Docker Deployment¶

Docker Compose is the official and only supported way to deploy SentriKat on-premises. The release bundle you download from the Customer Portal contains everything you need: the docker-compose.yml, an annotated .env.example, and the Nginx reverse-proxy configuration.

System Requirements¶

Architecture¶

The stack consists of three services defined in the bundled docker-compose.yml:

Database schema migrations run automatically when the application boots — there is no manual migration step, on first install or on upgrades.

Installation¶

1. Download SentriKat¶

1. Log into the Customer Portal with your email (you'll receive a one-time code)
2. Go to Downloads and download the latest release bundle (sentrikat-<version>.tar.gz)

2. Extract and Configure¶

# Extract the bundle
tar -xzf sentrikat-*.tar.gz
cd sentrikat-*

# Load the Docker image shipped inside the bundle
docker load -i sentrikat-image-*.tar.gz

# Create your configuration from the annotated template
cp .env.example .env
${EDITOR:-nano} .env

Set the required variables in .env (the .env.example in the bundle documents each one):

3. Start the Stack¶

docker compose up -d

# Wait for health — every service should be "Up (healthy)" within ~60 seconds
docker compose ps

On first boot the application applies all database migrations automatically (you'll see Applying schema migrations in the logs).

4. Complete the Setup Wizard¶

Open http://<your-host> (through the bundled Nginx) or http://<your-host>:5000 (direct to the app). On first run, SentriKat starts a setup wizard in the browser that walks you through:

1. Admin account — create your administrator user
2. Organization — name your first organization
3. Catalog seed — initial product catalog data
4. Initial sync — the first CISA KEV sync runs automatically

After the wizard, KEV data stays in sync automatically on a daily schedule — no extra configuration needed.

5. Activate Your License¶

For full details, see Licensing & Activation.

Verify the Installation¶

# All services healthy
docker compose ps

# The app answers (200, or a redirect to the wizard/login)
curl -s -o /dev/null -w "%{http_code}\n" http://localhost:5000/

Common Operations¶

View Logs¶

# All services
docker compose logs -f

# Application only
docker compose logs -f sentrikat

# Last 100 lines
docker compose logs --tail=100 sentrikat

Restart Services¶

# Restart all
docker compose restart

# Restart the application only
docker compose restart sentrikat

Update SentriKat¶

1. Download the latest bundle from the Customer Portal
2. Extract it and copy your existing .env into the new directory
3. Load the new image and start the new version:

docker load -i sentrikat-image-*.tar.gz
docker compose up -d

Schema migrations for the new version run automatically at boot. Your data lives in Docker volumes and is preserved across updates — but take a backup first anyway.

Backups¶

See Backup & Restore for database backup and disaster-recovery procedures.

Production Hardening¶

TLS / HTTPS¶

The default deployment serves HTTP. For production, terminate TLS at the bundled Nginx — the TLS Setup runbook covers Let's Encrypt, internal CA, and self-signed paths.

External PostgreSQL¶

To use an existing PostgreSQL cluster instead of the bundled sentrikat-db service, point DATABASE_URL at it — see External Postgres.

Container Permissions¶

For hardened hosts (SELinux, rootless Docker, custom UID/GID mappings), see Container Permissions.

Troubleshooting¶

A container won't start¶

# Check logs
docker compose logs sentrikat

# Check container status
docker compose ps -a

# Verify the resolved configuration
docker compose config

The most common cause is a missing required variable in .env — the application refuses to start and tells you which one in the logs.

Database connection issues¶

# Check PostgreSQL is running and healthy
docker compose ps sentrikat-db

# Inspect database logs
docker compose logs sentrikat-db

Port conflicts¶

The stack binds ports 80/443 (Nginx) and 5000 (app). If something else on the host already uses them:

# Check which ports are in use
ss -tlnp | grep -E '(:80|:443|:5000)'

Then change the published port in docker-compose.yml, e.g. "8080:5000".

Next Steps¶

• Configure organizations
• Deploy agents
• Set up notifications
• Configuration reference