---
alias: operation-guide-messtackcomponents
tags:
- containerized environments
description: "This document details the container-based Critical Manufacturing MES stack, including its components and configurations for network routing and authentication"
---

# Customer Environment MES Stack

This page lists all the containers that are running inside the Critical Manufacturing MES stack, with an explanation of its purpose as well as specific configurations for each container.

!!! info
	There can be multiple environments deployed for any infrastructure belonging to a single customer, each with its own URL.

```mermaid
graph LR
subgraph Customer Environment
    Env[Environment Manager]
    UI[UI]
    Host[Host]
    Help[Project Help]
    Grafana[Grafana]
    Postgres[PostgreSQL]
    SecurityPortal[Security Portal]
    Traefik[Traefik]
    TraefikForwardAuth[Traefik Forward Auth]
    Bus[MessageBus]
    DiscoveryService[Discovery Service]
    SQL[SQL Server]
    ConnectIoTManager2[Automation Manager Controller]
    IoTEventProcessor[IoT Event Processor]
    MCAD[MCAD]
    LBOGenerator[LBO Generator]
    MESScheduler[MES Scheduler]
    end
subgraph DataPlatform
    direction RL
    ClickHouse[ClickHouse]
    Kafka[Kafka]
    RabbitMQ[RabbitMQ]
    S3[Storage]
    DataManager[Data Manager]
    HouseKeeper[HouseKeeper]
    AggregationEngine[Aggregation Engine]
    Cube[Cube]
    EDPConnector[EDP Connector]
    IoTEventRules[IoT Event Rules]
    UNSConnector[UNS Connector]
    MLAgent[ML Platform Agent]
    MLPlatformTraining[ML Platform Training]
    end
subgraph GenAI
    RAG[RAG Service]
    Ollama[Ollama]
    LibreChat[LibreChat]
    MCPServers[MCP Servers]
    end
    
    Traefik --> TraefikForwardAuth
    TraefikForwardAuth --> Traefik
    Traefik --> UI
    Traefik --> Host
    Traefik --> Help
    Traefik --> Grafana
    Traefik --> SecurityPortal
    Traefik --> Bus
    Traefik --> DataPlatform
    Traefik --> GenAI
    Traefik --> LBOGenerator
    Traefik --> Env
    Host -.-> SQL
    SQL -.-> Env
    Host -.-> Env
    UI -.-> Env
    Help -.-> Env
    Grafana -.-> Env
    Grafana -.-> Postgres
    SecurityPortal -.-> Env
    Bus -.-> Env
    DataPlatform -.-> Env
    ConnectIoTManager2 -.-> Env
    IoTEventProcessor -.-> Env
    MCAD -.-> Env
    GenAI -.-> Env
    DiscoveryService -.-> Env
    LBOGenerator -.-> Env
    MESScheduler -.-> Env
    
classDef mermaid_title color:#000, fill:#fafafa, stroke:#fafafa, stroke-width:0x, font-size:100%, font-weight:200;
classDef mermaid_start color:#000, fill:#fafafa, stroke:#fafafa, color:#fafafa, stroke-width:0x, font-size:100%, visibility: hidden;
classDef mermaid_businessdata color:#000, fill:#65CDE8, stroke:#65CDE8, stroke-width:0px, font-size:100%;
classDef mermaid_nonbusinessdata color:#000, fill:#B7DEE8, stroke:#B7DEE8, stroke-width:0px, font-size:100%;
classDef mermaid_entity color:#000, fill:#FB9F53, stroke:#FB9F53, stroke-width:0px, font-size:100%;
classDef mermaid_entitylinked color:#000, fill:#FCD5B5, stroke:#FCD5B5, stroke-width:0px, font-size:100%;
classDef mermaid_context color:#000, fill:#B9CDE5, stroke:#B9CDE5, stroke-width:0px, font-size:100%;
classDef mermaid_optional color:#000, fill:#B7DEE8, stroke:#65CDE8, stroke-width:1px, font-size:100%, stroke-dasharray: 5 5;
classDef mermaid_state color:#000, fill:#d7e4bd, stroke:#000, stroke-width:1px, font-size:100%, font-weight:300;

class UI,Host,Help,SecurityPortal,ConnectIoTManager2,IoTEventProcessor,MCAD,Bus,Grafana,DiscoveryService,LBOGenerator,MESScheduler mermaid_businessdata
class Env,Traefik,TraefikForwardAuth mermaid_entitylinked
class ClickHouse,Kafka,RabbitMQ,S3,DataManager,HouseKeeper,AggregationEngine,Cube,EDPConnector,IoTEventRules,UNSConnector,MLAgent,MLPlatformTraining,RAG,Ollama,LibreChat,MCPServers mermaid_nonbusinessdata
class SQL mermaid_optional
class Postgres mermaid_nonbusinessdata

click Traefik "#traefik"
click TraefikForwardAuth "#traefik-forward-auth"
click Bus "#mes-message-bus"
click Host "#mes-host"
click Env "#environment-manager"
click SecurityPortal "#security-portal"
click UI "#mes-gui"
click Help "#project-help"
click Grafana "#grafana"
click Postgres "#postgresql"
click SQL "#sql-server"
click ClickHouse "#clickhouse"
click Kafka "#kafka"
click RabbitMQ "#rabbitmq"
click S3 "#storage"
click ConnectIoTManager2 "#automation-manager-controller"
click IoTEventProcessor "#iot-event-processor"
click MCAD "#mcad"
click LBOGenerator "#lbo-generator"
click MESScheduler "#mes-scheduler"
click DataManager "#data-manager"
click DiscoveryService "#discovery-service"
click HouseKeeper "#housekeeper"
click AggregationEngine "#aggregation-engine"
click Cube "#cube"
click EDPConnector "#edp-connector"
click IoTEventRules "#iot-event-rules"
click UNSConnector "#uns-connector"
click MLAgent "#ml-platform-agent"
click MLPlatformTraining "#ml-platform-training"
click RAG "#rag-service"
click Ollama "#ollama"
click LibreChat "#librechat"
click MCPServers "#mcp-servers"
```

## Core Components

### Traefik

Manages incoming network traffic, acting as a reverse proxy by forwarding requests to services based on routing rules. For more information, see <https://doc.traefik.io/traefik/>.

Each MES environment includes a Traefik instance that is entirely responsible for that same stack. A top-level Ingress Controller is required in order to route incoming traffic to the appropriate MES stack's Traefik.
Security must be dealt with at this first level, such as handling certificate validations and ensuring secure connections.

!!! note
    The ingress controller is customer-managed: you are responsible for installing, configuring, and maintaining it, together with its external endpoint, DNS, and TLS certificates. For more information, see [Ingress Controller Requirements](https://portal.criticalmanufacturing.com/Help/devops-center/deployment-targets/kubernetes-section/ingress-controller/).

!!! warning
    If your ingress controller is **Traefik**, you must define an entrypoint named `web-secure`, for example:

    ```yaml
    spec:
      containers:
      - args:
        - --entrypoints.web-secure.address=:8443
    ```

    This is required because our MES stack references `web-secure` in `traefik.ingress.kubernetes.io/router.entrypoints`.  
    If the entrypoint is missing or named differently, HTTPS traffic will fail.

Example:

* `http://<domain_one>/` - the Traefik instance inside the MES stack sends this request to the proper container inside the MES stack for `domain_one` that handles the `/` path, which in this case is the `UI`.
* `http://<domain_one>/api` - the Traefik instance inside the MES stack sends this request to the proper container inside the MES stack for `domain_one` that handles the `api` path, which in this case is the `host`.
* `http://<domain_two>/Help` - the Traefik instance inside the MES stack sends this request to the container for `domain_two` that handles the `Help` path, which provides project-specific documentation.

```mermaid
graph LR
subgraph Cluster
    Traefik[Ingress Controller]
end
subgraph mes_instance_two
    Traefik3[Traefik]
    ui3["UI"]
    api3["Host"]
    help3["Project Help"]
end
subgraph mes_instance_one
    Traefik2[Traefik]
    ui2["UI"]
    api2["Host"]
    help2["Project Help"]
end
Traefik --->|https://mes_instance_one.domain.local/|Traefik2
Traefik --->|https://mes_instance_one.domain.local/api|Traefik2
Traefik --->|https://mes_instance_two.domain.local/Help|Traefik3
Traefik2 -.->|/|ui2
Traefik2 -.->|/api|api2
Traefik3 -.->|/Help|help3

classDef mermaid_title color:#000, fill:#fafafa, stroke:#fafafa, stroke-width:0x, font-size:100%, font-weight:200;
classDef mermaid_start color:#000, fill:#fafafa, stroke:#fafafa, color:#fafafa, stroke-width:0x, font-size:100%, visibility: hidden;
classDef mermaid_businessdata color:#000, fill:#65CDE8, stroke:#65CDE8, stroke-width:0px, font-size:100%;
classDef mermaid_nonbusinessdata color:#000, fill:#B7DEE8, stroke:#B7DEE8, stroke-width:0px, font-size:100%;
classDef mermaid_entity color:#000, fill:#FB9F53, stroke:#FB9F53, stroke-width:0px, font-size:100%;
classDef mermaid_entitylinked color:#000, fill:#FCD5B5, stroke:#FCD5B5, stroke-width:0px, font-size:100%;
classDef mermaid_context color:#000, fill:#B9CDE5, stroke:#B9CDE5, stroke-width:0px, font-size:100%;
classDef mermaid_optional color:#000, fill:#B7DEE8, stroke:#65CDE8, stroke-width:1px, font-size:100%, stroke-dasharray: 5 5;
classDef mermaid_state color:#000, fill:#d7e4bd, stroke:#000, stroke-width:1px, font-size:100%, font-weight:300;
class Traefik,Traefik2,Traefik3 mermaid_entity
class api2,api3,help2,help3,ui2,ui3 mermaid_businessdata
```

!!! info
	These rules and the configurations of which addresses are mapped to which internal containers are defined in Traefik Ingress Routes and Middlewares (for Kubernetes) and Traefik configuration file (for DockerSwarm). Both can be accessed through any container orchestrator management tool.

### Traefik Forward Auth

Provides support to authentication through Critical Manufacturing Security Portal, equivalent to an IIS module that is installed and running in traditional installations. Every request to a protected route is forwarded by Traefik to Traefik Forward Auth to ascertain whether that request has valid authentication.

Relevant folders in container volumes:

| Path        | Description                 |
| ----------- | --------------------------- |
| `/opt/app/` | Main application directory. |

Table: Traefik Forward Auth relevant folders for containerized environments

### Environment Manager

The Environment Manager works as an overseer of the entire MES stack and coordinates as a primary information point from which all other containers depend. It performs operations like the actual installation setup application of the traditional environments, with added functionality, wherein every time the stack is started, all containers have the same entrypoint (a small piece of executable code) that queries the Environment Manager container to see whether the system is installed and running and also if there are any customization packages that need to be installed for any specific container. When the Environment Manager responds to the queries from all other containers to indicate that the system has been installed, the other containers can safely run.

!!! note
    If outbound access to the Customer Portal's DevOps Center requires a proxy, configure the **HTTP Proxy URL** and **HTTPS Proxy URL** settings (**Outbound Proxy** group) when creating the environment.

```mermaid
sequenceDiagram
    Container in MES Stack->>Environment Manager: Is MES installed?
    activate Environment Manager
    Environment Manager-->>Container in MES Stack: Not yet, checking
    Environment Manager-->>Container in MES Stack: Yes, it is, you can run safely
    deactivate Environment Manager
    activate Container in MES Stack
    Container in MES Stack->>+Environment Manager: Are there any custom components I should know about?
    deactivate Container in MES Stack
    Environment Manager-->>Container in MES Stack: Yes, here they are
    activate Environment Manager
    Container in MES Stack->>Environment Manager: Ok, installing before running the main application
    deactivate Environment Manager
```

Customization packages are usually stored in one of the volumes bound by the Environment Manager and are accessible through it.

Relevant folders in container volumes:

| Path             | Description                                                                                                               |
| ---------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `/opt/app/`      | Main application directory.                                                                                               |
| `/var/opt/envmanager/installation/` | Installation data (volume `installation_data`). Includes a folder per system, named after the system name. |
| `/opt/connectiot/` | Connect IoT repository share (volume `connect_iot_repo`), shared between the Host and the Environment Manager. |
| `/var/log/cmf/`  | If the volume type selected for logs is 'None', applications will not log to a file, and therefore, this location will be empty. Otherwise, the location will be shared with several containers, with each container having its own separate folder inside it.  |

Table: Environment Manager relevant folders for containerized environments

### Security Portal

A multi-tenant application that acts as an identity management system. For more information, see [Security Portal](../security/security-portal/index.md).

Relevant folders in container volumes:

| Path            | Description                                                                                                               |
| --------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `/opt/app/`     | Main application directory.                                                                                               |
| `/var/opt/app/*.pem` | Token signing key pairs (mounted as secrets).                                                                        |

Table: Critical Manufacturing MES Security Portal relevant folders for containerized environments

### MES Host

The set of services that operate the core of Critical Manufacturing MES services and orchestration, exposing a public API for external access.

Since version 12.0, documents and attachments are stored in the S3-compatible object storage instead of a volume mounted by the Host.

Relevant folders in container volumes:

| Path                | Description                                                                                                             |
| ------------------- | ----------------------------------------------------------------------------------------------------------------------- |
| `/opt/app/`         | Main application directory (includes Host config file and customization libraries).                                      |
| `/opt/connectiot/` | Connect IoT repository share (volume `connect_iot_repo`), shared between the Host and the Environment Manager. |
| `/var/log/cmf/`     | Logging location, shared with several containers, where each container will have its own separate folder inside this one. |

Table: Critical Manufacturing MES Host relevant folders for containerized environments

### MES GUI

Web server used as the main visual entrypoint for the Critical Manufacturing MES.

Relevant folders in container volumes:

| Path            | Description                                                                                                              |
| --------------- | ------------------------------------------------------------------------------------------------------------------------ |
| `/opt/app/`     | Main application directory.                                                                                              |

Table: Critical Manufacturing MES GUI relevant folders for containerized environments

### Project Help

Optional project-specific documentation for the local Critical Manufacturing MES installation, exposed under the `Help` path.

Relevant folders in container volumes:

| Path            | Description                                                                                                               |
| --------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `/app/`         | Main application directory.                                                                                               |
| `/var/log/cmf/` | Logging location, shared with several containers, where each container will have its own separate folder inside this one. |

Table: Project Help relevant folders for containerized environments

### MES Message Bus

A high-performance publish and subscribe message bus. For more information, see [Message Bus](../../application-administration/messagebus.md).

Relevant folders in container volumes:

| Path            | Description                                                                                                               |
| --------------- | ------------------------------------------------------------------------------------------------------------------------- |
| `/opt/app/`     | Main application directory.                                                                                               |
| `/var/log/cmf/` | Logging location, shared with several containers, where each container will have its own separate folder inside this one. |

Table: Critical Manufacturing MES Message Bus relevant folders for containerized environments

### Grafana

Visualization framework that allows you to query, visualize metrics from the Critical Manufacturing MES through widgets and dashboards.

Grafana has no volume of its own: its configuration (users, dashboards, and data sources) is stored in a dedicated database in the [PostgreSQL](#postgresql) container, and users authenticate through the Security Portal.

### PostgreSQL

PostgreSQL database server that stores the Grafana configuration database. When the GenAI package is installed, it also stores the LibreChat data through the `ferretdb` container.

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/var/lib/postgresql` | Database data (volume `postgres-storage`). |

Table: PostgreSQL relevant folders for containerized environments

### SQL Server

Installed optionally through DevOps Center, this container holds an instance of SQL Server that can be used only with the Online database. It is lacking:

* Reports
* ODS database
* DWH database
* Analysis Services

!!! info
	This container is the only one that can be configured to have an open port for the outside world. This port is used to access the database through SQL Server Management Studio, which can access the server through the name: `machine_name,[port]`.

!!! warning
	Be aware that the character separator between machine name and port is a comma (`,`) and not the traditional colon (`:`).

Relevant folders in container volumes:

| Path                   | Description                                                                             |
| ---------------------- | --------------------------------------------------------------------------------------- |
| `/var/opt/mssql/data/` | MSSQL Data files.                                                                       |

Table: SQL Server relevant folder for containerized environments

### Discovery Service

Enables the Message Bus gateway replicas to discover each other: each replica registers with the Discovery Service and receives the addresses of the other replicas to form the Message Bus cluster. It is an internal component of the stack and is not exposed externally through the ingress router.

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app/` | Main application directory. |
| `/var/log/cmf/` | Logging location, shared with several containers, where each container will have its own separate folder inside this one. |

Table: Discovery Services relevant folders for containerized environments

### LBO Generator

The service responsible for generating and serving LBOs.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app` | Main application directory. |
| `/opt/lbogen/output` | Intermediate artifacts location. |
| `/opt/lbogen/assemblies` | Host assemblies location. |
| `/opt/lbogen/lbos` | Generated LBO packages (zip files) available for download. |

Table: LBO Generator relevant folders for containerized environments

### MES Scheduler

:lock: Basic Scheduling

The service responsible for MES Scheduling operations.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app` | Main application directory (Scheduling Engine API). |
| `/opt/app/Scheduling` | Scheduling Engine binaries. |

Table: MES Scheduler relevant folders for containerized environments

### Automation Manager Controller

:lock: Connect IoT

A Kubernetes controller that watches the **Automation Managers** with the AutomaticDeploy deployment mode and deploys or undeploys their containers inside the cluster. Only the managers in the configured worker pool (`General` by default) are handled. It runs with a dedicated service account and role. For more information, see [[user-guide-automation-manager-deploy]].

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app` | Main application directory. |

Table: Automation Manager Controller relevant folders for containerized environments

### IoT Event Processor

A Connect IoT Automation Manager deployed in standalone mode from the `criticalmanufacturing/ioteventprocessor` image. In the MES stack, this container is named `connectiot-manager`. It consumes the IoT event topics from Kafka, uses RabbitMQ for its job queue, and runs the Data Platform workflows of the Automation Controllers that subscribe to each **IoT Event Definition**. The same image is deployed twice more by the Data Platform package, as the [IoT Event Rules](#iot-event-rules) and [UNS Connector](#uns-connector) containers, each with its own standalone configuration.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/iot/manager/`   | Manager configuration and standalone templates. |
| `/usr/iot/manager/`   | Generated manager configuration and standalone file. |
| `/tmp/ConnectIoT`     | Persisted data, job data, and logs (not on a volume). |

Table: IoT Event Processor relevant folders for containerized environments

### MCAD

:lock: New Product Introduction

Service that performs the mechanical CAD (MCAD) operations of the New Product Introduction module on behalf of the **Host**. The related ECAD integration does not run as a container: the ECAD package only configures Traefik routes to the external ECAD service endpoints defined during installation.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app` | Main application directory. |

Table: MCAD relevant folders for containerized environments

## Data Platform

### ClickHouse

:lock: Data Platform

From [ClickHouse](https://clickhouse.com/clickhouse):

*ClickHouse is a column-oriented database that enables its users to generate powerful analytics, using SQL queries, in real-time.*

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/var/lib/clickhouse/` | Application data (volume `clickhouse-data`). |

Table: ClickHouse relevant folders for containerized environments

ClickHouse logs are written to the console (container output); file logging is disabled. The stack also deploys the `clickhouse-ui` container, a web interface for ClickHouse.

### Kafka

:lock: Data Platform

From [Apache Kafka](https://kafka.apache.org/):

*Apache Kafka is an open-source distributed event streaming platform used by thousands of companies for high-performance data pipelines, streaming analytics, data integration, and mission-critical applications.*

A single Kafka node (container `kafka1`), running as both broker and controller (KRaft mode), is used for streaming operations. The stack also deploys the `kafka-ui` container, a web interface for Kafka.

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/var/lib/kafka/data` | Application data. |

Table: Kafka relevant folders for containerized environments

### RabbitMQ

From [RabbitMQ](https://www.rabbitmq.com/):

*RabbitMQ is a reliable and mature messaging and streaming broker.*

RabbitMQ is the message queue used by the Host and the IoT Event Processor. It is not part of the Data Platform package.

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/var/lib/rabbitmq/mnesia` | Application data. |
| `/var/log/rabbitmq` | Log folder. |

Table: RabbitMQ relevant folders for containerized environments

### Storage

:lock: Data Platform

S3-compatible object storage used by the Data Platform and the Host for large IoT events, exported data sets, and documents. In version 12.0 the in-cluster storage is provided by a Silo-based, MinIO-compatible image (`silo-distroless`), which replaces MinIO. It is intended for development and test environments only; staging and production environments must use an external S3-compatible service.

Relevant folders in container volumes:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/bitnami/minio/data` | Application data (volume `storage-data`). |

Table: Storage relevant folders for containerized environments

### Data Manager

:lock: Data Platform

The Data Manager acts as the manager of all Data Stores. A Data Store is a physical data repository, typically a database of a certain technology that is abstracted by a Data Store Driver. Data Sets (structured tabular grid of rows (records) and columns (fields)) are written and read from a Data Store. For internally managed Data Sets, the system takes care of the schema creation, space provisioning and overall data set management (e.g.: purging).

The Data Manager provides a central access to Data in the platform, enabling data security and also exposing the Data via an OData interface or by using the Grafana interface.

The Data Manager container has no persistent volume.

### HouseKeeper

:lock: Data Platform

Replicates the Online and ODS databases to the ClickHouse ODS database, builds the Canonical Data Model (CDM) events, and materializes all IoT events in ClickHouse. It is deployed as several containers from the same image, each running a subset of the HouseKeeper services: `housekeeper`, `housekeeper-cdm-builder`, `housekeeper-cdm-builder-light`, and, for the Enterprise Data Platform, `housekeeper-edp` and `housekeeper-edp-cdm-builder`.

The HouseKeeper containers have no persistent volume.

### Aggregation Engine

:lock: Data Platform

Runs Dagster and dbt to aggregate the data of the CDM database into the Data Warehouse tables in ClickHouse. The Dagster UI is exposed under the `3rdparty/dagster` path of the environment.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app` | Main application directory. Customization packages are deployed to this directory. |

Table: Aggregation Engine relevant folders for containerized environments

### Cube

:lock: Data Platform

Semantic layer over the Data Warehouse tables, exposing the cubes through GraphQL and REST under the `datamanager/cube` path. It is deployed together with the `cubestore` container, which caches pre-aggregations. The `cube-playground` container, running Cube in development mode, exposes the Cube Playground under the `3rdparty/cube-playground` path.

Relevant folders in the container:

| Path                  | Description                            |
| --------------------- | -------------------------------------- |
| `/opt/app/model`      | Cube model directory. Customization packages can deliver new cube models to this directory. |

Table: Cube relevant folders for containerized environments

### EDP Connector

:lock: Data Platform

Connects a data silo to the Enterprise Data Platform (EDP), forwarding its replication and Service History IDs events. It is deployed only in Enterprise Data Platform scenarios.

### IoT Event Rules

:lock: Data Platform

A standalone Connect IoT Automation Manager, from the IoT Event Processor image, that evaluates the event rules over the incoming IoT events and triggers the associated notifications and actions. It replaces the EPF Alarm Management containers of previous versions.

### UNS Connector

:lock: Data Platform

A standalone Connect IoT Automation Manager, from the IoT Event Processor image, that publishes Light CDM events to an MQTT broker as a Unified Namespace (UNS). It is deployed only when the UNS and the Light CDM events are enabled, and requires the **IoT Data Platform Advanced** license. For more information, see [[user-guide-data-platform-uns-connectivity]].

### ML Platform Agent

:lock: Data Platform

Interacts with the application, providing values extracted from trained models.

The deployed model revisions are read from the S3-compatible storage configured for the environment; the container has no persistent volume.

### ML Platform Training

:lock: Data Platform

Performs model training from events gathered by the Data Platform.

Exported data sets, training data, and trained models are stored in the S3-compatible storage configured for the environment; the container has no persistent volume.

## GenAI

The GenAI package is optional and adds the following containers.

### RAG Service

The `core-rag` container coordinates the indexing of MES content and the retrieval of relevant content for Generative AI requests. It reads entities from the MES Host, consumes MES operation events from Kafka, generates embeddings through the `core-ollama` container, and stores them in ClickHouse. It has no persistent volume.

### Ollama

The `core-ollama` container generates embeddings locally for the RAG service, using the embedding model bundled in the image. Language-model inference uses the provider selected during installation. It has no persistent volume.

### LibreChat

The `librechat` container is the chat interface for the Generative AI features, exposed under the `GenAI` path of the environment and authenticated through the Security Portal. It stores its data in the `ferretdb` container (volume `ferret-data`), which persists it in the [PostgreSQL](#postgresql) container.

### MCP Servers

Model Context Protocol (MCP) servers that expose MES capabilities to AI agents:

* `mcp-mes` exposes MES entities, documents, attachments, Analytics Views, maintenance data, and UI pages on `/mcp`, and the Query Object MCP server on `/queryobjects/mcp`.
* `mcp-analytics` hosts the Cube.js MCP server on `/cubejs/mcp`, the ClickHouse MCP server on `/clickhouse/mcp`, and the OData MCP server on `/odata/mcp`. It is deployed only with the Data Platform.
* `mcp-grafana` is a third-party MCP server that interacts with the Grafana dashboards. It requires the **IoT Data Platform Premium** license.

The MCP servers are internal to the stack and are not exposed through Traefik.