Docker

Running Keyraft in Docker is the recommended deployment method.

Basic Run

docker run -d -p 7200:7200 \
  -e KEYRAFT_MASTER_KEY=$(openssl rand -base64 32) \
  -v keyraft-data:/data \
  keyraft/keyrafted:latest

The container auto-initializes on first run.

Get Root Token

docker logs <container-name>

Look for the Root token message in the output.

Docker Images

Registry	Image
Docker Hub	keyraft/keyrafted:latest
GitHub Container Registry	ghcr.io/keyraft/keyrafted:latest

Docker Compose

version: '3.8'

services:
  keyraft:
    image: keyraft/keyrafted:latest
    ports:
      - "7200:7200"
    environment:
      - KEYRAFT_MASTER_KEY=${KEYRAFT_MASTER_KEY}
    volumes:
      - keyraft-data:/data
    restart: unless-stopped

volumes:
  keyraft-data:

Generate a master key before starting:

export KEYRAFT_MASTER_KEY=$(openssl rand -base64 32)
docker compose up -d

Environment Variables

Variable	Description
KEYRAFT_MASTER_KEY	Master encryption key for secrets
KEYRAFT_DATA_DIR	Data directory path (default: /data)
KEYRAFT_LISTEN	HTTP listen address (default: :7200)

Persistence

Mount a volume at /data to persist keys, tokens, and audit logs across container restarts:

-v keyraft-data:/data

Production Notes

• Always set KEYRAFT_MASTER_KEY explicitly - do not rely on auto-generated keys across redeployments
• Use a named volume or bind mount for data persistence
• Place a reverse proxy with TLS in front for production exposure

See Security for more recommendations.