# Run your own, or let us.

Knit Spool is the same daemon either way. This is the plain comparison: what running one takes, and what Knit Hosted does in its place.

## One daemon, two ways to run it

Knit Spool is free software under the AGPL, published on GitHub as a container image for both x86 and ARM machines. Knit Hosted runs a public release of that image, pinned by digest — no fork, no private build. A device cannot tell the two apart, and Knit works with any mix of them.

## What running one takes

The README's quick start is one docker compose file. It brings the daemon up behind Caddy, which obtains the certificate and renews it; if you already run Nginx or Caddy, the daemon sits behind that instead. Configuration is environment variables only, and an invalid value refuses to start rather than running wrong.

- A box with a public address and a hostname that resolves to it. A 1 GB machine is enough; the repository ships an overlay sized for one.
- Docker, and a reverse proxy for TLS. The compose file includes one.
- A token, if you want the spool private. The daemon accepts two at once, so rotating one drops no device.
- Whatever monitoring you like: the daemon answers a health check and serves Prometheus metrics.

From then on the updates, the certificate, the data volume and the box itself are yours to look after — which is the whole of the trade, and for many people the right one.

## What Knit Hosted does instead

The same daemon, with the box taken off your hands.

- A hostname under spool.getknit.app — sixteen random characters that say nothing about you — with a certificate we renew, and never written into a public certificate log.
- Sizing: each plan sets a device ceiling, and the spool is placed on hardware measured to hold it.
- A public Knit Spool release pinned by digest, updated by us.
- The token, the commons and proof-of-work from a dashboard, applied to the running spool without a restart or a dropped device.
- Device and storage meters, and a month of usage charts.
- Hardware in the EU, behind Caddy for TLS.

What you give up is the box. A setting the dashboard does not offer is the daemon's own default, and a plan change is an email rather than a switch.

## The same protections

Blindness belongs to the daemon, not to whoever hosts it. Sealed frames, conversation ids that map to nobody, no rosters and no plaintext hold on your box and on ours alike. What differs is who can see the box. On Knit Hosted we hold the container, and we keep an email address, a billing reference and an instance id about you — never conversation ids, connection logs or client addresses.

## Moving between them

A Knit device can use several spools at once and treats them alike, so a move is adding a connection string rather than migrating anything. Point your devices at the new spool, let the conversations fill in from the devices in them, and retire the old one when you like. Nothing on a spool needs copying: your messages live on your devices.

## Which to pick

Run your own when you want every setting, already have a box, or simply prefer to. The daemon you would be trusting is the same one you can read on GitHub in either case. Choose Knit Hosted when you would rather not own a server: a spool starts once the payment lands, for one price a month, and runs to the end of the month you paid for when you cancel.

Next: [Knit Spool on GitHub](https://github.com/getknit/knit-spool) · [See pricing](https://hosted.getknit.app/pricing) · [What a spool is](https://hosted.getknit.app/what-is-a-spool)