DocsBook a demo

Platform

Platform overviewArchitectureWorkflow orchestrationGitOps configurationGovernance and AAAAI and MCPKnowledge and contextRuntime and executionEvidence and monitoring

Use cases

All use casesProduction incidentRelease preparationHotfix to productionSecurity scan triage
Why NopsAIIntegrationsSecurity

Resources

All resourcesAI agent governanceMCP governanceMCP securitySelf-hosted platforms
PricingGitHub

Company

How a run worksAboutContactBook a demo

Docker Compose deployment

The local and small single-host topology, its services, and its exposure defaults.

How-toAdministratorDeveloper

Key points

  • The stack runs PostgreSQL, API, AAA, dispatcher, git-bot, UI, Gotenberg, the restricted socket proxy, and a Docker runner.
  • NOPSAI_BIND_ADDRESS defaults to 127.0.0.1, so published ports are workstation-local unless you change it.
  • System Logs read through tcp://docker-socket-proxy:2375, never the raw Docker socket.
  • The default topology does not mount /data/backups as durable storage.

Before you start

Runtime
Docker Engine with the Compose v2 plugindocker compose version
Bootstrap values
The seven required values present in .envgrep -c "^\(POSTGRES_PASSWORD\|DATABASE_URL\|NOPSAI_MASTER_KEY\|JWT_SIGNING_KEY\|SERVICE_JWT_SIGNING_KEY\|AAA_SHARED_INTERNAL_TOKEN\|NOPSAI_BOOTSTRAP_ADMIN_PASSWORD\)=" .env
Images
A checkout to build from, or access to the configured image registry

Steps

  1. 01

    Start the topology

    Compose brings up PostgreSQL, the API, AAA, the dispatcher, git-bot, the UI, Gotenberg, and the socket proxy on the nopsai-net network.

    Build and startbash
    docker compose up -d --build
docker compose ps
    Expected result
    • Every service reaches a running state; the database becomes healthy before the API finishes starting.
  2. 02

    Confirm the control plane answers

    /livez reports the process is up; /healthz waits for a reachable database, which is what a cold start is usually blocked on.

    Probe the APIbash
    curl -s localhost:8080/livez
curl -s localhost:8080/healthz
curl -s localhost:8080/version | jq
    Verify
    • /healthz reports ready and /version returns the build identity of the images you started.
  3. 03

    Add a runner

    The docker-runner service in this file only builds the image; its entrypoint is true. Install a working runner from the dispatcher workspace instead.

    Verify
    • The runner registers and appears dispatchable in System, then the dispatcher workspace.
  4. 04

    Upgrade or tear down

    Upgrading is a pull and recreate. Tearing down keeps the database volume unless you ask for it to go.

    Important
    • down -v deletes the database volume, and with it every run record, credential, and setting.
    Upgrade, stop, or drop statebash
    NOPSAI_VERSION=0.22 docker compose pull && docker compose up -d
docker compose down
docker compose down -v

How it works

Compose is the fastest way to see real product behavior, and everything configured there can be exported to a configuration repository afterwards.

The Docker runner mounts the Docker socket because it creates agent and step containers. Treat the runner host as a trusted execution boundary and isolate workloads by scope.

Docker step containers default to bridge networking so package installs, source fetches, and registry access work. Set DOCKER_NETWORK_NAME=none when steps must run without egress, or name a dedicated network for controlled egress.

Examples

Start, inspect, and stopbash
docker compose up -d --build
docker compose ps
docker compose logs -f nopsai aaa dispatcher docker-runner
docker compose down

Limits

Current behavior
  • Compose defaults are development defaults. Replace every fallback secret and review exposure before using them anywhere shared.

Implementation evidence

  • docker-compose.yaml

    Exact services, ports, and environment variables.