Documentation index

Container Deployment

Scope

This path runs the Workbench, PostgreSQL, and the reverse proxy on one Docker host. Use it for evaluation or approved smaller deployments where the customer accepts the documented availability boundary.

Prerequisites

• Authorized release package or private registry entitlement.
• Supported patched Linux host with current Docker Engine and Compose plugin.
• Customer DNS record and RSA 4096-bit certificate.
• Signed Project X IT license.
• At least 4 vCPU, 16 GB RAM, 100 GB encrypted storage, and separate backup capacity for an initial deployment.
• Inbound TCP 443 only from approved user and collector networks.
• Outbound TCP 443 only to approved account, connector, and update endpoints.

Configure

cd deployment
cp .env.example .env

Set the authorized Workbench image version or digest, public origin, database password, recovery secret, PostgreSQL image, and reverse-proxy image. Put the certificate and key in deployment/tls. Put the signed license in config/license.json.

Never use sample secrets, the latest tag, or an unverified image.

Validate the Configuration

docker compose config
docker compose pull
docker image inspect <authorized-image-reference>

Compare the pulled image digest with the release manifest.

Start

docker compose up -d
docker compose ps
docker compose logs --tail=100 app

All containers must be healthy. Confirm HTTPS, certificate chain, security headers, application health, PostgreSQL connectivity, and server-side license validation.

First Sign-In

1. Open WORKBENCH_PUBLIC_ORIGIN.
2. Create the first local owner through the protected setup flow.
3. Enroll MFA before enabling imports, connectors, or collector tokens.
4. Create separate named administrator accounts; do not share the owner account.
5. Configure SMTP recovery, backup, logging, retention, and incident contacts.
6. Complete the acceptance checklist before importing real evidence.

Ongoing Operation

Apply supported security updates through a tested release process. Back up PostgreSQL, evidence storage, configuration, audit exports, and required keys. Test restoration at the customer-approved interval.