Container Deployment¶

Use containers when your environment already uses Docker, Compose, or container orchestration.

Container host requirements¶

Environment	CPU	Memory	Disk	Notes
Lab	2 vCPU	4 GB	20 GB	Single Core and Managerd container.
Small production	4 vCPU	8 GB	50 GB	Persistent logs and config volumes.
Medium production	8 vCPU	16 GB	100 GB	Add log forwarding and resource limits.
Large production	16+ vCPU	32+ GB	250+ GB	Use multiple Core nodes behind a load balancer.

Required host directories¶

sudo mkdir -p /srv/vnetarmor/config/core
sudo mkdir -p /srv/vnetarmor/config/managerd
sudo mkdir -p /srv/vnetarmor/certs
sudo mkdir -p /srv/vnetarmor/logs/core
sudo mkdir -p /srv/vnetarmor/logs/managerd
sudo mkdir -p /srv/vnetarmor/state

Example Compose layout¶

services:
  core:
    image: registry.example.com/vnetarmor/core:<version>
    container_name: vnetarmor-core
    restart: unless-stopped
    ports:
      - "80:8100"
      - "443:8443"
    volumes:
      - /srv/vnetarmor/config/core:/etc/vnetarmor/core:ro
      - /srv/vnetarmor/certs:/opt/vnetarmor/certs:ro
      - /srv/vnetarmor/logs/core:/var/log/vnetarmor/core
      - /srv/vnetarmor/state:/var/lib/vnetarmor
    environment:
      - VNETARMOR_ACTIVATION_TOKEN=${VNETARMOR_ACTIVATION_TOKEN}
    deploy:
      resources:
        limits:
          memory: 1024M

  managerd:
    image: registry.example.com/vnetarmor/managerd:<version>
    container_name: vnetarmor-managerd
    restart: unless-stopped
    ports:
      - "9443:9443"
    volumes:
      - /srv/vnetarmor/config/managerd:/etc/vnetarmor/managerd:ro
      - /srv/vnetarmor/certs:/opt/vnetarmor/certs:ro
      - /srv/vnetarmor/logs/managerd:/var/log/vnetarmor/managerd

Resource limits¶

Set memory limits and restart policies. This avoids one management component exhausting host memory and affecting data-plane traffic.

Component	Suggested starting limit
Core	1024 MB or higher depending on traffic and body inspection.
Managerd	512 MB.
WebGUI	384 MB.
Portal	768 MB.

Networking guidance¶

Use host networking only when explicitly required.
Keep Managerd administrative ports private or restricted.
Expose Core frontend ports to traffic sources.
Use mTLS for administrative access.
Mount certificates read-only.