Deployment guides

CapScope is one Go binary plus a Dockerfile and a compose file, so anything that can run a Docker image can run it. Every guide below covers the same five things: a password, a persistent /data volume, Docker socket access, HTTPS in front of port 8080, and exactly one replica.

Common to all platforms

The image ships everything a PaaS expects: a plain Dockerfile, EXPOSE 8080, a VOLUME /data, a built-in HEALTHCHECK and an unauthenticated GET /healthz endpoint. Whatever the platform, these six rules always apply:

• Set AUTH_PASS to a long random password — the server refuses to start without it (unless you explicitly set ALLOW_NO_AUTH=true for a private test).
• Persist /data on a volume. The SQLite database — logs, metrics, snapshots, alert state — lives there and dies on redeploy without it.
• Give CapScope Docker API access: mount /var/run/docker.sock, or (safer, no socket in CapScope) point DOCKER_HOST at a read-only socket proxy.
• Exactly one replica. Each instance writes the same SQLite file — two writers corrupt the database.
• HTTPS in front. The app listens on 8080; Basic auth credentials travel in clear text on plain HTTP.
• Kubernetes is not supported. CapScope talks to the Docker Engine API, not the kubelet — run it as a Docker container on a Docker node.

openssl rand -base64 24

The image is built from the repo's multi-stage Dockerfile (Go 1.24 to a static scratch binary), so any platform that can build or pull a Docker image works. The first build downloads Go modules — the host needs outbound internet during the build.

Pick your platform

Verify after any deployment

New to CapScope? Read the documentation intro first, then come back and pick a platform.