# All-in-one docker compose deployment of a full anchore-enterprise service system
---
name: "anchore-6010"
volumes:
  # Since this is for a quickstart, each minor version has its own db, to use a previous db and upgrade, change this
  # to the db volume name you want to upgrade from. e.g. "anchore-enterprise-5.26-db" if upgrading from a 5.26 quickstart deployment.
  # IMPORTANT: Do not change this volume name - it is used to persist data across minor version upgrades within this major version.
  anchore-enterprise-db:
    # Set this to 'true' to use an external volume. In which case, it must be created manually with "docker volume create anchore-db-volume"
    external: false

services:
  # The primary API endpoint service
  api:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    ports:
      - "8228:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=api
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false

    command: ["anchore-enterprise-manager", "service", "start", "apiext"]
  # Catalog is the primary persistence and state manager of the system
  catalog:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      queue:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    expose:
      - 8228
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=catalog
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "catalog"]
  component-catalog:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      queue:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    expose:
      - 8228
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=component-catalog
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fk https://localhost:$${ANCHORE_SERVICE_PORT}/health || curl -f http://localhost:$${ANCHORE_SERVICE_PORT}/health || exit 1",
        ]
      start_period: 20s
    command:
      [ "ng-enterprise", "service",
        "start",
        "component_catalog"
      ]
  queue:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=queue
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "simplequeue"]
  policy-engine:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      data-syncer:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=policy-engine
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      - ANCHORE_POLICY_ENGINE_ENABLE_PACKAGE_DB_LOAD=false
    command: ["anchore-enterprise-manager", "service", "start", "policy_engine"]
  analyzer:
    image: docker.io/anchore/enterprise:v6.1.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=analyzer
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      - /analysis_scratch
      #- ./config-enterprise.yaml:/config/config.yaml:z
      # To enable and configure malware and catalogers during centralized analysis/scans please review - https://docs.anchore.com/current/docs/configuration/malware.
      #- ./analyzer_config.yaml:/anchore_service/analyzer_config.yaml:z
    command: ["anchore-enterprise-manager", "service", "start", "analyzer"]
  anchore-db:
    build:
      context: .
      dockerfile: Dockerfile.anchore-db
    shm_size: 1g
    volumes:
      - anchore-enterprise-db:/var/lib/postgresql/data:Z
    environment:
      - POSTGRES_PASSWORD=mysecretpassword
    expose:
      - 5432
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 5s
      timeout: 5s
      retries: 30
      start_period: 10s
    command: postgres -c shared_preload_libraries=pg_stat_statements,pg_cron -c pg_stat_statements.track=all -c max_connections=10000 -c shared_buffers=128MB -c cron.use_background_workers=on
  db-preflight:
    image: docker.io/anchore/enterprise:v6.1.0
    restart: "no"
    depends_on:
      anchore-db:
        condition: service_healthy
    volumes:
      - ./license.yaml:/license.yaml:ro,z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=db-preflight
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["ng-enterprise", "db", "preflight"]
  reports:
    image: docker.io/anchore/enterprise:v6.1.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8558:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=reports
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "reports"]
  reports_worker:
    image: docker.io/anchore/enterprise:v6.1.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=reports_worker
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command:
      ["anchore-enterprise-manager", "service", "start", "reports_worker"]
  notifications:
    image: docker.io/anchore/enterprise:v6.1.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8668:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=notifications
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      - ANCHORE_ENTERPRISE_UI_URL=http://localhost:3000
    command: ["anchore-enterprise-manager", "service", "start", "notifications"]
  data-syncer:
    image: docker.io/anchore/enterprise:v6.1.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8778:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=data-syncer
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      - ANCHORE_DATA_SYNC_AUTO_SYNC_ENABLED=true
    command:
      ["anchore-enterprise-manager", "service", "start", "data_syncer"]
  ui-redis:
    image: docker.io/library/redis:7.4.6
    expose:
      - 6379
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    healthcheck:
      test: ["CMD-SHELL", "redis-cli PING"]
  ui:
    image: docker.io/anchore/enterprise-ui:v6.1.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-ui.yaml:/config/config-ui.yaml:z
    depends_on:
      api:
        condition: service_healthy
      ui-redis:
        condition: service_healthy
      anchore-db:
        condition: service_healthy
    ports:
      - "3000:3000"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      - ANCHORE_ENTERPRISE_URI=http://api:8228/v2
      - ANCHORE_REDIS_URI=redis://ui-redis:6379
      - ANCHORE_APPDB_URI=postgres://postgres:mysecretpassword@anchore-db:5432/postgres
      - ANCHORE_ENABLE_METRICS=false


#  # Uncomment this section to add a prometheus instance to gather metrics. This is mostly for quickstart to demonstrate prometheus metrics exported
#  # You will also need to set metrics env variable to true foreach Anchore service "ANCHORE_ENABLE_METRICS=true" in this file.
#  prometheus:
#    image: docker.io/prom/prometheus:latest
#    depends_on:
#      api:
#        condition: service_healthy
#    volumes:
#      - ./anchore-prometheus.yml:/etc/prometheus/prometheus.yml:z
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m
#    ports:
#      - "9090:9090"

#  # Uncomment this section to run a swagger UI service, for inspecting and interacting with the anchore enterprise API via a browser (http://localhost:8080 by default, change if needed in both sections below)
#  swagger-ui-nginx:
#    image: docker.io/nginx:latest
#    depends_on:
#      api:
#        condition: service_healthy
#      swagger-ui:
#        condition: service_started
#    ports:
#      - "8080:8080"
#    volumes:
#      - ./anchore-swaggerui-nginx.conf:/etc/nginx/nginx.conf:z
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m

#  swagger-ui:
#    image: docker.io/swaggerapi/swagger-ui
#    depends_on:
#      api:
#        condition: service_healthy
#    environment:
#      - URL=http://localhost:8080/v2/openapi.json
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m