Install with Docker Compose

Deploy JustScan, PostgreSQL, the frontend, and documentation on a single host with Docker Compose.

The supported Compose deployment runs PostgreSQL, the backend, frontend, documentation, and nginx. Nginx exposes the application and routes /api, /swagger, and /docs through one host.

Prerequisites

Docker 24 or newer with Docker Compose v2
A host port available for nginx, port 80 by default
Persistent storage for PostgreSQL and backend scanner data
A public HTTPS hostname for production use

Configure

From the Compose deployment directory, create the environment file and review the backend configuration:

cd deploy/docker-compose
cp .env.example .env

Set at least:

Setting	Purpose
`POSTGRES_PASSWORD`	PostgreSQL password; it must match `database.password` in `backend-config.yaml`
`JUSTSCAN_VERSION`	Release tag to deploy, such as `v1.2.3`; defaults to `latest`
`HTTP_PORT`	Host port for nginx; defaults to `80`

Replace every change-me-in-production value in backend-config.yaml before production use. Generate distinct values for jwt.secret and encryption.key, and set allow_origins to the URL users open in their browser. Keep database passwords, JWT secrets, encryption keys, and provider credentials in the host secret manager where possible.

The frontend uses the same-origin /api proxy by default, which keeps the bundled Compose deployment on one host. For a deployment where the browser must call a backend on another host, build the frontend with NEXT_PUBLIC_API_URL set to that backend's public URL (including https://); browser requests will then use that configured API origin. Local split-port development continues to use http://localhost:8080 directly.

Start and verify

docker compose up -d

Open http://HOST[:HTTP_PORT] and verify that /, /docs, /swagger, and /api/v1/health resolve through nginx. The backend container healthcheck uses /api/v1/readyz; use /api/v1/livez for a process-only liveness check. Then continue with first-time setup to create the initial administrator.

Large archive uploads

The bundled nginx configuration allows multipart framing above JustScan's 5 GiB archive limit, disables request buffering for archive uploads, and waits up to two hours for long-running backend requests. If another reverse proxy sits in front of Compose, configure at least a 6 GiB request-body limit, disable buffering where supported, and use read/send timeouts of at least two hours. See reverse proxy, ingress, and TLS.

Artifactory Xray-only deployments

When every registry uses Artifactory Xray, use the smaller backend image and disable local scanners:

JUSTSCAN_BACKEND_IMAGE_PREFIX=backend-minimal
JUSTSCAN_VERSION=v1.2.3

scanner:
  enable_trivy: false
  enable_grype: false

Keep the default backend image if any registry will use local Trivy scanning.

Operate the stack

docker compose logs -f
docker compose logs -f backend
docker compose pull
docker compose up -d

Use upgrades and maintenance for release changes and troubleshooting for runtime failures. docker compose down -v removes the PostgreSQL and backend data volumes; back up data before using it.