[{"data":1,"prerenderedAt":1184},["ShallowReactive",2],{"docs-navigation":3,"-docs-guides-operations":410,"-docs-guides-operations-surround":1179},[4,19,166,319,333,397],{"title":5,"icon":6,"path":7,"stem":8,"children":9,"page":18},"Overview","i-lucide-compass","\u002Fdocs\u002Foverview","docs\u002F1.overview",[10,14],{"title":11,"path":12,"stem":13},"Introduction","\u002Fdocs\u002Foverview\u002Fintroduction","docs\u002F1.overview\u002F1.introduction",{"title":15,"path":16,"stem":17},"JFrog compatibility","\u002Fdocs\u002Foverview\u002Fjfrog-compatibility","docs\u002F1.overview\u002F2.jfrog-compatibility",false,{"title":20,"icon":21,"path":22,"stem":23,"children":24,"page":18},"Installation","i-lucide-download","\u002Fdocs\u002Finstallation","docs\u002F2.installation",[25,29,43,68,108,112,116,162],{"title":26,"path":27,"stem":28},"Choosing a method","\u002Fdocs\u002Finstallation\u002Foverview","docs\u002F2.installation\u002F1.overview",{"title":30,"icon":31,"path":32,"stem":33,"children":34,"page":18},"Single binary","i-lucide-terminal","\u002Fdocs\u002Finstallation\u002Fsingle-binary","docs\u002F2.installation\u002F2.single-binary",[35,39],{"title":36,"path":37,"stem":38},"Quick start","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Fquick-start","docs\u002F2.installation\u002F2.single-binary\u002F1.quick-start",{"title":40,"path":41,"stem":42},"Limits and backups","\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Foperations","docs\u002F2.installation\u002F2.single-binary\u002F2.operations",{"title":44,"icon":45,"path":46,"stem":47,"children":48,"page":18},"Docker","i-simple-icons-docker","\u002Fdocs\u002Finstallation\u002Fdocker","docs\u002F2.installation\u002F3.docker",[49,52,56,60,64],{"title":36,"path":50,"stem":51},"\u002Fdocs\u002Finstallation\u002Fdocker\u002Fquick-start","docs\u002F2.installation\u002F3.docker\u002F1.quick-start",{"title":53,"path":54,"stem":55},"PostgreSQL and S3","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fpostgresql-and-s3","docs\u002F2.installation\u002F3.docker\u002F2.postgresql-and-s3",{"title":57,"path":58,"stem":59},"Docker Compose","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose","docs\u002F2.installation\u002F3.docker\u002F3.compose",{"title":61,"path":62,"stem":63},"Compose settings","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-settings","docs\u002F2.installation\u002F3.docker\u002F4.compose-settings",{"title":65,"path":66,"stem":67},"Compose with another object store","\u002Fdocs\u002Finstallation\u002Fdocker\u002Fcompose-other-object-storage","docs\u002F2.installation\u002F3.docker\u002F5.compose-other-object-storage",{"title":69,"icon":70,"path":71,"stem":72,"children":73,"page":18},"Kubernetes","i-simple-icons-kubernetes","\u002Fdocs\u002Finstallation\u002Fkubernetes","docs\u002F2.installation\u002F4.kubernetes",[74,77,80,84,88,92,96,100,104],{"title":5,"path":75,"stem":76},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Foverview","docs\u002F2.installation\u002F4.kubernetes\u002F1.overview",{"title":36,"path":78,"stem":79},"\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fquick-start","docs\u002F2.installation\u002F4.kubernetes\u002F2.quick-start",{"title":81,"path":82,"stem":83},"External PostgreSQL","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-postgresql","docs\u002F2.installation\u002F4.kubernetes\u002F3.external-postgresql",{"title":85,"path":86,"stem":87},"External object storage","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexternal-object-storage","docs\u002F2.installation\u002F4.kubernetes\u002F4.external-object-storage",{"title":89,"path":90,"stem":91},"Exposing Relic","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fexposing","docs\u002F2.installation\u002F4.kubernetes\u002F5.exposing",{"title":93,"path":94,"stem":95},"Values","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fvalues","docs\u002F2.installation\u002F4.kubernetes\u002F6.values",{"title":97,"path":98,"stem":99},"Upgrades and removal","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fupgrades","docs\u002F2.installation\u002F4.kubernetes\u002F7.upgrades",{"title":101,"path":102,"stem":103},"Hardening and probes","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fhardening","docs\u002F2.installation\u002F4.kubernetes\u002F8.hardening",{"title":105,"path":106,"stem":107},"Monitoring","\u002Fdocs\u002Finstallation\u002Fkubernetes\u002Fmonitoring","docs\u002F2.installation\u002F4.kubernetes\u002F9.monitoring",{"title":109,"path":110,"stem":111},"Cloudflare","\u002Fdocs\u002Finstallation\u002Fcloudflare","docs\u002F2.installation\u002F5.cloudflare",{"title":113,"path":114,"stem":115},"Configuration reference","\u002Fdocs\u002Finstallation\u002Fconfiguration","docs\u002F2.installation\u002F6.configuration",{"title":117,"icon":118,"path":119,"stem":120,"children":121,"page":18},"Storage","i-lucide-hard-drive","\u002Fdocs\u002Finstallation\u002Fstorage","docs\u002F2.installation\u002F7.storage",[122,126,130,134,138,142,146,150,154,158],{"title":123,"path":124,"stem":125},"Storage overview","\u002Fdocs\u002Finstallation\u002Fstorage\u002Foverview","docs\u002F2.installation\u002F7.storage\u002F1.overview",{"title":127,"path":128,"stem":129},"Azure Blob Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fazure-blob-storage","docs\u002F2.installation\u002F7.storage\u002F10.azure-blob-storage",{"title":131,"path":132,"stem":133},"SeaweedFS","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fseaweedfs","docs\u002F2.installation\u002F7.storage\u002F2.seaweedfs",{"title":135,"path":136,"stem":137},"Amazon S3","\u002Fdocs\u002Finstallation\u002Fstorage\u002Famazon-s3","docs\u002F2.installation\u002F7.storage\u002F3.amazon-s3",{"title":139,"path":140,"stem":141},"Cloudflare R2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fcloudflare-r2","docs\u002F2.installation\u002F7.storage\u002F4.cloudflare-r2",{"title":143,"path":144,"stem":145},"MinIO","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fminio","docs\u002F2.installation\u002F7.storage\u002F5.minio",{"title":147,"path":148,"stem":149},"Google Cloud Storage","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fgoogle-cloud-storage","docs\u002F2.installation\u002F7.storage\u002F6.google-cloud-storage",{"title":151,"path":152,"stem":153},"Backblaze B2","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fbackblaze-b2","docs\u002F2.installation\u002F7.storage\u002F7.backblaze-b2",{"title":155,"path":156,"stem":157},"Other S3-compatible services","\u002Fdocs\u002Finstallation\u002Fstorage\u002Fother","docs\u002F2.installation\u002F7.storage\u002F8.other",{"title":159,"path":160,"stem":161},"Filesystem","\u002Fdocs\u002Finstallation\u002Fstorage\u002Ffilesystem","docs\u002F2.installation\u002F7.storage\u002F9.filesystem",{"title":163,"path":164,"stem":165},"Development","\u002Fdocs\u002Finstallation\u002Fdevelopment","docs\u002F2.installation\u002F8.development",{"title":167,"icon":168,"path":169,"stem":170,"children":171,"page":18},"Guides","i-lucide-book-open","\u002Fdocs\u002Fguides","docs\u002F3.guides",[172,176,180,254,296,300,303,307,311,315],{"title":173,"path":174,"stem":175},"Repositories","\u002Fdocs\u002Fguides\u002Frepositories","docs\u002F3.guides\u002F1.repositories",{"title":177,"path":178,"stem":179},"Replication","\u002Fdocs\u002Fguides\u002Freplication","docs\u002F3.guides\u002F10.replication",{"title":181,"icon":182,"path":183,"stem":184,"children":185,"page":18},"Package types","i-lucide-package","\u002Fdocs\u002Fguides\u002Fpackage-types","docs\u002F3.guides\u002F2.package-types",[186,190,194,198,202,206,210,214,218,222,226,230,234,238,242,246,250],{"title":187,"path":188,"stem":189},"npm, yarn and pnpm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnpm","docs\u002F3.guides\u002F2.package-types\u002F01.npm",{"title":191,"path":192,"stem":193},"Maven and Gradle","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fmaven-gradle","docs\u002F3.guides\u002F2.package-types\u002F02.maven-gradle",{"title":195,"path":196,"stem":197},"Docker and OCI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdocker","docs\u002F3.guides\u002F2.package-types\u002F03.docker",{"title":199,"path":200,"stem":201},"Go","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgo","docs\u002F3.guides\u002F2.package-types\u002F04.go",{"title":203,"path":204,"stem":205},"PyPI","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fpypi","docs\u002F3.guides\u002F2.package-types\u002F05.pypi",{"title":207,"path":208,"stem":209},"Helm","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhelm","docs\u002F3.guides\u002F2.package-types\u002F06.helm",{"title":211,"path":212,"stem":213},"NuGet","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnuget","docs\u002F3.guides\u002F2.package-types\u002F07.nuget",{"title":215,"path":216,"stem":217},"RubyGems","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frubygems","docs\u002F3.guides\u002F2.package-types\u002F08.rubygems",{"title":219,"path":220,"stem":221},"Cargo","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fcargo","docs\u002F3.guides\u002F2.package-types\u002F09.cargo",{"title":223,"path":224,"stem":225},"Conan","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fconan","docs\u002F3.guides\u002F2.package-types\u002F10.conan",{"title":227,"path":228,"stem":229},"Terraform and OpenTofu","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fterraform","docs\u002F3.guides\u002F2.package-types\u002F11.terraform",{"title":231,"path":232,"stem":233},"Hugging Face","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fhugging-face","docs\u002F3.guides\u002F2.package-types\u002F12.hugging-face",{"title":235,"path":236,"stem":237},"Generic files","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fgeneric","docs\u002F3.guides\u002F2.package-types\u002F13.generic",{"title":239,"path":240,"stem":241},"RPM","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Frpm","docs\u002F3.guides\u002F2.package-types\u002F14.rpm",{"title":243,"path":244,"stem":245},"Debian","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fdebian","docs\u002F3.guides\u002F2.package-types\u002F15.debian",{"title":247,"path":248,"stem":249},"Alpine","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Falpine","docs\u002F3.guides\u002F2.package-types\u002F16.alpine",{"title":251,"path":252,"stem":253},"Nix","\u002Fdocs\u002Fguides\u002Fpackage-types\u002Fnix","docs\u002F3.guides\u002F2.package-types\u002F17.nix",{"title":255,"icon":256,"path":257,"stem":258,"children":259,"page":18},"Security","i-lucide-shield","\u002Fdocs\u002Fguides\u002Fsecurity","docs\u002F3.guides\u002F3.security",[260,264,268,272,276,280,284,288,292],{"title":261,"path":262,"stem":263},"Permissions","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fpermissions","docs\u002F3.guides\u002F3.security\u002F1.permissions",{"title":265,"path":266,"stem":267},"LDAP","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fldap","docs\u002F3.guides\u002F3.security\u002F2.ldap",{"title":269,"path":270,"stem":271},"Access tokens","\u002Fdocs\u002Fguides\u002Fsecurity\u002Ftokens","docs\u002F3.guides\u002F3.security\u002F3.tokens",{"title":273,"path":274,"stem":275},"Relic Scan","\u002Fdocs\u002Fguides\u002Fsecurity\u002Frelic-scan","docs\u002F3.guides\u002F3.security\u002F4.relic-scan",{"title":277,"path":278,"stem":279},"CVE intelligence","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fcve-intelligence","docs\u002F3.guides\u002F3.security\u002F5.cve-intelligence",{"title":281,"path":282,"stem":283},"Audit log","\u002Fdocs\u002Fguides\u002Fsecurity\u002Faudit-log","docs\u002F3.guides\u002F3.security\u002F6.audit-log",{"title":285,"path":286,"stem":287},"Single sign-on","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fsingle-sign-on","docs\u002F3.guides\u002F3.security\u002F7.single-sign-on",{"title":289,"path":290,"stem":291},"SCIM provisioning","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fscim","docs\u002F3.guides\u002F3.security\u002F8.scim",{"title":293,"path":294,"stem":295},"Workload identities","\u002Fdocs\u002Fguides\u002Fsecurity\u002Fworkload-identities","docs\u002F3.guides\u002F3.security\u002F9.workload-identities",{"title":297,"path":298,"stem":299},"Operations","\u002Fdocs\u002Fguides\u002Foperations","docs\u002F3.guides\u002F4.operations",{"title":105,"path":301,"stem":302},"\u002Fdocs\u002Fguides\u002Fmonitoring","docs\u002F3.guides\u002F5.monitoring",{"title":304,"path":305,"stem":306},"Metrics reference","\u002Fdocs\u002Fguides\u002Fmetrics-reference","docs\u002F3.guides\u002F6.metrics-reference",{"title":308,"path":309,"stem":310},"Webhooks","\u002Fdocs\u002Fguides\u002Fwebhooks","docs\u002F3.guides\u002F7.webhooks",{"title":312,"path":313,"stem":314},"Projects","\u002Fdocs\u002Fguides\u002Fprojects","docs\u002F3.guides\u002F8.projects",{"title":316,"path":317,"stem":318},"AI agents","\u002Fdocs\u002Fguides\u002Fai-agents","docs\u002F3.guides\u002F9.ai-agents",{"title":320,"icon":321,"path":322,"stem":323,"children":324,"page":18},"API","i-lucide-braces","\u002Fdocs\u002Fapi","docs\u002F4.api",[325,329],{"title":326,"path":327,"stem":328},"API usage","\u002Fdocs\u002Fapi\u002Foverview","docs\u002F4.api\u002F1.overview",{"title":330,"path":331,"stem":332},"Relic API","\u002Fdocs\u002Fapi\u002Frelic-api","docs\u002F4.api\u002F2.relic-api",{"title":334,"icon":31,"path":335,"stem":336,"children":337,"page":18},"CLI","\u002Fdocs\u002Fcli","docs\u002F5.cli",[338,341,345,349,353,357,361,365,369,373,377,381,385,389,393],{"title":5,"path":339,"stem":340},"\u002Fdocs\u002Fcli\u002Foverview","docs\u002F5.cli\u002F01.overview",{"title":342,"path":343,"stem":344},"Sign in and contexts","\u002Fdocs\u002Fcli\u002Fsign-in","docs\u002F5.cli\u002F02.sign-in",{"title":346,"path":347,"stem":348},"Resources","\u002Fdocs\u002Fcli\u002Fresources","docs\u002F5.cli\u002F03.resources",{"title":350,"path":351,"stem":352},"apply, diff and delete","\u002Fdocs\u002Fcli\u002Fapply","docs\u002F5.cli\u002F04.apply",{"title":354,"path":355,"stem":356},"Artifacts","\u002Fdocs\u002Fcli\u002Ffiles","docs\u002F5.cli\u002F05.files",{"title":358,"path":359,"stem":360},"Server, API and tokens","\u002Fdocs\u002Fcli\u002Fplatform","docs\u002F5.cli\u002F06.platform",{"title":362,"path":363,"stem":364},"Builds and images","\u002Fdocs\u002Fcli\u002Fbuilds","docs\u002F5.cli\u002F07.builds",{"title":366,"path":367,"stem":368},"Scanning and auditing","\u002Fdocs\u002Fcli\u002Fsecurity","docs\u002F5.cli\u002F08.security",{"title":370,"path":371,"stem":372},"Releases","\u002Fdocs\u002Fcli\u002Freleases","docs\u002F5.cli\u002F09.releases",{"title":374,"path":375,"stem":376},"Evidence","\u002Fdocs\u002Fcli\u002Fevidence","docs\u002F5.cli\u002F10.evidence",{"title":378,"path":379,"stem":380},"Package managers","\u002Fdocs\u002Fcli\u002Fpackage-managers","docs\u002F5.cli\u002F11.package-managers",{"title":382,"path":383,"stem":384},"Scan reports and VEX","\u002Fdocs\u002Fcli\u002Freports-and-vex","docs\u002F5.cli\u002F12.reports-and-vex",{"title":386,"path":387,"stem":388},"Migrating from Artifactory","\u002Fdocs\u002Fcli\u002Fimport","docs\u002F5.cli\u002F13.import",{"title":390,"path":391,"stem":392},"Database","\u002Fdocs\u002Fcli\u002Fdatabase","docs\u002F5.cli\u002F14.database",{"title":394,"path":395,"stem":396},"Machine setup","\u002Fdocs\u002Fcli\u002Fsetup","docs\u002F5.cli\u002F15.setup",{"title":398,"icon":399,"path":400,"stem":401,"children":402,"page":18},"SDK","i-lucide-boxes","\u002Fdocs\u002Fsdk","docs\u002F6.sdk",[403,406],{"title":5,"path":404,"stem":405},"\u002Fdocs\u002Fsdk\u002Foverview","docs\u002F6.sdk\u002F1.overview",{"title":407,"path":408,"stem":409},"Relic API clients","\u002Fdocs\u002Fsdk\u002Frelic-api-clients","docs\u002F6.sdk\u002F2.relic-api-clients",{"id":411,"title":297,"body":412,"description":1172,"extension":1173,"links":1174,"meta":1175,"navigation":1176,"path":298,"seo":1177,"stem":299,"__hash__":1178},"docs\u002Fdocs\u002F3.guides\u002F4.operations.md",{"type":413,"value":414,"toc":1156},"minimark",[415,430,435,450,474,485,492,497,521,525,534,538,662,666,677,702,713,717,728,738,741,748,752,758,779,782,786,823,833,887,890,915,928,949,973,977,1001,1005,1119,1123,1130,1133,1152],[416,417,418,419,422,423,426,427,429],"p",{},"See also ",[420,421,20],"a",{"href":27},", the\n",[420,424,425],{"href":114},"configuration reference"," and\n",[420,428,117],{"href":124},".",[431,432,434],"h2",{"id":433},"backup","Backup",[416,436,437,438,442,443,446,447,429],{},"Back up PostgreSQL and the ",[439,440,441],"code",{},"artifacts"," bucket. The ",[439,444,445],{},"temporary"," bucket and Grype's\ndatabase need no backup. For a single node with SQLite or the filesystem store,\nsee ",[420,448,40],{"href":449},"\u002Fdocs\u002Finstallation\u002Fsingle-binary\u002Foperations#backups",[451,452,453,465],"ol",{},[454,455,456,457,461,462,429],"li",{},"Back up PostgreSQL ",[458,459,460],"strong",{},"first",": a snapshot, a base backup with WAL, or\n",[439,463,464],{},"pg_dump",[454,466,467,468,470,471,429],{},"Copy the ",[439,469,441],{}," bucket with an S3 sync tool, such as ",[439,472,473],{},"rclone sync",[416,475,476,477,480,481,484],{},"Garbage collection deletes only content unreferenced for\n",[439,478,479],{},"RELIC_GARBAGE_COLLECTION_GRACE_PERIOD"," (default 1 hour). If the bucket copy\ntakes longer, stop the worker while it runs\n(",[439,482,483],{},"kubectl scale deploy\u002Frelic-worker --replicas=0","). Extra blobs in the copy are\nremoved by garbage collection after a restore.",[416,486,487,488,491],{},"Keep a copy of ",[439,489,490],{},"RELIC_ENCRYPTION_KEY"," apart from the backups.",[493,494,496],"h3",{"id":495},"restore","Restore",[451,498,499,502,505,518],{},[454,500,501],{},"Stop the server and the worker.",[454,503,504],{},"Restore PostgreSQL to the chosen point.",[454,506,507,508,510,511,514,515,517],{},"Restore the ",[439,509,441],{}," bucket from a copy taken ",[458,512,513],{},"after"," that point. Create\nan empty ",[439,516,445],{}," bucket.",[454,519,520],{},"Start the server, then the worker.",[431,522,524],{"id":523},"upgrades","Upgrades",[416,526,527,528,531,532,429],{},"Migrations run at startup and only go forward. The server, the worker and\n",[439,529,530],{},"relic server migrate"," log each migration they apply (\"database migration\napplied\", with its version and name). Upgrade the server first, then the\nworker. Downgrades are not supported: a release older than the database's\nschema refuses to start and names both schema versions, so restore from a\nbackup instead. For Helm, see ",[420,533,524],{"href":98},[431,535,537],{"id":536},"routine-operations","Routine operations",[539,540,541,554],"table",{},[542,543,544],"thead",{},[545,546,547,551],"tr",{},[548,549,550],"th",{},"Task",[548,552,553],{},"Behaviour",[555,556,557,574,594,610,625,644],"tbody",{},[545,558,559,563],{},[560,561,562],"td",{},"Garbage collection",[560,564,565,566,569,570,573],{},"Runs in the worker every ",[439,567,568],{},"RELIC_GARBAGE_COLLECTION_INTERVAL"," (10 minutes). Deletes content unreferenced for the grace period. Content in the trash can stays referenced until the trash is emptied or ",[439,571,572],{},"RELIC_TRASH_RETENTION"," (14 days) runs out. Container image layers no manifest uses are deleted after a day.",[545,575,576,579],{},[560,577,578],{},"Storage check",[560,580,581,582,585,586,589,590,593],{},"Runs daily, or with ",[458,583,584],{},"Check storage"," on the System page or ",[439,587,588],{},"relic storage check",". Hands content no item knows about to garbage collection, reports missing or wrong-sized content, and re-hashes up to 10 GiB per run. A check stops after 2 hours. Problems raise RelicContentIntegrity; the report is the ",[439,591,592],{},"storage_check"," job's output.",[545,595,596,599],{},[560,597,598],{},"Interrupted jobs",[560,600,601,602,605,606,609],{},"A job whose worker stopped mid-run (a crash, ",[439,603,604],{},"kill -9",") stays ",[439,607,608],{},"running"," until it is older than both 5 minutes and its time limit: 2 hours for the storage check, 30 minutes for Relic Scan's jobs, 1 minute for the others. The worker then retries it, or drops it when it allows one attempt (storage check, cleanup, webhook dispatch), and the next run of its kind can start.",[545,611,612,615],{},[560,613,614],{},"Audit log purge",[560,616,617,618,621,622,624],{},"Runs daily. Deletes events older than ",[439,619,620],{},"RELIC_AUDIT_RETENTION"," (365 days) (",[420,623,281],{"href":282},").",[545,626,627,629],{},[560,628,273],{},[560,630,631,632,635,636,639,640,643],{},"Needs ",[439,633,634],{},"syft"," and ",[439,637,638],{},"grype",", which the image contains; without them scanning is off. Persist ",[439,641,642],{},"\u002Fvar\u002Flib\u002Frelic\u002Fgrype"," to keep the vulnerability database across restarts.",[545,645,646,649],{},[560,647,648],{},"Logs",[560,650,651,652,655,656,659,660,429],{},"JSON on stderr, with ",[439,653,654],{},"request_id"," and, when traced, ",[439,657,658],{},"trace_id",". Credentials are never logged. See ",[420,661,105],{"href":301},[431,663,665],{"id":664},"behind-a-reverse-proxy","Behind a reverse proxy",[416,667,668,669,672,673,624],{},"The server serves HTTPS by default. Behind a proxy that terminates TLS, start it\nwith ",[439,670,671],{},"--no-tls",", or let the proxy connect over HTTPS\n(",[420,674,676],{"href":675},"\u002Fdocs\u002Finstallation\u002Fconfiguration#tls","TLS",[416,678,679,680,635,683,686,687,690,691,694,695,698,699,429],{},"Relic trusts ",[439,681,682],{},"X-Forwarded-Proto",[439,684,685],{},"X-Forwarded-For"," only from the addresses in\n",[439,688,689],{},"RELIC_TRUSTED_PROXIES"," and strips them from other clients. List your proxy\nthere; otherwise Relic generates ",[439,692,693],{},"http:\u002F\u002F"," URLs, sets cookies without ",[439,696,697],{},"Secure",",\nand sees every client as the proxy. Over HTTPS, responses carry\n",[439,700,701],{},"Strict-Transport-Security: max-age=31536000",[416,703,704,705,708,709,712],{},"A client address that sends more than 20 wrong passwords within 10 minutes must\nwait before its next attempt: one second at first, doubling up to five minutes.\nMeanwhile it gets ",[439,706,707],{},"429"," with ",[439,710,711],{},"Retry-After",". Tokens are not throttled.",[431,714,716],{"id":715},"memory-and-concurrent-uploads","Memory and concurrent uploads",[416,718,719,720,723,724,727],{},"In a container with a memory limit, Relic sets Go's soft memory limit to 90% of\nit, unless ",[439,721,722],{},"GOMEMLIMIT"," is set. Each upload in flight to object storage holds\nbuffers: up to 40 MiB for S3-compatible storage and Azure Blob Storage, 32 MiB\nfor Google Cloud Storage. Relic runs (soft limit − 256 MiB) ÷ that size uploads\nat once, between 4 and 64; without a limit, 16. A 1 GiB limit allows 16 to S3\nor Azure and 20 to Google Cloud Storage. Uploads to a local directory are not\nlimited. Size ",[439,725,726],{},"server.resources.limits.memory"," in the chart for the uploads you\nexpect.",[416,729,730,731,734,735,737],{},"Relic Scan's scanners run in the worker's container, so a worker with Syft and\nGrype sets aside a scan memory budget (",[439,732,733],{},"RELIC_SCAN_MEMORY_BUDGET","; by default\nhalf the container's limit, at most 1 GiB) and takes 90% of the rest as its own\nsoft limit, at least 128 MiB. The scanners run one at a time for each 192 MiB of\nthe budget, at most two, and each gets an equal share of it as its ",[439,736,722],{},".\nA vulnerability database update runs alone with the whole budget, never while a\nscanner or the malicious-package import runs.",[416,739,740],{},"The caches Relic keeps in memory size themselves from its soft limit: a\nsixteenth for each of the Debian, RPM and Helm index caches (at most 256 MiB\neach), an eighth for rendered npm package documents (at most 128 MiB) and a\nthirty-second each for npm package indexes and NuGet manifests (at most 32 MiB\nand 16 MiB).",[416,742,743,744,747],{},"Give the single-node image (",[439,745,746],{},"relic server --worker",") at least 512 MiB: it keeps\nabout 230 MiB for itself and runs one scanner with 256 MiB. With 1 GiB it runs two\nscanners of 256 MiB each and keeps about 460 MiB.",[431,749,751],{"id":750},"secrets-at-rest","Secrets at rest",[416,753,754,755,757],{},"With ",[439,756,490],{}," set, Relic seals these secrets in the database with\nAES-256-GCM:",[759,760,761,764,767,770,773,776],"ul",{},[454,762,763],{},"token signing keys",[454,765,766],{},"key pairs, such as the ones that sign Alpine, Debian and RPM indexes and\nrelease manifests",[454,768,769],{},"remote repository and replication passwords",[454,771,772],{},"LDAP manager passwords",[454,774,775],{},"OIDC client secrets and SAML keys",[454,777,778],{},"webhook secrets",[416,780,781],{},"Secrets stored before the key was set are sealed at startup. On SQLite, Relic\noverwrites the space deleted rows leave and empties the write-ahead log after\nsealing, so the plaintext does not stay in the database files; copies of the\nfiles made before then still hold it. Set the same key\non the server and the worker, and keep a copy apart from the backups. The server does not start if it finds sealed signing keys and has no\nkey or a different one. Without a key, secrets are stored unencrypted and Relic\nlogs a warning.",[431,783,785],{"id":784},"signing-keys","Signing keys",[416,787,788,789,792,793,796,797,800,801,803,804,635,807,810,811,814,815,818,819,822],{},"An Alpine, Debian or RPM repository signs its indexes with the key pair its\n",[439,790,791],{},"signingKey"," names. Alpine and Debian indexes are also signed with the one\n",[439,794,795],{},"secondarySigningKey"," names, so apk and apt accept them with either key. dnf\nreads only one signature, so ",[439,798,799],{},"repomd.xml.asc"," holds the ",[439,802,791],{},"'s alone.\nBoth public keys are published: ",[439,805,806],{},"relic package setup apk",[439,808,809],{},"apt"," install\nboth, and ",[439,812,813],{},"repomd.xml.key",", the ",[439,816,817],{},"gpgkey"," that ",[439,820,821],{},"relic package setup dnf","\nwrites, holds both. This lets a key be replaced without breaking clients.",[416,824,825,826,708,829,832],{},"To replace ",[439,827,828],{},"debian-signing",[439,830,831],{},"debian-signing-2",":",[451,834,835,841,854,881],{},[454,836,837,838,840],{},"Add the new key pair as ",[439,839,795],{}," and apply the repository.\nRelic creates the key pair on first use.",[454,842,843,844,847,848,850,851,853],{},"Run ",[439,845,846],{},"relic package setup"," again on every apk and apt client, so each one\ntrusts both keys. dnf clients whose ",[439,849,817],{}," is the repository's\n",[439,852,813],{}," URL need nothing.",[454,855,856,857,860,861,864,865,867,868,870,871,874,875,877,878,880],{},"Swap the two names (",[439,858,859],{},"signingKey: debian-signing-2",",\n",[439,862,863],{},"secondarySigningKey: debian-signing",") and apply. Alpine and Debian clients\nthat still trust only the old key keep working. dnf finds ",[439,866,799],{},"\nsigned by a key it has not imported, downloads ",[439,869,817],{}," again and imports\nthe new key, asking first unless it runs with ",[439,872,873],{},"-y",". A dnf client whose\n",[439,876,817],{}," is a local file needs that file replaced with ",[439,879,813],{},"\nbefore this step.",[454,882,883,884,886],{},"When no apk or apt client trusts only the old key, remove\n",[439,885,795],{}," and apply.",[416,888,889],{},"This command lists the key pairs:",[891,892,897],"pre",{"className":893,"code":894,"language":895,"meta":896,"style":896},"language-bash shiki shiki-themes material-theme-lighter github-light-default github-dark-default","relic api key-pairs\n","bash","",[439,898,899],{"__ignoreMap":896},[900,901,904,908,912],"span",{"class":902,"line":903},"line",1,[900,905,907],{"class":906},"seIyd","relic",[900,909,911],{"class":910},"sasMN"," api",[900,913,914],{"class":910}," key-pairs\n",[416,916,917,918,920,921,923,924,927],{},"This command deletes a key pair. Relic refuses to delete one that signs a\nrepository, as its ",[439,919,791],{},", its ",[439,922,795],{}," or the default,\nand ",[439,925,926],{},"release-bundles",", which signs release manifests:",[891,929,931],{"className":893,"code":930,"language":895,"meta":896,"style":896},"relic api -X DELETE key-pairs\u002Fdebian-signing\n",[439,932,933],{"__ignoreMap":896},[900,934,935,937,939,943,946],{"class":902,"line":903},[900,936,907],{"class":906},[900,938,911],{"class":910},[900,940,942],{"class":941},"smky3"," -X",[900,944,945],{"class":910}," DELETE",[900,947,948],{"class":910}," key-pairs\u002Fdebian-signing\n",[416,950,951,952,954,955,958,959,962,963,965,966,635,969,972],{},"A repository without ",[439,953,791],{}," signs with ",[439,956,957],{},"relic-rsa"," (Alpine) or\n",[439,960,961],{},"relic-gpg"," (Debian and RPM). A key pair name is up to 64 letters, digits, ",[439,964,429],{},", ",[439,967,968],{},"_",[439,970,971],{},"-",", and\nstarts with a letter or digit. Alpine repositories sign with RSA key pairs,\nDebian and RPM repositories with OpenPGP ones: applying a repository refuses a\nkey pair that is stored as, or that another repository signs with as, the\nother kind.",[431,974,976],{"id":975},"health","Health",[759,978,979,985,995],{},[454,980,981,984],{},[439,982,983],{},"\u002Fhealthz",": the process is alive.",[454,986,987,990,991,994],{},[439,988,989],{},"\u002Freadyz",": the database and object storage answer, and the database has not\nrefused a write for lack of space in the last minute. It answers ",[439,992,993],{},"503"," with\nthe reason: \"database unavailable\", \"database is full\" or \"object storage\nunavailable\".",[454,996,997,1000],{},[458,998,999],{},"Administration → System"," shows both, plus storage, jobs and scanners.",[431,1002,1004],{"id":1003},"troubleshooting","Troubleshooting",[539,1006,1007,1017],{},[542,1008,1009],{},[545,1010,1011,1014],{},[548,1012,1013],{},"Symptom",[548,1015,1016],{},"Check",[555,1018,1019,1035,1056,1079,1089,1097,1108],{},[545,1020,1021,1029],{},[560,1022,1023,1025,1026,1028],{},[439,1024,989],{}," answers \"database unavailable\", and signed-in requests ",[439,1027,993],{}," \"database unavailable\"",[560,1030,1031,1034],{},[439,1032,1033],{},"RELIC_DATABASE_URL",", network policies to PostgreSQL, connection limits.",[545,1036,1037,1050],{},[560,1038,1039,1041,1042,1045,1046,1049],{},[439,1040,989],{}," answers \"database is full\", and writes fail with \"the disk is full\" (",[439,1043,1044],{},"507",", or ",[439,1047,1048],{},"resource_exhausted"," on the Relic API)",[560,1051,1052,1053,1055],{},"Free space on the database's volume: the SQLite file's disk, or the PostgreSQL server's. Writes work again without a restart, and ",[439,1054,989],{}," answers \"ok\" a minute after the last refused write.",[545,1057,1058,1063],{},[560,1059,1060,1062],{},[439,1061,989],{}," answers \"object storage unavailable\"",[560,1064,1065,965,1068,1071,1072,1075,1076,624],{},[439,1066,1067],{},"RELIC_OBJECT_STORAGE_ENDPOINT",[439,1069,1070],{},"RELIC_OBJECT_STORAGE_REGION",", the key pair, and that the artifacts bucket exists. On Amazon S3 the key also needs ",[439,1073,1074],{},"s3:ListBucket"," (",[420,1077,135],{"href":1078},"\u002Fdocs\u002Finstallation\u002Fstorage\u002Famazon-s3#iam-policy",[545,1080,1081,1084],{},[560,1082,1083],{},"Relic does not start and lists configuration errors",[560,1085,1086,1087,624],{},"Fix every variable named (",[420,1088,425],{"href":114},[545,1090,1091,1094],{},[560,1092,1093],{},"A pod stays in startup",[560,1095,1096],{},"Another replica holds the migration lock. Read its logs.",[545,1098,1099,1102],{},[560,1100,1101],{},"Large uploads fail",[560,1103,1104,1105,429],{},"The ingress or proxy's body size limit and timeouts, and the size of ",[439,1106,1107],{},"\u002Ftmp",[545,1109,1110,1113],{},[560,1111,1112],{},"Uploads fail but downloads work",[560,1114,1115,1116,624],{},"The key pair lacks write or delete access to the temporary bucket, or the store rejects multipart uploads or checksums (",[420,1117,117],{"href":1118},"\u002Fdocs\u002Finstallation\u002Fstorage\u002Foverview#what-relic-does-not-support",[431,1120,1122],{"id":1121},"usage-reports","Usage reports",[416,1124,1125,1126,1129],{},"Relic counts downloads and deploys per repository and user, and records\nrepository sizes every six hours, for two years. ",[458,1127,1128],{},"Administration → Usage","\nshows them to administrators and viewers.",[416,1131,1132],{},"Print the last 90 days:",[891,1134,1136],{"className":893,"code":1135,"language":895,"meta":896,"style":896},"relic usage --days 90\n",[439,1137,1138],{"__ignoreMap":896},[900,1139,1140,1142,1145,1148],{"class":902,"line":903},[900,1141,907],{"class":906},[900,1143,1144],{"class":910}," usage",[900,1146,1147],{"class":941}," --days",[900,1149,1151],{"class":1150},"sIO_5"," 90\n",[1153,1154,1155],"style",{},"html pre.shiki code .seIyd, html code.shiki .seIyd{--shiki-light:#E2931D;--shiki-default:#953800;--shiki-dark:#FFA657}html pre.shiki code .sasMN, html code.shiki .sasMN{--shiki-light:#91B859;--shiki-default:#0A3069;--shiki-dark:#A5D6FF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .smky3, html code.shiki .smky3{--shiki-light:#91B859;--shiki-default:#0550AE;--shiki-dark:#79C0FF}html pre.shiki code .sIO_5, html code.shiki .sIO_5{--shiki-light:#F76D47;--shiki-default:#0550AE;--shiki-dark:#79C0FF}",{"title":896,"searchDepth":1157,"depth":1157,"links":1158},2,[1159,1163,1164,1165,1166,1167,1168,1169,1170,1171],{"id":433,"depth":1157,"text":434,"children":1160},[1161],{"id":495,"depth":1162,"text":496},3,{"id":523,"depth":1157,"text":524},{"id":536,"depth":1157,"text":537},{"id":664,"depth":1157,"text":665},{"id":715,"depth":1157,"text":716},{"id":750,"depth":1157,"text":751},{"id":784,"depth":1157,"text":785},{"id":975,"depth":1157,"text":976},{"id":1003,"depth":1157,"text":1004},{"id":1121,"depth":1157,"text":1122},"Back up, restore, upgrade and troubleshoot a running Relic installation.","md",null,{},true,{"title":297,"description":1172},"FGhZtXyZjHhRotmgvQlu2fDCDVBul3xz65b7t78WO3Q",[1180,1182],{"title":293,"path":294,"stem":295,"description":1181,"children":-1},"CI jobs exchange their platform's OIDC token for a short-lived Relic token.",{"title":105,"path":301,"stem":302,"description":1183,"children":-1},"Relic's metrics, traces, logs, dashboards and alerts, with a runbook for each alert.",1793857337290]