threshold/.release/docker/README_docker_io.md

Threshold

Usage

See the latest updates to the Dockerfile for this image in our repository.

Dev Mode

Due to the limitations of threshold dev running and maintaining a postgres docker container, it's not recommended to run dev mode inside docker. To do so will require knowledge of running docker-in-docker, and the caveats associated with it.

Default Configuration

The default behavior of the Threshold docker image is to run threshold server -config /threshold/config.hcl. The included config.hcl file is meant to serve as an example, and is not suitable for actual deployment. Please see the comments within the file for more information; full configuration details can be found on Threshold's documentation site.

Upgrading from the HashiCorp Boundary image

The configuration directory moved from /boundary to /threshold. For compatibility, /boundary is a symlink to /threshold inside the image, a -config /boundary/config.hcl argument (or a config mounted at /boundary/config.hcl) is still honored with a deprecation warning, boundary is accepted as a command name, and BOUNDARY_* environment variables are mirrored to THRESHOLD_*. Please migrate your mounts and arguments to the /threshold and THRESHOLD_* names.

Postgres

The usage instructions in this README assume you have an external postgres database (version 12 or greater) to run threshold server with. If you want to get started quickly, you can start a local postgres in docker:

docker run -it -p 5432:5432 -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres postgres

The postgres URL setting is defined with env://THRESHOLD_POSTGRES_URL so it can be easily set with -e during docker run:

docker run \
    --network host \
    -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
    repo.anhonesthost.net/cybercovellc/threshold

Database Init

If you're starting with a new, unused postgres instance, initialize the database using the default config.hcl:

docker run \
  --network host \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl

If you want to run this with your own config.hcl (assuming config.hcl is located at $(pwd)/config.hcl):

docker run \
  --network host \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  -v "$(pwd)":/threshold/ \
  repo.anhonesthost.net/cybercovellc/threshold database init -config /threshold/config.hcl

Database Migration

If you are updating to a newer version of threshold with a database instance that was initialized with an older version, you will need to apply the database migrations:

docker run \
  --network host \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl

If you want to run this with your own config.hcl (assuming config.hcl is located at $(pwd)/config.hcl):

docker run \
  --network host \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  -v "$(pwd)":/threshold/ \
  repo.anhonesthost.net/cybercovellc/threshold database migrate -config /threshold/config.hcl

Server

Start a Threshold server using the default config.hcl:

docker run \
  --network host \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  repo.anhonesthost.net/cybercovellc/threshold

Start a Threshold server using your own config.hcl, assuming it's located at $(pwd)/config.hcl:

docker run \
  --network host \
  -p 9200:9200 \
  -p 9201:9201 \
  -p 9202:9202 \
  -v "$(pwd)":/threshold/ \
  -e 'THRESHOLD_POSTGRES_URL=postgresql://postgres:postgres@0.0.0.0:5432/postgres?sslmode=disable' \
  repo.anhonesthost.net/cybercovellc/threshold