+  `route53:ChangeResourceRecordSets` on the zone and `route53:GetChange`. Use the `route53` solver as
+  shown above.
+</Note>
+
+## Manual Setup
+
+If you don't run external-dns and cert-manager, provision these by hand and point the ingress
+controller at them.
+
+**DNS** — create a record for each hostname in the table above, all pointing to your ingress load
+balancer (typically a CNAME to the load balancer's hostname, or a cloud DNS alias). The sandbox
+record must be the wildcard `*.runtime.openhands.example.com`.
+
+**TLS** — obtain certificates covering those hostnames and load them into the ingress controller as
+Kubernetes TLS secrets. A single wildcard isn't enough, because the hostnames sit at different
+depths. You need:
+
+- `*.runtime.openhands.example.com` for the sandboxes, and
+- certificates for `app.openhands.example.com`, `auth.app.openhands.example.com`, and
+  `runtime-api.openhands.example.com` (for example a `*.openhands.example.com` wildcard, which covers
+  `app` and `runtime-api`, plus a certificate for `auth.app.openhands.example.com`).
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Installing Sysbox" icon="cube" href="/enterprise/k8s-install/sysbox">
+    Install the sandbox runtime on your sandbox nodes.
+  </Card>
+  <Card title="Install with Helm" icon="ship" href="/enterprise/k8s-install/installation">
+    Deploy OpenHands once the cluster is ready.
+  </Card>
+</CardGroup>
diff --git a/enterprise/k8s-install/eks.mdx b/enterprise/k8s-install/eks.mdx
@@ -0,0 +1,139 @@
+---
+title: Amazon EKS
+description: Prepare an Amazon EKS cluster to run OpenHands Enterprise
+icon: aws
+---
+
+Running OpenHands Enterprise on Amazon EKS follows the standard
+[Helm install](/enterprise/k8s-install/installation), with a few EKS-specific choices for node
+groups, storage, ingress, and the sandbox runtime. This guide covers preparing the cluster; once
+it's ready, follow the Helm install to deploy.
+
+## Cluster Requirements
+
+| Requirement | Recommendation |
+|---|---|
+| EKS version | 1.32–1.35 (the range [Sysbox](/enterprise/k8s-install/sysbox) supports) |
+| Add-ons | VPC CNI, CoreDNS, kube-proxy, and the **EBS CSI driver** (sandboxes and stateful components use EBS volumes) |
+| Storage class | A `gp3` StorageClass backed by the EBS CSI driver |
+| Metrics | Metrics Server, for `kubectl top` and autoscaling |
+
+The chart's default sandbox storage class (`standard-rwo`) is GKE-only. Set
+`runtime-api.env.STORAGE_CLASS` to your `gp3` class or sandboxes will never start.
+
+## Node Groups
+
+OpenHands runs two very different workloads, so use two node groups:
+
+- **General** — the OpenHands services (server, runtime API, Keycloak, LiteLLM, Redis) and the
+  cluster add-ons (ingress, DNS, and certificate controllers). Standard EKS nodes on the Amazon
+  Linux 2023 AMI; on-demand or Spot.
+- **Sysbox** — the agent sandboxes, one pod per session. These need the Sysbox runtime, which
+  requires an **Ubuntu** AMI and at least **4 vCPU** per node, on **on-demand** capacity. See
+  [Installing Sysbox](/enterprise/k8s-install/sysbox).
+
+We recommend [Karpenter](https://karpenter.sh/) for autoscaling both groups (managed node groups
+also work). The sandbox group is the one that scales with usage — size it by peak concurrent
+sessions, and configure it so a node is only removed when empty, never while a session is running.
+
+Sandboxes are pinned to Sysbox nodes automatically by the `sysbox-runc` RuntimeClass. Keep the
+ingress, DNS, and certificate controllers on the general group with a node selector.
+
+### Sizing the Sandbox Nodes
+
+Each sandbox requests **0.5 vCPU**, **3 GiB memory** (request = limit, so it's guaranteed), and
+**10 GiB** of ephemeral storage. Memory is usually the binding constraint, so `m`-family instances
+(4 GiB per vCPU) pack most efficiently:
+
+| Instance | vCPU / memory | Sandboxes per node | Bound by |
+|---|---|---|---|
+| `c6i.2xlarge` | 8 / 16 GiB | ~4 | memory |
+| `m6i.2xlarge` | 8 / 32 GiB | ~9 | memory |
+| `r6i.2xlarge` | 8 / 64 GiB | ~14 | CPU |
+| `m6i.4xlarge` | 16 / 64 GiB | ~19 | memory |
+
+Two things to size for:
+
+- **Root volume** — ephemeral scratch is `10 GiB × sandboxes per node`. A full `m6i.4xlarge` needs
+  ~190 GiB of scratch, so give Sysbox nodes a large root volume (200 GiB or more), or prefer more,
+  smaller nodes.
+- **Warm capacity** — a new sandbox otherwise waits for a node to boot, which takes a few minutes.
+  Keeping a small pool of spare capacity (for example a low-priority placeholder Deployment sized to
+  one sandbox) lets sessions start instantly. Size it to your expected burst.
+
+For per-pod tuning — larger sandboxes, server replicas, autoscaling — see
+[Resource Limits](/enterprise/k8s-install/resource-limits).
+
+## Object Storage
+
+OpenHands stores conversation and session state in a file store. The bundled MinIO is ephemeral;
+for production, back it with an **S3 bucket**:
+
+1. Create a bucket in the cluster's region.
+2. Grant access with either an IAM user access key scoped to the bucket, or — to avoid a long-lived
+   credential — IRSA / EKS Pod Identity.
+3. For the access-key approach, store the credentials in a secret:
+
+```bash
+kubectl -n openhands create secret generic openhands-s3-credentials \
+  --from-literal=AWS_ACCESS_KEY_ID=<access-key-id> \
+  --from-literal=AWS_SECRET_ACCESS_KEY=<secret-access-key>
+```
+
+Then point the file store at the bucket in your values:
+
+```yaml
+filestore:
+  ephemeral: false
+  type: s3
+  bucket: <your-bucket>
+  region: <your-region>
+  existingSecret: openhands-s3-credentials
+```
+
+## Database
+
+Use an external **Amazon RDS for PostgreSQL** instance rather than the bundled database. Place it in
+the cluster's VPC, reachable from the nodes on port 5432. See
+[External PostgreSQL](/enterprise/external-postgres) for the values.
+
+## Ingress
+
+Install an ingress controller on the general node group and expose it with an **AWS Network Load
+Balancer**, provisioned directly from Service annotations (no AWS Load Balancer Controller required).
+Both Traefik and NGINX are supported:
+
+- **Traefik (recommended)** — set `ingress.class: traefik` in your OpenHands values. Its default
+  `TLSStore` lets one wildcard certificate serve every host.
+- **NGINX** — set `ingress.class: nginx` and use `nginx.ingress.kubernetes.io/*` annotations for
+  per-ingress tuning.
+
+Expose the controller's Service as an NLB in the controller's own chart values:
+
+```yaml
+service:
+  type: LoadBalancer
+  annotations:
+    service.beta.kubernetes.io/aws-load-balancer-type: nlb
+    service.beta.kubernetes.io/aws-load-balancer-scheme: internet-facing
+```
+
+Then set up certificates and DNS records for the OpenHands hostnames — see
+[DNS and TLS](/enterprise/k8s-install/dns-and-tls).
+
+## Next Steps
+
+<CardGroup cols={2}>
+  <Card title="Installing Sysbox" icon="cube" href="/enterprise/k8s-install/sysbox">
+    Install the sandbox runtime on your Sysbox node group.
+  </Card>
+  <Card title="DNS and TLS" icon="lock" href="/enterprise/k8s-install/dns-and-tls">
+    Automate records and certificates with external-dns and cert-manager.
+  </Card>
+  <Card title="Install with Helm" icon="ship" href="/enterprise/k8s-install/installation">
+    Deploy OpenHands once the cluster is ready.
+  </Card>
+  <Card title="Resource Limits" icon="gauge-high" href="/enterprise/k8s-install/resource-limits">
+    Size memory, CPU, and replicas for production.
+  </Card>
+</CardGroup>
diff --git a/enterprise/k8s-install/index.mdx b/enterprise/k8s-install/index.mdx
@@ -1,7 +1,7 @@
 ---
 title: Kubernetes Installation
 description: Deploy OpenHands Enterprise into your own Kubernetes cluster using Helm
 icon: dharmachakra
 ---

 OpenHands Enterprise can be deployed into an existing Kubernetes cluster using Helm.
@@ -35,8 +35,8 @@
 |-----------|-------------|
 | **OpenHands Server** | Main application server handling UI, API, and agent orchestration |
 | **Runtime API** | Manages sandbox lifecycle—provisioning, scaling, and cleanup |
 | **Runtimes (Sandboxes)** | Isolated containers where agents execute code |
 | **Keycloak** | Identity and access management |
 | **LiteLLM Proxy** | Routes requests to your LLM provider(s) |
 | **PostgreSQL** | Persistent storage for application data |
 | **Redis** | Caching and session management |
@@ -50,6 +50,22 @@
 
 ## Guides
 
+<Card title="Install with Helm" icon="ship" href="/enterprise/k8s-install/installation">
+  End-to-end installation instructions using your OpenHands Enterprise license.
+</Card>
+
+<Card title="Installing Sysbox" icon="cube" href="/enterprise/k8s-install/sysbox">
+  Install the Sysbox runtime so agent sandboxes can run securely.
+</Card>
+
+<Card title="DNS and TLS" icon="lock" href="/enterprise/k8s-install/dns-and-tls">
+  Automate DNS records and TLS certificates with external-dns and cert-manager.
+</Card>
+
+<Card title="Amazon EKS" icon="aws" href="/enterprise/k8s-install/eks">
+  EKS-specific setup — node groups, EBS storage, S3, RDS, and NLB ingress.
+</Card>
+
 <Card title="External PostgreSQL" icon="database" href="/enterprise/external-postgres">
   Configure OpenHands to use your own PostgreSQL database instead of the bundled instance.
 </Card>