Operate Runtime and the Web Console

Use this section after installation. Operating Caracal involves two surfaces with a deliberate split:

• The caracal runtime CLI manages the local stack’s lifecycle - starting, stopping, checking, upgrading - and launches workload processes with injected credentials. It never touches product state.
• The web console is the browser interface for everything product-shaped: zones, applications, providers, resources, policies, workloads, audit, and live intervention.

The pages below follow the work in the order an operator normally performs it, without mixing runtime lifecycle with product management.

Complete an Operator Journey

1. Choose the Right Surface. Use caracal for local lifecycle and process launch, the web console for human management, and the Control API or Admin SDK for automation.
2. Start and Check the Stack. Start services, wait for readiness, and open the packaged console.
3. Control Console Access. Admit the people who may sign in.
4. Use the Web Console. Finish account onboarding, create a zone, and complete guided setup.
5. Configure Workloads. Create a Launcher workload and credential bindings, or configure an SDK profile.
6. Run Workloads. Launch a command with short-lived credentials.
7. Inspect Diagnostics and Audit. Read dashboard posture, health, decisions, and request traces.
8. Manage Product Objects and Manage Runtime Authority. Maintain configuration and intervene in Subjects, Authority records, Sessions, Delegations, and Approvals.

Keep the Boundary Clear

Goal	Surface
Start, stop, check, upgrade, or purge the local stack	caracal
Launch one process with injected credentials	caracal run
Manage access to the console host	caracal allowlist
Create or change zones, applications, providers, resources, policies, workloads, or Control keys	Web console
Inspect and intervene in runtime authority	Web console
Automate product management	Control API or Admin SDK

The runtime CLI does not provide zone, policy, session, delegation, approval, audit, or Control management commands. This keeps local lifecycle independent of admin tokens, selected zones, and product credentials.

Local Addresses

After caracal up, open the packaged console at http://localhost:3001. The full loopback port map lives in Start and Check the Stack.

Do not call service ports merely because they are reachable locally. The console, SDKs, Gateway, Control API, and documented API surfaces provide the supported paths for their respective tasks.

Next Step

Start with Choose the Right Surface.