Docker Deployment¶

Docker Compose is the official and only supported way to deploy SentriKat on-premises. The release bundle you download from the Customer Portal contains everything you need: the docker-compose.yml, an annotated .env.example, and the Nginx reverse-proxy configuration.

System Requirements¶

Architecture¶

The stack consists of three services defined in the bundled docker-compose.yml:

Database schema migrations run automatically when the application boots: there is no manual migration step, on first install or on upgrades.

Installation¶

1. Download SentriKat¶

1. Log into the Customer Portal with your email (you'll receive a one-time code)
2. Go to Downloads and download the latest release bundle (sentrikat-<version>.tar.gz)

2. Extract and Configure¶

# Extract the bundle
tar -xzf sentrikat-*.tar.gz
cd sentrikat-*/

# Load the Docker image shipped inside the bundle
docker load -i sentrikat-image-*.tar.gz

# Create your configuration from the annotated template
cp .env.example .env
${EDITOR:-nano} .env

Set the required variables in .env (the .env.example in the bundle documents each one):

sed -i "s|^SECRET_KEY=.*|SECRET_KEY=$(openssl rand -hex 32)|" .env
sed -i "s|^ENCRYPTION_KEY=.*|ENCRYPTION_KEY=$(openssl rand 32 | base64 | tr '+/' '-_')|" .env
sed -i "s|^DB_PASSWORD=.*|DB_PASSWORD=$(openssl rand -hex 24)|" .env
sed -i "s|^SERVER_NAME=.*|SERVER_NAME=localhost|" .env
sed -i "s|^SENTRIKAT_URL=.*|SENTRIKAT_URL=https://localhost|" .env  # 1.3.0-beta and earlier: http://localhost:5000
sed -i "s|^SENTRIKAT_INSTALLATION_ID=.*|SENTRIKAT_INSTALLATION_ID=SK-INST-$(openssl rand -hex 16 | tr a-f A-F)|" .env

# verify all six are set
grep -E "^(SECRET_KEY|ENCRYPTION_KEY|DB_PASSWORD|SERVER_NAME|SENTRIKAT_URL|SENTRIKAT_INSTALLATION_ID)=" .env

3. Start the Stack¶

docker compose up -d

# Wait for health: every service should be "Up (healthy)"
docker compose ps

On first boot the application applies all database migrations automatically (you'll see Applying schema migrations in the logs).

4. Complete the Setup Wizard¶

On 1.4.0-beta and later, open https://<your-host>/ (http:// sends you there). Until you put your own certificate in the certs folder, the browser warns that the certificate is not trusted: that is the self-signed certificate created at the first start (see TLS / HTTPS). On 1.3.0-beta and earlier, open http://<your-host> (through the bundled Nginx) or http://<your-host>:5000 (direct to the app).

On first run, SentriKat starts a setup wizard in the browser that walks you through:

1. Admin account: create your administrator user
2. Organization: name your first organization
3. Catalog seed: initial product catalog data
4. Initial sync: the first exploited-vulnerability catalogue sync runs automatically

After the wizard, exploited-vulnerability data stays in sync automatically on a daily schedule, no extra configuration needed.

Air-Gapped Data Refresh¶

On a host with no internet access (Professional), keep the vulnerability intelligence current by moving a signed feed bundle across the boundary:

1. On a connected machine, download the signed vuln-feed bundle from the Customer Portal.
2. Transfer it to the air-gapped host (removable media or a data diode).
3. In the admin UI, import the bundle. The exploited-vulnerability feed, exploit probability, and the software identity catalogue update with no internet access required.

The license is offline-signed. Air-gapped installations send nothing to us.

5. Activate Your License¶

For full details, see Licensing & Activation.

Verify the Installation¶

# All services healthy
docker compose ps

# The app answers (200, or a redirect to the wizard/login). Run it on the server itself:
# from 1.4.0-beta, port 5000 answers only there. Right after a start it takes a few seconds,
# 000 means nothing answered within a minute.
for i in $(seq 1 30); do code=$(curl -s -o /dev/null --max-time 5 -w "%{http_code}" http://127.0.0.1:5000/); [ "$code" != 000 ] && break; sleep 2; done; echo "$code"

Common Operations¶

View Logs¶

# All services
docker compose logs -f

# Application only
docker compose logs -f sentrikat

# Last 100 lines
docker compose logs --tail=100 sentrikat

Restart Services¶

# Restart all
docker compose restart

# Restart the application only
docker compose restart sentrikat

Update SentriKat¶

1. Download the latest bundle from the Customer Portal
2. Extract it and copy your existing .env into the new directory
3. Load the new image and start the new version:

docker load -i sentrikat-image-*.tar.gz
docker compose up -d

Schema migrations for the new version run automatically at boot. Your data lives in Docker volumes and is preserved across updates, but take a backup first anyway.

Backups¶

See Backup & Restore for database backup and disaster-recovery procedures.

Production Hardening¶

TLS / HTTPS¶

1.4.0-beta and later. The bundled Nginx serves HTTPS on port 443 from the first start, and port 80 only redirects there. Without a certificate in the certs folder, a self-signed one is created at the first start. To use your own, put fullchain.pem (certificate plus intermediate chain) and privkey.pem (its key) in ./certs/ and run docker compose restart sentrikat-nginx. A restart does not reread .env. Port 5000 answers in plain HTTP only on the server itself: to reach it from other machines, set APP_PORT_BIND=0.0.0.0 in .env and run docker compose up -d (that traffic is not encrypted).

1.3.0-beta and earlier. The default deployment serves HTTP. For production, terminate TLS at the bundled Nginx: the TLS Setup runbook covers Let's Encrypt, internal CA, and self-signed paths.

External PostgreSQL¶

To use an existing PostgreSQL cluster instead of the bundled sentrikat-db service, point DATABASE_URL at it. See External Postgres.

Container Permissions¶

For hardened hosts (SELinux, rootless Docker, custom UID/GID mappings), see Container Permissions.

Troubleshooting¶

A container won't start¶

# Check logs
docker compose logs sentrikat

# Check container status
docker compose ps -a

# Verify the resolved configuration
docker compose config

The most common cause is a missing required variable in .env, the application refuses to start and tells you which one in the logs.

Database connection issues¶

# Check PostgreSQL is running and healthy
docker compose ps sentrikat-db

# Inspect database logs
docker compose logs sentrikat-db

Port conflicts¶

The stack binds ports 80/443 (Nginx) and 5000 (app; on 1.4.0-beta and later, only on the server's own address 127.0.0.1). If something else on the host already uses them:

# Check which ports are in use
ss -tlnp | grep -E '(:80|:443|:5000)'

On 1.3.0-beta and earlier, change the published port in docker-compose.yml, e.g. "8080:5000". On 1.4.0-beta and later, the browser, agents and scripts reach SentriKat through Nginx: ports 80 and 443 must be free.

Next Steps¶

• Configure organizations
• Deploy agents
• Set up notifications
• Configuration reference