Migrate using Docker Compose

This runbook migrates a running Anchore Enterprise v5.x Docker Compose deployment to v6.1 or later. It assumes the commands are run on the host where the deployment lives. Before you begin, read the migration overview to understand what the migration does and what you need in place.

Rather than editing your existing v5.x docker-compose.yaml file in place, this guide has you start from a clean copy of the v6.x reference compose file and move your data into it.

The migration has two parts:

• Migrate the underlying database from PostgreSQL 13 to PostgreSQL 17, exporting your v5.x data and restoring it into the new database.
• Replace the v5.x application stack with a new deployment built from the v6.x reference compose file, running the v6.x images on the new migrated database.

Starting from the v6.x template takes care of both at once: the template already runs PostgreSQL 17, and once your data is restored into it, Anchore Enterprise upgrades its own database schema automatically on first boot.

Prerequisites

Before you begin, make sure you have:

• Confirm the deployment is currently running a supported Anchore Enterprise v5.x release. Check the Recommended Component Versions table in the Release Notes for the version you’re moving from.
• Docker and Docker Compose installed and up to date.
• A valid license.yaml.
• Ensure sufficient disk space exists for database backups, temporary migration files, and the additional PostgreSQL volume: a full second copy of your database’s data directory, plus the export file, at minimum.
• A maintenance window — you will need to stop the deployment and writes to the database before the final export in Step 8 so no data is missed.

Downtime Expectations

This migration requires application downtime during the database export and restore. Downtime duration depends on database size, disk performance, and system resources.

Migration Procedure

Step 1: Stop All Services

docker compose down --remove-orphans

This begins the downtime window.

Step 2: Back Up Your Existing Configuration

Before making any changes, back up the existing docker-compose.yaml and, optionally, the Docker volumes. Store the backup somewhere safe so it is not accidentally reused or deleted.

cp docker-compose.yaml docker-compose-v5.yaml.bak

Step 3: Set Up a New Deployment Directory

Create a separate directory for the v6.x deployment. Do not reuse your v5.x deployment directory. This method keeps the two deployments, and their compose projects, independent until you’re ready to retire v5.x.

mkdir anchore-enterprise-v6 && cd anchore-enterprise-v6

Step 4: Download the v6.x Deployment Files

Your new v6.x directory needs the v6.x docker-compose.yaml file, your license file copied over from the old v5.x directory, and the Dockerfile we provide for building the new PostgreSQL 17 database:

curl -sSfL https://docs.anchore.com/current/docs/deployment/docker_compose/docker-compose.yaml > docker-compose.yaml
curl -sSfL https://docs.anchore.com/current/docs/deployment/docker_compose/Dockerfile.anchore-db > Dockerfile.anchore-db
cp /path/to/your/v5-license.yaml ./license.yaml

Step 5: Configure Secrets

Follow Step 4: Configure Secrets in the standard deployment guide to set POSTGRES_PASSWORD, ANCHORE_ADMIN_PASSWORD, ANCHORE_AUTH_SECRET, and ANCHORE_DB_PASSWORD. These are fresh secrets for the new deployment; they do not need to match the values your v5.x deployment used.

Step 6: Start Only the New Database

docker compose up -d anchore-db

Wait for it to report healthy before continuing:

docker compose ps anchore-db

Step 7: Restart the v5.x Database

Step 1 stopped every v5.x service, including anchore-db, but the export in the next step needs it running. From your v5.x deployment directory, restart just the database:

cd /path/to/v5-directory
docker compose up -d anchore-db

The downtime window from Step 1 stays intact: the application services remain stopped, so nothing writes to the database, and anchore-db does not publish a host port, so it cannot conflict with the new v6.x database started in Step 6.

Step 8: Export the v5.x Database

From your v5.x deployment directory, export the database straight into the new v6.x deployment directory. You can decide where to archive the dump file once the migration is complete:

docker compose exec -T anchore-db pg_dump -U postgres -Fc -d postgres -f /tmp/anchore-v5-export.dump
docker compose cp anchore-db:/tmp/anchore-v5-export.dump /path/to/v6-directory/anchore-v5-export.dump

Step 9: Restore the Data into the New Database

From your new v6.x deployment directory, run the following to restore the export taken from the old database into the new one:

cd /path/to/v6-directory
docker compose exec -T anchore-db pg_restore -U postgres -d postgres --clean --if-exists --no-owner < ./anchore-v5-export.dump

Step 10: Start the Full v6.x Deployment

Again, from inside the new v6.x deployment directory, run the following to bring up the full v6.x deployment:

docker compose up -d

Anchore Enterprise performs its own database schema migration in-process on first boot, upgrading your restored v5.x data to the v6.x schema automatically; no separate migration command is needed.

Step 11: Stop the v5.x Database

Step 7 restarted the v5.x anchore-db service, but now that the data has been imported into the new v6 database we can stop the v5 database from continuing to run from your old v5.x deployment directory:

cd /path/to/v5-directory
docker compose down anchore-db

Step 12: Validate the Upgrade

Retire the Old v5.x Deployment (Optional)

Once the upgrade is validated and you are confident you will not need to roll back, you can take the final (and completely optional) step of removing the old v5.x database volume. Our recommendation is to retain the database dump file, the original compose file, and the volume until the upgraded deployment has been fully validated in production.

docker volume rm <your-old-db-volume-name>