panda-rpki-oss/docs/docker.md

Docker and Compose

Run commands from the project root. A Linux Docker engine is required for the documented deployment and integration tests.

docker build -f docker/Dockerfile -t panda-rpki:v0.1.0 .

The image defaults to an unprivileged user and includes CA certificates, rsync and /usr/bin/time. Compose uses a read-only root filesystem and a temporary /tmp. Host input mounts are read-only; state and outputs are writable.

Single anchor

mkdir -p state output
export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state" OUTPUT_DIR="$PWD/output"
export TAL_FILE=anchor.tal TA_FILE=anchor.cer
export PUID="$(id -u)" PGID="$(id -g)"
docker compose -f docker/compose.yaml run --build --rm validator

Supply absolute host paths as above. Relative Compose paths are resolved from the Compose file's directory, which is docker/. Build context is explicitly the project root. PANDA_RPKI_RRDP_SYNC_MODE defaults to auto.

All five regional anchors

Follow Prepare all five RIR trust anchors to download and check each TAL and matching certificate under input/, then run:

mkdir -p state output
export INPUT_DIR="$PWD/input" STATE_DIR="$PWD/state" OUTPUT_DIR="$PWD/output"
export PUID="$(id -u)" PGID="$(id -g)"
export AFRINIC_TAL_FILE=afrinic.tal AFRINIC_TA_FILE=afrinic.cer
export APNIC_TAL_FILE=apnic.tal APNIC_TA_FILE=apnic.cer
export ARIN_TAL_FILE=arin.tal ARIN_TA_FILE=arin.cer
export LACNIC_TAL_FILE=lacnic.tal LACNIC_TA_FILE=lacnic.cer
export RIPE_TAL_FILE=ripe.tal RIPE_TA_FILE=ripe.cer
docker compose -f docker/compose.all5.yaml run --build --rm validator

Template variable	Default	Applies to
PANDA_RPKI_WORKERS	8	all5 and daemon object workers
PANDA_RPKI_REPO_WORKERS	8	all5 and daemon transport workers
PANDA_RPKI_WORKER_QUEUE_CAPACITY	256	all5 object queue
PANDA_RPKI_HTTP_TIMEOUT_SECS	600	all5 HTTP timeout (native CLI default is 300)
PANDA_RPKI_RRDP_SYNC_MODE	auto	single-anchor and all5

The all5 CCR is OUTPUT_DIR/all5.ccr; the single-anchor CCR is OUTPUT_DIR/result.ccr. Reuse STATE_DIR and select new OUTPUT_DIR values to retain multiple cycles. These templates take no bundled RIR input files.

Daemon service

mkdir -p data/daemon
export INPUT_DIR="$PWD/input" DAEMON_DIR="$PWD/data/daemon"
export TAL_FILE=anchor.tal TA_FILE=anchor.cer
export PUID="$(id -u)" PGID="$(id -g)"
export PANDA_RPKI_INTERVAL_SECS=600 PANDA_RPKI_RETAIN_RUNS=10
docker compose -f docker/compose.daemon.yaml up -d --build
docker compose -f docker/compose.daemon.yaml logs -f validator
# Stop gracefully; persistent host data remains available.
docker compose -f docker/compose.daemon.yaml stop

Defaults: interval 60 seconds, retain 10, PANDA_RPKI_RUN_TIMEOUT_SECS=0 (disabled), log level info, log format json. The daemon template passes PANDA_RPKI_LOG_LEVEL and PANDA_RPKI_LOG_FORMAT into the container. It restarts unless stopped and allows 40 seconds for shutdown, exceeding the controller's default 30-second grace plus termination wait.

For multiple anchors, append TAL/TA pairs after -- in the daemon service's command. For other validator options, edit that same list. A finite run can be invoked with docker compose run --rm validator daemon ... using the daemon CLI; use --max-runs before --.

Compose variables are expanded into arguments; only the two documented log environment variables are read directly by the binary. For single-anchor/all5 logs, pass them with docker compose run -e PANDA_RPKI_LOG_LEVEL=debug ....