Fed-BioMed Deployment¶

Fed-BioMed can be deployed across a range of scenarios, from a single laptop for local testing to a distributed multi-institution federation. This page gives an overview of the available deployment modes and points to the relevant documentation for each.

Deployment Modes¶

There are two primary deployment modes, differentiated by whether network communications between components are authenticated and encrypted via a VPN.

Plain Docker Images¶

Fed-BioMed provides ready-to-use Docker images for each component (fedbiomed/node, fedbiomed/researcher). These images start components with minimal configuration and are suitable for:

• Testing and development — quickly spin up a local federated learning setup without manual dependency management
• Customized deployments — use the provided images as a base and extend them with additional packages, custom datasets, or organisation-specific configuration (see Extending Docker Images)
• Integration into larger systems — embed Fed-BioMed nodes or researchers inside an existing infrastructure by building on top of the base images

Plain Docker images do not provide VPN-based authentication between components. They are best suited for deployments on trusted networks or for testing purposes.

See the Docker deployment guide for full instructions.

Docker Images with VPN¶

For production deployments where data privacy and network security are required, Fed-BioMed provides a separate set of images that tunnel all inter-component communications through a WireGuard VPN with mutual endpoint authentication. This ensures that:

• Only authenticated nodes can join the federation
• All traffic between the researcher and nodes is encrypted
• Node data is protected even when components run on different machines across untrusted networks

This is the recommended mode for real-life deployments involving sensitive data or multiple data provider sites.

See the VPN deployment guide for full instructions.

Choosing a Scenario¶

For multi-machine setups without containers, components must be connected through a highly secure network. See the README for a brief description.

Refer to the security model and network communications documentation to understand which scenario best fits your requirements.