Quick start
Get the image
Each release publishes a signed image for linux/amd64 and linux/arm64 as
ghcr.io/relicbuild/relic and relicbuild/relic (Docker Hub), tagged
v1.2.3, 1.2 and latest (a pre-release: its tag only). Pull it:
docker pull ghcr.io/relicbuild/relic:v0.2.0-beta.4
Check its signature with cosign 3 or later (optional). Older cosign versions
answer no signatures found.
cosign verify ghcr.io/relicbuild/relic:v0.2.0-beta.4 --certificate-oidc-issuer https://token.actions.githubusercontent.com --certificate-identity-regexp '^https://github.com/relicbuild/relic/'
Or build it from a checkout of the release's tag:
docker build --build-arg VERSION=v0.2.0-beta.4 -t ghcr.io/relicbuild/relic:v0.2.0-beta.4 .
The command selects the part:
| Command | What it does |
|---|---|
server start (the default) | Applies migrations, then serves the APIs and the web UI over HTTPS on RELIC_HTTP_LISTEN_ADDRESS (:8090). --no-tls serves plain HTTP. |
server start --worker | Server and background jobs in one process, for a single node. |
server worker | Applies migrations, then runs background jobs. |
server migrate | Applies migrations and exits. |
The image is distroless, runs as a non-root user, and includes the web UI, the
scanners, the relic-indexer builds and the Debian CA bundle.
Run one container
Put the settings in an env file, such as relic.env with mode 0600:
RELIC_DATABASE_URL=sqlite:///var/lib/relic/data/relic.db
RELIC_OBJECT_STORAGE_TYPE=filesystem
RELIC_OBJECT_STORAGE_PATH=/var/lib/relic/data/objects
RELIC_ADMIN_PASSWORD=<admin-password>
RELIC_ENCRYPTION_KEY=<openssl rand -base64 32>
Start the server and the worker in one container:
docker run -d --name relic --restart unless-stopped --env-file relic.env -p 8090:8090 \
-v relic-data:/var/lib/relic/data -v relic-grype:/var/lib/relic/grype -v relic-tls:/etc/relic/tls \
ghcr.io/relicbuild/relic:v0.2.0-beta.4 server start --worker
The server serves HTTPS with a certificate authority it generates in
/etc/relic/tls (TLS). Copy its
certificate out of the container:
docker cp relic:/etc/relic/tls/ca.crt .
Trust ca.crt, open https://localhost:8090 and sign in as admin, or
use the relic CLI with --ca-file ca.crt.
| Volume | Holds |
|---|---|
relic-data | The SQLite database and the content. Back it up with relic.env (Limits and backups). |
relic-grype | Grype's vulnerability database. |
relic-tls | The certificate authority and server certificate. |
Use named volumes, or bind mounts owned by uid 65532 (nonroot). To reach the
server by another name, add it to RELIC_TLS_HOSTNAMES, or set your own
certificate with RELIC_TLS_CERTIFICATE_FILE and RELIC_TLS_KEY_FILE. Behind a
reverse proxy that terminates TLS, add --no-tls and list the proxy in
RELIC_TRUSTED_PROXIES (Behind a reverse proxy).
Back up the database from inside the container:
docker exec relic /relic server database backup /var/lib/relic/data/backup-$(date +%F).db
Next
- Several replicas: PostgreSQL and S3.
- Development or evaluation: Docker Compose.