Artificial Intelligence (AI) AWS

Cognee on AWS User Guide

| Product: Cognee 1.6.7 on Ubuntu 24.04 on AWS

Overview

This guide covers launching and using the Cognee 1.6.7 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg MLOps and Speech AI listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Cognee is an open source, Apache 2.0 licensed AI memory engine. You give it documents, notes, transcripts or web pages; it uses a language model to extract the people, organisations, products, places and events in them and the relationships between them into a knowledge graph, and embeds the same text into a vector store. Questions are answered from the graph and the vectors together, so an answer can follow how facts connect across your sources. A web interface lets you add data to datasets, explore the graph and ask questions, and everything is available over a REST API, so agents and applications can use Cognee as long term memory.

The image works with no API key on arrival: an open source language model (Qwen2.5 7B Instruct, Apache 2.0) is served by Ollama on the CPU and a local embedding model computes the vectors, so your data never leaves the instance unless you choose a hosted provider. Storage is embedded (SQLite, LanceDB and an embedded graph database), so there is no database server to run or secure.

Upstream Cognee ships a default account with a published password, and its sign up route is open. On this image both are closed before anything is reachable:

  • No default password, no first caller takeover. First boot runs Cognee on loopback only, gives its administrator account a password generated for your instance, proves that the published default password is refused and that sign up, password reset and e-mail verification are closed, and only then lets nginx start.
  • HTTPS from the first boot. nginx serves the web interface and the API on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS. Requests for a host name the instance does not serve are dropped.
  • Secrets unique to your instance. The administrator password, the token signing secrets, the key that guards the local model server and the TLS key are all generated on first boot. None is baked into the image, and no model provider key is shipped.
  • Loopback only, fenced by user. The API (8000), the web interface (3000) and the local model (11434) listen on 127.0.0.1 only, and nftables decides which service account may open each one: only nginx and the web interface reach the API, only nginx reaches the web interface, and only Cognee reaches the model, through a gateway that wants this instance's key.
  • An egress fence against server side request forgery. Cognee fetches the URLs you give it, so the cognee service account may reach public addresses only. The instance metadata service, link local addresses, loopback, private and reserved ranges, your VPC's own address blocks and IPv6 are refused, so a host name that resolves to an internal address, or a redirect to one, fails too. You can allow a private model server in one file (Step 10).
  • Request hygiene at nginx. nginx passes the real client address and a fixed host name, never a forwarding header a client sends, rejects encoded or doubled slashes and dot segments in the raw request line, refuses cross site requests, and rate limits sign in per IPv4 address and per IPv6 /64.
  • Built from source. The Cognee backend is installed from the v1.6.7 release with every Python dependency checked against the upstream lock file hashes (two raised within range to clear HIGH advisories), and the web interface is built from the same release's source, not a floating prebuilt image. Ubuntu 24.04 LTS is fully patched at build time and unattended security upgrades are on. No compiler is left on the image.

Cognee is an independent open source project by Topoteretes. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by Topoteretes or the Cognee project. It ships the free and open source Apache 2.0 licensed software.

What is on the image: Cognee 1.6.7 (/opt/cognee), the Cognee web interface built from source (/opt/cognee/ui, on Node.js 22), Ollama v0.40.15 with the CPU backend and the qwen2.5:7b-instruct-q4_K_M model, the BAAI/bge-small-en-v1.5 embedding model, nginx, nftables, the licences and build provenance in /usr/share/doc/cognee and /usr/share/cognee, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.xlarge

Prerequisites

  • An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet.
  • A security group that allows TCP 22 (SSH), TCP 443 (the web interface and API) and TCP 80 (redirects to HTTPS) from your own networks only.
  • m5.xlarge (4 vCPU, 16 GiB) or larger. The bundled 7B model uses about 5 GiB of memory while it is loaded, and building the graph needs the four vCPUs: on a 2 vCPU type such as m5.large a single model call outlasts Cognee's ten minute limit and cognify fails.

Be realistic about the bundled CPU model. It is there so the appliance is useful, private and free of API keys from the first minute, not to be fast. On m5.xlarge, building the memory for a three sentence document takes about fifteen to twenty minutes, and answering a question about it takes about a minute and a half; time grows with the amount of text. For production volumes, switch Cognee to a hosted model provider (Step 9; processing then takes seconds) or choose a larger instance type. No GPU is required.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Cognee 1.6.7 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.xlarge, your key pair and a security group as above.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.xlarge --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=cognee}]'

First boot takes a few minutes: it generates the instance's secrets and certificate, proves the access controls and then opens nginx. The bundled model then loads in the background. On a new instance that can take up to about ten minutes, because EBS restores the volume from its snapshot as it is first read; sudo systemctl is-active ollama prints active once the model is in memory.

Step 2: Connect to your instance

Version SSH user
Cognee 1.6.7 on Ubuntu 24.04 ubuntu 
ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check that Cognee answers

Check the service itself, not just the unit state. The services, then Cognee's health endpoint through nginx on HTTPS:

systemctl is-active cognee-egress-guard cognee-firstboot ollama ollama-proxy.socket cognee cognee-ui nginx
C=$(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1/health)
echo "GET /health -> HTTP $C"
[ "$C" = 200 ] && echo COGNEE_OK

active
active
active
active
active
active
active
GET /health -> HTTP 200
COGNEE_OK

Port 80 redirects to HTTPS. The API, the web interface and the model server answer on loopback only, and only for the service accounts that need them: any other user on the instance is refused, and nothing but 22, 80 and 443 listens on the network:

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
curl -s -o /dev/null -w "http://$H/ -> HTTP %{http_code} %{redirect_url}\n" --resolve "$H:80:127.0.0.1" "http://$H/"
sudo ss -Htln | awk '{print $4}' | sort -u | tr '\n' ' '; echo
A=$(sudo -u nobody curl -s -o /dev/null -m 4 -w '%{http_code}' http://127.0.0.1:8000/health || true)
U=$(sudo -u nobody curl -s -o /dev/null -m 4 -w '%{http_code}' http://127.0.0.1:3000/ || true)
M=$(sudo -u nobody curl -s -o /dev/null -m 4 -w '%{http_code}' http://127.0.0.1:11434/ || true)
echo "another user to the API :8000 -> HTTP $A, the UI :3000 -> HTTP $U, the model :11434 -> HTTP $M"
[ "$A" = 000 ] && [ "$U" = 000 ] && [ "$M" = 000 ] && echo FENCED_OK

http://<your-instance-public-dns>/ -> HTTP 301 https://<your-instance-public-dns>/
0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:11434 127.0.0.1:11435 127.0.0.1:3000 127.0.0.1:8000 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80
another user to the API :8000 -> HTTP 000, the UI :3000 -> HTTP 000, the model :11434 -> HTTP 000
FENCED_OK

HTTP 000 means the connection was refused: nothing reaches Cognee except through nginx.

Step 4: Get your URL and password

sudo cat /root/cognee-credentials.txt

The file is readable by root only. Your values differ:

# cognee - this instance's credentials (cloudimg, minted at first boot). Keep this file secret.
COGNEE_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
COGNEE_ADMIN_EMAIL=default_user@example.com
COGNEE_ADMIN_PASSWORD=<24 or more characters generated on your instance>
COGNEE_TLS_SHA256_FINGERPRINT=<unique to your instance>
# LLM: the bundled local model qwen2.5:7b-instruct-q4_K_M (Ollama). See the guide to use your own provider key.

The sign in name is Cognee's own administrator account, default_user@example.com; its password is unique to your instance and the upstream default password does not work (first boot proves that before nginx opens). COGNEE_URL uses the instance's public DNS name from EC2 instance metadata, and the certificate also names the public and private IP addresses. To serve your own DNS name, see Step 12.

Step 5: Sign in to the web interface

Open COGNEE_URL in your browser. The certificate is self signed for your instance, so the browser warns once; compare the fingerprint it shows with COGNEE_TLS_SHA256_FINGERPRINT before you accept it. Sign in with default_user@example.com and COGNEE_ADMIN_PASSWORD.

The Cognee sign in page served over HTTPS by the instance

After signing in you land on the overview. Panels that mention Cognee Cloud link to the upstream project's separate hosted service; it is not part of this image and nothing on the instance contacts it.

The Cognee overview after signing in

Add documents to a dataset, then ask questions about them under Search. Change the administrator password from the interface if you want one of your own; the credentials file keeps the original.

Step 6: The access model

Anonymous callers are refused by every route except the health check, and sign up, password reset and e-mail verification are closed:

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
R="--resolve $H:443:127.0.0.1"
ME=$(curl -sk $R -o /dev/null -w '%{http_code}' "https://$H/api/v1/users/me")
DS=$(curl -sk $R -o /dev/null -w '%{http_code}' "https://$H/api/v1/datasets")
REG=$(curl -sk $R -o /dev/null -w '%{http_code}' -H 'Content-Type: application/json' -d '{"email":"someone@example.com","password":"Some-password-1"}' "https://$H/api/v1/auth/register")
FGT=$(curl -sk $R -o /dev/null -w '%{http_code}' -H 'Content-Type: application/json' -d '{"email":"default_user@example.com"}' "https://$H/api/v1/auth/forgot-password")
DEF=$(curl -sk $R -o /dev/null -w '%{http_code}' --data-urlencode 'username=default_user@example.com' --data-urlencode 'password=default_password' "https://$H/api/v1/auth/login")
echo "anonymous /api/v1/users/me -> HTTP $ME"; echo "anonymous /api/v1/datasets -> HTTP $DS"
echo "POST /api/v1/auth/register -> HTTP $REG"; echo "POST /api/v1/auth/forgot-password -> HTTP $FGT"
echo "sign in with the upstream default password -> HTTP $DEF"
[ "$ME" = 401 ] && [ "$DS" = 401 ] && [ "$REG" = 403 ] && [ "$FGT" = 403 ] && [ "$DEF" = 400 ] && echo ACCESS_MODEL_OK

anonymous /api/v1/users/me -> HTTP 401
anonymous /api/v1/datasets -> HTTP 401
POST /api/v1/auth/register -> HTTP 403
POST /api/v1/auth/forgot-password -> HTTP 403
sign in with the upstream default password -> HTTP 400
ACCESS_MODEL_OK
  • Authentication is required. REQUIRE_AUTHENTICATION=true with Cognee's multi user access control on: each user sees only their own datasets unless access is shared.
  • Sign up is closed. Only the administrator adds accounts, from the instance itself (Step 11). Password reset and e-mail verification are closed too, because the image runs no mail server.
  • The web interface is behind sign in. nginx asks Cognee whether the caller is signed in before it forwards anything but a page load to the interface.

Step 7: Use the API

Everything in the interface is available over the REST API. Sign in once and keep the token in a file only you can read. The password is read from the credentials file and passed on standard input, so it never appears in a command line:

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
sudo sed -n 's/^COGNEE_ADMIN_PASSWORD=//p' /root/cognee-credentials.txt | tr -d '\n' \
  | curl -s --cacert /etc/nginx/ssl/cognee.crt --resolve "$H:443:127.0.0.1" "https://$H/api/v1/auth/login" \
      --data-urlencode 'username=default_user@example.com' --data-urlencode 'password@-' \
  | jq -r .access_token > ~/.cognee-token
chmod 600 ~/.cognee-token
curl -s --cacert /etc/nginx/ssl/cognee.crt --resolve "$H:443:127.0.0.1" -H "Authorization: Bearer $(cat ~/.cognee-token)" \
  "https://$H/api/v1/users/me" | jq '{email, is_superuser}'

{
  "email": "default_user@example.com",
  "is_superuser": true
}

For scripts and agents, create a long lived key on the API Keys page and send it as the X-Api-Key header instead of a bearer token.

Step 8: Add a document, build the memory, ask a question

Add a short document to a dataset called quickstart:

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
cat > /tmp/northwind.txt <<'DOC'
Northwind Analytics is a data consultancy founded in 2019 by Priya Raman in Leeds.
Its flagship product is Lighthouse, a forecasting tool used by the Harbour Rail company.
In 2024 Northwind opened a second office in Bristol, led by Tomas Ferreira.
DOC
curl -s --cacert /etc/nginx/ssl/cognee.crt --resolve "$H:443:127.0.0.1" -H "Authorization: Bearer $(cat ~/.cognee-token)" \
  -F 'datasetName=quickstart' -F 'data=@/tmp/northwind.txt' "https://$H/api/v1/add" | jq -r .status

PipelineRunCompleted

cognify reads the dataset with the language model and builds the graph. With the bundled CPU model this takes about fifteen to twenty minutes on m5.xlarge, so start it in the background and check its status:

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
A=(--cacert /etc/nginx/ssl/cognee.crt --resolve "$H:443:127.0.0.1" -H "Authorization: Bearer $(cat ~/.cognee-token)")
curl -s "${A[@]}" -H 'Content-Type: application/json' -d '{"datasets":["quickstart"],"run_in_background":true}' \
  "https://$H/api/v1/cognify" | jq -c '[.[].status] | unique'

["PipelineRunStarted"]

/api/v1/datasets/status reports DATASET_PROCESSING_STARTED while the graph is being built and DATASET_PROCESSING_COMPLETED when it is ready. Then ask a question. This waits for the graph first (up to 30 minutes):

# ask-after-cognify
H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
A=(--cacert /etc/nginx/ssl/cognee.crt --resolve "$H:443:127.0.0.1" -H "Authorization: Bearer $(cat ~/.cognee-token)")
for i in $(seq 1 180); do
  curl -s "${A[@]}" "https://$H/api/v1/datasets/status" | jq -e 'length > 0 and all(.[]; test("COMPLETED"))' > /dev/null && break
  sleep 10
done
curl -s "${A[@]}" -H 'Content-Type: application/json' \
  -d '{"query":"Who founded Northwind Analytics, and in which city?","datasets":["quickstart"]}' \
  "https://$H/api/v1/search" | jq -r '.[0].search_result[0]'

Priya Raman founded Northwind Analytics in Leeds.

The answer's wording varies from run to run; the facts come from your document.

The dataset and its documents also appear under Datasets in the web interface, where you can add files and run the same steps without the API:

The quickstart dataset on the Cognee Datasets page

Step 9: Use your own model provider (optional)

The bundled model keeps everything on the instance. For faster processing and stronger answers, point Cognee at a hosted provider by editing /etc/cognee/cognee.env (readable by root only) and replacing the LLM_ lines. Keep the local embedding settings unchanged: changing the embedding model on a dataset that already has vectors means rebuilding it. For example, OpenAI:

LLM_PROVIDER=openai
LLM_MODEL=openai/gpt-4o-mini
LLM_ENDPOINT=
LLM_API_KEY=sk-your-openai-key

Then restart the API, and once you no longer use the local model, stop it to free its memory:

sudo systemctl restart cognee
sudo systemctl disable --now ollama-proxy.socket ollama

Hosted providers are public addresses, which the egress fence allows. Credentials from the instance role are not available to Cognee, because the metadata service is blocked for it; use an API key.

Step 10: A model server inside your VPC

The egress fence lets Cognee reach public addresses only. To use a private model server, for example an Ollama or vLLM host at 10.0.5.25, list its address in /etc/cloudimg/cognee-egress-allow and reload the fence:

echo '10.0.5.25/32' | sudo tee -a /etc/cloudimg/cognee-egress-allow
sudo systemctl reload cognee-egress-guard

The metadata service, link local, loopback and multicast ranges are always refused and cannot be listed.

Step 11: Add users

Sign up is closed to the network. Create more accounts from the instance itself as root, where Cognee's registration route answers on the loopback address:

sudo curl -s -X POST http://127.0.0.1:8000/api/v1/auth/register \
  -H 'Content-Type: application/json' \
  -d '{"email":"analyst@example.com","password":"<a-strong-password>"}'

Only root, nginx and the web interface may open port 8000, so no other account on the instance can use that route.

Step 12: Your own DNS name and certificate

Point a DNS record at the instance, then set the name Cognee is served as. This mints a new self signed certificate for the name, updates nginx and the URL and fingerprint in /root/cognee-credentials.txt, and keeps the name across reboots:

sudo cognee-set-hostname <your-domain>

To use a certificate from your own or a public certificate authority instead, install it over the generated pair and reload nginx (running cognee-set-hostname again replaces it with a self signed one):

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/cognee.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/cognee.key
sudo nginx -t && sudo systemctl reload nginx

Step 13: Security checks

The egress fence in force, with each rule's purpose:

sudo nft list table inet cloudimg_cognee_egress | grep -oE 'comment "cloudimg-[a-z0-9]+"' | sort -u

comment "cloudimg-allow"
comment "cloudimg-allow6"
comment "cloudimg-fence"
comment "cloudimg-ipv6"
comment "cloudimg-local11434"
comment "cloudimg-local11435"
comment "cloudimg-local3000"
comment "cloudimg-local8000"
comment "cloudimg-loopback"
comment "cloudimg-metadata"
comment "cloudimg-metadata6"
comment "cloudimg-modelgate"
comment "cloudimg-multicast"
comment "cloudimg-private"
comment "cloudimg-reply"
comment "cloudimg-vpc"

The metadata service and your VPC are refused to Cognee, while root on the same instance reaches them (the control). The instance's own SSH port stands in for any service in your VPC:

I=$(sudo curl -s -m 4 -o /dev/null -w '%{http_code}' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
N=$(sudo setpriv --reuid=cognee --regid=cognee --clear-groups curl -s -m 4 -o /dev/null -w '%{http_code}' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token || true)
P=$(hostname -I | awk '{print $1}')
VR=$(sudo timeout 4 bash -c "exec 3<>/dev/tcp/$P/22" 2>/dev/null && echo OPEN || echo REFUSED)
VN=$(sudo setpriv --reuid=cognee --regid=cognee --clear-groups timeout 4 bash -c "exec 3<>/dev/tcp/$P/22" 2>/dev/null && echo OPEN || echo REFUSED)
echo "metadata service: root HTTP $I, cognee HTTP $N"
echo "own address port 22: root $VR, cognee $VN"
[ "$I" = 200 ] && [ "$N" = 000 ] && [ "$VR" = OPEN ] && [ "$VN" = REFUSED ] && echo EGRESS_FENCE_OK

metadata service: root HTTP 200, cognee HTTP 000
own address port 22: root OPEN, cognee REFUSED
EGRESS_FENCE_OK

nginx judges the raw request line before it decodes or normalises the path, so encoded slashes, dot segments and doubled slashes are refused (--path-as-is sends the path exactly as written):

H=$(sudo sed -n 's#^COGNEE_URL=https://\([^/]*\)/.*#\1#p' /root/cognee-credentials.txt)
R="--resolve $H:443:127.0.0.1"
OK=1
for p in '/api/v1/auth/%72egister' '/api/v1//auth/register' '/api/v1/x/../auth/register' '/api/v1/auth%2fregister' '/API/V1/AUTH/REGISTER'; do
  c=$(curl -sk $R --path-as-is -o /dev/null -w '%{http_code}' -H 'Content-Type: application/json' -d '{}' "https://$H$p")
  echo "POST $p -> HTTP $c"
  case "$c" in 400|403|404) ;; *) OK=0 ;; esac
done
c=$(curl -sk $R -o /dev/null -w '%{http_code}' "https://$H/health"); echo "GET /health -> HTTP $c"
[ "$OK" = 1 ] && [ "$c" = 200 ] && echo RAW_LINE_OK

POST /api/v1/auth/%72egister -> HTTP 403
POST /api/v1//auth/register -> HTTP 400
POST /api/v1/x/../auth/register -> HTTP 400
POST /api/v1/auth%2fregister -> HTTP 400
POST /API/V1/AUTH/REGISTER -> HTTP 403
GET /health -> HTTP 200
RAW_LINE_OK

Sign in is rate limited to 20 attempts a minute per client, with a burst of 20, and every request to 3,000 a minute: an IPv4 client is counted by its address and an IPv6 client by its /64 network, so rotating addresses inside one /64 does not reset the limit. A client over the limit gets HTTP 429.

The services run as unprivileged accounts in systemd sandboxes that are blocked from the metadata service, and the secrets are readable by root only:

systemctl show cognee -p User -p NoNewPrivileges -p ProtectSystem -p IPAddressDeny
sudo stat -c '%U:%G %a %n' /etc/cognee /etc/cognee/cognee.env /var/lib/cognee /root/cognee-credentials.txt

IPAddressDeny=168.63.129.16/32 224.0.0.0/4 fd00:ec2::254/128 198.18.0.0/15 192.0.0.0/24 240.0.0.0/4 169.254.169.254/32
User=cognee
ProtectSystem=strict
NoNewPrivileges=yes
root:root 700 /etc/cognee
root:root 600 /etc/cognee/cognee.env
cognee:cognee 750 /var/lib/cognee
root:root 600 /root/cognee-credentials.txt

Step 14: What is in the image, and under what licence

/opt/cognee/venv/bin/python -c 'import importlib.metadata as m; print("cognee", m.version("cognee"))'
/opt/ollama/bin/ollama --version 2>/dev/null | sed -n 's/.*version is /ollama /p'
ls /usr/share/doc/cognee
cat /usr/share/doc/cognee/BUILD-PROVENANCE.txt

cognee 1.6.7
ollama 0.40.15
BUILD-PROVENANCE.txt
LICENSE
NOTICE.md
uv.lock
cognee 1.6.7 (cloudimg build)
source: https://github.com/topoteretes/cognee/archive/refs/tags/v1.6.7.tar.gz
source sha256: 0eb0224fc1e225e455fc60c2ae403a47f122a763e86dbb7e754aab97458f0797
tag commit: eaa33be5c58cd14584e64e3e0ed2e1479472ee09
uv.lock sha256: 7f5600a58d2aeed2a457cd5639ab835c5a999119e74a1a6d7a806d3e2edad26b (uv 0.13.7 sync --frozen --no-dev --no-editable)
raised within range (HIGH advisories): pypdf 6.21.2 -> 6.21.4, dnspython 2.8.0 -> 2.9.0 (sha256-pinned wheels)
ladybug JSON extension: linux_amd64 libjson from https://files.pythonhosted.org/packages/py3/c/cognee/cognee-1.6.7-py3-none-any.whl (sha256 fdda7a9a58d463ab4631e817748162e084cf806c597da71d38cac13b2c7e2a51)
UI: cognee-frontend @ v1.6.7, package-lock sha256 f0ea05ef9a48ccf96d687d10f7dace6c31704133bdd936d65d5fda5e34b01421, Node v22.23.4; proprietary fonts, logos
    and avatar removed; server routes pinned to 127.0.0.1:8000; image optimiser disabled
Ollama v0.40.15 (CPU backend only), model qwen2.5:7b-instruct-q4_K_M layer sha256:2bada8a7450677000f678be90653b85d364de7db25eb5ea54136ada5f3933730 (Apache-2.0)
embedding model BAAI/bge-small-en-v1.5 via Qdrant/bge-small-en-v1.5-onnx-Q (MIT)

Cognee is licensed under the Apache License 2.0. The Qwen2.5 7B Instruct model is Apache 2.0, the embedding model and Ollama are MIT. BUILD-PROVENANCE.txt records exactly how the image was built: the source archive and its checksum, the lock files the dependencies were checked against, and the model digests. The web interface's upstream source includes fonts under proprietary licences and third party logos; cloudimg removes them at build time and the interface uses the open source Geist font instead.

Day to day operation

systemctl status cognee --no-pager | head -3
sudo journalctl -u cognee -n 20 --no-pager | tail -3
  • Restart the API with sudo systemctl restart cognee and the web interface with sudo systemctl restart cognee-ui; reload nginx with sudo systemctl reload nginx.
  • Data (accounts, documents, the graph and the vectors) lives in /var/lib/cognee. Model files live in /var/lib/ollama.
  • Back up by stopping the API briefly and copying the data directory together with /etc/cognee/cognee.env, which holds the token secrets:
sudo systemctl stop cognee-ui cognee
sudo tar czf /root/cognee-backup-$(date +%F).tgz -C /var/lib cognee -C /etc cognee
sudo systemctl start cognee cognee-ui
  • Upgrades. Unattended upgrades keep Ubuntu and nginx patched. To move to a newer Cognee release, back up first and read the upstream release notes.

Troubleshooting

  • Nothing answers on port 443. nginx starts only after first boot has completed: sudo systemctl status cognee-firstboot --no-pager and sudo journalctl -u cognee-firstboot --no-pager | tail -30. If first boot fails it leaves nothing listening on purpose.
  • The browser warns about the certificate. Expected until you install your own certificate; compare the fingerprint with COGNEE_TLS_SHA256_FINGERPRINT.
  • Search returns nothing. The dataset's graph is not built yet: check /api/v1/datasets/status (Step 8) and wait for DATASET_PROCESSING_COMPLETED.
  • Processing is slow. Expected with the bundled CPU model; see Step 9 to switch to a hosted provider.
  • cognify fails with "LLM connection test timed out". The bundled model is still loading on a new instance: wait until sudo systemctl is-active ollama prints active, then run cognify again.
  • The log shows litellm.Timeout after 600 seconds, then Retrying. Normal on a 4 vCPU instance: the first long model call can outlast the limit, and the retry reuses the work already done. The status stays DATASET_PROCESSING_STARTED until the retry finishes.
  • cognify ends in DATASET_PROCESSING_ERRORED and the log shows litellm.Timeout after 600 seconds. The instance has too few vCPUs for the bundled model: stop it, change the instance type to m5.xlarge or larger, start it and run cognify again (sudo journalctl -u cognee --no-pager | grep -i timeout).
  • Adding a URL to a private address fails quickly. The egress fence refuses private and VPC addresses by default; allow the server in /etc/cloudimg/cognee-egress-allow (Step 10).
  • HTTP 429 on sign in. nginx allows 20 sign in attempts a minute per IPv4 address or IPv6 /64; wait a minute.

Security recommendations

  • Allow ports 22, 80 and 443 in the security group from your own networks only.
  • Create a separate account for each person (Step 11) and change the administrator password after first sign in.
  • Use your own DNS name and a certificate your clients trust (Step 12).
  • List only the private servers you need in the egress allow-list.
  • Keep the operating system patched; unattended security upgrades are on.

Support and licensing

Cognee is open source under the Apache 2.0 licence; there is no per user licence fee. The AMI price covers cloudimg's hardening, first boot setup and support.

  • Email: support@cloudimg.co.uk
  • Website: https://www.cloudimg.co.uk
  • Support: 24/7, with a 24 hour response SLA