Setup

name: tigerstrike

services:
  tigerstrike:
    image: tigergate/tigerstrike:latest   # or pin a version, e.g. :1.0.0
    container_name: tigerstrike
    entrypoint: ["/usr/local/bin/tigerstrike-service"]
    command: ["--port", "8085", "--workers", "2"]
    network_mode: host                   # required — the worker reaches its sandboxes on the host bridge
    restart: unless-stopped
    stop_grace_period: 30s               # let in-flight scans drain on SIGTERM
    env_file: .env                       # TIGERGATE_API_KEY lives here
    environment:
      TIGERSTRIKE_WORKER_NAME: "${TIGERSTRIKE_WORKER_NAME:-tigerstrike-onprem}"
      TIGERSTRIKE_OUTPUT_ROOT: /var/lib/tigerstrike/runs
      TIGERSTRIKE_ENV: production
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock                       # required — sandbox runs on the host daemon
      - tigerstrike_runs:/var/lib/tigerstrike/runs                      # scan artifacts (dashboard download links)
      - /var/lib/tigerstrike/codebase:/var/lib/tigerstrike/codebase:ro  # optional — private-codebase drop-zone
    mem_limit: 4g
    cpus: 2
    healthcheck:
      test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8085/health"]
      interval: 30s
      timeout: 5s
      start_period: 30s
      retries: 3
    logging:
      driver: json-file
      options:
        max-size: "50m"
        max-file: "5"

volumes:
  tigerstrike_runs:

# Copy to .env, then: chmod 600 .env
# Create the key at: Settings → Organization → API Keys (an Organization key, tg_…)
TIGERGATE_API_KEY=

# Optional — the TigerGate region your organization is in. Leave unset for us1,
# the default. Keys are region-scoped, so this must match the region the key
# above was issued in. See https://docs.tigergate.dev/platform/regions
# TIGERGATE_REGION=

# Optional — an explicit platform URL for a self-hosted or staging install.
# Overrides TIGERGATE_REGION entirely; leave unset for TigerGate SaaS.
# TIGERGATE_BACKEND_URL=

# Optional — friendly name shown in the dashboard's worker fleet view.
# Defaults to "tigerstrike-onprem"; use e.g. "acme-prod-dc1" so multiple hosts don't collide.
# TIGERSTRIKE_WORKER_NAME=acme-prod-dc1

apiVersion: apps/v1
kind: Deployment
metadata: { name: tigerstrike, namespace: tigerstrike, labels: { app: tigerstrike } }
spec:
  replicas: 1
  strategy: { type: Recreate }
  selector: { matchLabels: { app: tigerstrike } }
  template:
    metadata: { labels: { app: tigerstrike } }
    spec:
      terminationGracePeriodSeconds: 30
      containers:
        - name: tigerstrike
          image: tigergate/tigerstrike:latest   # or pin a version, e.g. :1.0.0
          imagePullPolicy: Always
          command: ["/usr/local/bin/tigerstrike-service"]
          args: ["--port", "8085", "--workers", "2"]
          env:
            - { name: DOCKER_HOST, value: "tcp://127.0.0.1:2375" }   # talk to the DinD sidecar
            - { name: TIGERSTRIKE_WORKER_NAME, value: "acme-eks" }
            - { name: TIGERSTRIKE_BOOT_TIMEOUT, value: "15m" }       # first sandbox pull is ~600 MB
            - name: TIGERGATE_API_KEY
              valueFrom: { secretKeyRef: { name: tigerstrike-api, key: TIGERGATE_API_KEY } }
          ports: [{ containerPort: 8085, name: health }]
          startupProbe: { httpGet: { path: /health, port: 8085 }, periodSeconds: 5, failureThreshold: 24 }
          livenessProbe: { httpGet: { path: /health, port: 8085 }, periodSeconds: 30, failureThreshold: 6 }
          resources: { requests: { cpu: "1", memory: "2Gi" }, limits: { cpu: "2", memory: "4Gi" } }
          volumeMounts:
            - { name: runs, mountPath: /var/lib/tigerstrike/runs }
        - name: dind
          image: docker:24-dind
          securityContext: { privileged: true }
          env: [{ name: DOCKER_TLS_CERTDIR, value: "" }]
          args: ["--host=unix:///var/run/docker.sock"]
          startupProbe: { tcpSocket: { port: 2375 }, periodSeconds: 5, failureThreshold: 24 }
          resources: { requests: { cpu: "1", memory: "2Gi" }, limits: { cpu: "4", memory: "8Gi" } }
          volumeMounts:
            - { name: dind-storage, mountPath: /var/lib/docker }
            - { name: runs, mountPath: /var/lib/tigerstrike/runs }   # same path in both containers
      volumes:
        # Node-local disk (emptyDir) — no PVC / StorageClass needed. Ephemeral:
        # wiped when the pod is rescheduled; the sandbox image re-pulls and run
        # artifacts upload to the platform per-scan, so only an in-flight scan is
        # lost on a mid-scan restart.
        - { name: runs, emptyDir: { sizeLimit: 10Gi } }
        - { name: dind-storage, emptyDir: { sizeLimit: 20Gi } }