# All-in-one docker compose deployment of a full anchore-enterprise service system
---
name: "anchore-6020"
volumes:
  # Since this is for a quickstart, each minor version has its own db, to use a previous db and upgrade, change this
  # to the db volume name you want to upgrade from. e.g. "anchore-enterprise-5.26-db" if upgrading from a 5.26 quickstart deployment.
  # IMPORTANT: Do not change this volume name - it is used to persist data across minor version upgrades within this major version.
  anchore-enterprise-db:
    # Set this to 'true' to use an external volume. In which case, it must be created manually with "docker volume create anchore-db-volume"
    external: false

services:
  # The primary API endpoint service
  api:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    ports:
      - "8228:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=api
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false

    command: ["anchore-enterprise-manager", "service", "start", "apiext"]
  # Catalog is the primary persistence and state manager of the system
  catalog:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      queue:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    expose:
      - 8228
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=catalog
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "catalog"]
  component-catalog:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      queue:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    expose:
      - 8228
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=component-catalog
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    healthcheck:
      test:
        [
          "CMD-SHELL",
          "curl -fk https://localhost:$${ANCHORE_SERVICE_PORT}/health || curl -f http://localhost:$${ANCHORE_SERVICE_PORT}/health || exit 1",
        ]
      start_period: 20s
    command:
      [ "ng-enterprise", "service",
        "start",
        "component_catalog"
      ]
  queue:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=queue
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "simplequeue"]
  policy-engine:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      data-syncer:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=policy-engine
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      - ANCHORE_POLICY_ENGINE_ENABLE_PACKAGE_DB_LOAD=false
    command: ["anchore-enterprise-manager", "service", "start", "policy_engine"]
  analyzer:
    image: docker.io/anchore/enterprise:v6.2.0
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=analyzer
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      - /analysis_scratch
      #- ./config-enterprise.yaml:/config/config.yaml:z
      # To enable and configure malware and catalogers during centralized analysis/scans please review - https://docs.anchore.com/current/docs/configuration/malware.
      #- ./analyzer_config.yaml:/anchore_service/analyzer_config.yaml:z
    command: ["anchore-enterprise-manager", "service", "start", "analyzer"]
  anchore-db:
    build:
      context: .
      dockerfile: Dockerfile.anchore-db
    shm_size: 1g
    volumes:
      - anchore-enterprise-db:/var/lib/postgresql/data:Z
    environment:
      - POSTGRES_PASSWORD=mysecretpassword
    expose:
      - 5432
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -d postgres"]
      interval: 15s
      timeout: 5s
      retries: 30
      start_period: 10s
    command: postgres -c shared_preload_libraries=pg_stat_statements,pg_cron -c pg_stat_statements.track=all -c max_connections=2000 -c shared_buffers=128MB -c cron.use_background_workers=on -c work_mem=8MB
  db-preflight:
    image: docker.io/anchore/enterprise:v6.2.0
    restart: "no"
    depends_on:
      anchore-db:
        condition: service_healthy
    volumes:
      - ./license.yaml:/license.yaml:ro,z
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=db-preflight
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["ng-enterprise", "db", "preflight"]
  reports:
    image: docker.io/anchore/enterprise:v6.2.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8558:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=reports
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command: ["anchore-enterprise-manager", "service", "start", "reports"]
  reports_worker:
    image: docker.io/anchore/enterprise:v6.2.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    expose:
      - 8228
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=reports_worker
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
    command:
      ["anchore-enterprise-manager", "service", "start", "reports_worker"]
  notifications:
    image: docker.io/anchore/enterprise:v6.2.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8668:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=notifications
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      - ANCHORE_ENTERPRISE_UI_URL=http://localhost:3000
    command: ["anchore-enterprise-manager", "service", "start", "notifications"]
  data-syncer:
    image: docker.io/anchore/enterprise:v6.2.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-enterprise.yaml:/config/config.yaml:z
    depends_on:
      anchore-db:
        condition: service_healthy
      catalog:
        condition: service_healthy
      db-preflight:
        condition: service_completed_successfully
    ports:
      - "8778:8228"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      # Uncomment and provide your own password for system admin access.
      #- ANCHORE_ADMIN_PASSWORD=<your_password_here>
      # Uncomment and provide your own password for internal service authentication. This should be the same across all services in the system.
      #- ANCHORE_AUTH_SECRET=<your_auth_secret_here>
      # Uncomment and provide your own password for the database. This should be the same as the POSTGRES_PASSWORD environment variable in the anchore-db service below.
      #- ANCHORE_DB_PASSWORD=<your_db_password_here>
      - ANCHORE_ENDPOINT_HOSTNAME=data-syncer
      - ANCHORE_DB_HOST=anchore-db
      # At-rest encryption is off unless a key is set. Use the SAME key on every service.
      # MISSION CRITICAL: back this key up in a secrets manager outside this file. If it is
      # lost, every encrypted value is permanently unrecoverable - backups will not help.
      #- ANCHORE_DB_ENCRYPTION_KEY_CURRENT=<your_generated_key_here>
      - ANCHORE_ENABLE_METRICS=false
      # Set this to false for airgapped mode deployments where the data syncer should not attempt to reach out to Anchore's public data sync service. In this case, the data syncer will only serve data from the local database.
      - ANCHORE_DATA_SYNC_AUTO_SYNC_ENABLED=true
    command:
      ["anchore-enterprise-manager", "service", "start", "data_syncer"]
  ui-redis:
    image: docker.io/library/redis:7.4.6
    expose:
      - 6379
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    healthcheck:
      test: ["CMD-SHELL", "redis-cli PING"]
  ui:
    image: docker.io/anchore/enterprise-ui:v6.2.0
    volumes:
      - ./license.yaml:/license.yaml:ro,z
      #- ./config-ui.yaml:/config/config-ui.yaml:z
    depends_on:
      api:
        condition: service_healthy
      ui-redis:
        condition: service_healthy
      anchore-db:
        condition: service_healthy
    ports:
      - "3000:3000"
    logging:
      driver: "json-file"
      options:
        max-size: 100m
    environment:
      - ANCHORE_ENTERPRISE_URI=http://api:8228/v2
      - ANCHORE_REDIS_URI=redis://ui-redis:6379
      - ANCHORE_APPDB_URI=postgres://postgres:mysecretpassword@anchore-db:5432/postgres
      - ANCHORE_ENABLE_METRICS=false


#  # Uncomment this section to add a prometheus instance to gather metrics. This is mostly for quickstart to demonstrate prometheus metrics exported
#  # You will also need to set metrics env variable to true foreach Anchore service "ANCHORE_ENABLE_METRICS=true" in this file.
#  prometheus:
#    image: docker.io/prom/prometheus:latest
#    depends_on:
#      api:
#        condition: service_healthy
#    volumes:
#      - ./anchore-prometheus.yml:/etc/prometheus/prometheus.yml:z
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m
#    ports:
#      - "9090:9090"

#  # Uncomment this section to run a swagger UI service, for inspecting and interacting with the anchore enterprise API via a browser (http://localhost:8080 by default, change if needed in both sections below)
#  swagger-ui-nginx:
#    image: docker.io/nginx:latest
#    depends_on:
#      api:
#        condition: service_healthy
#      swagger-ui:
#        condition: service_started
#    ports:
#      - "8080:8080"
#    volumes:
#      - ./anchore-swaggerui-nginx.conf:/etc/nginx/nginx.conf:z
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m

#  swagger-ui:
#    image: docker.io/swaggerapi/swagger-ui
#    depends_on:
#      api:
#        condition: service_healthy
#    environment:
#      - URL=http://localhost:8080/v2/openapi.json
#    logging:
#      driver: "json-file"
#      options:
#        max-size: 100m