Download Stackurity Community

Community is free and open source (Apache-2.0). The current release is 0.13.7 (what changed). It runs on your own server as one container plus PostgreSQL. Nothing needs inbound access to your machines, and no account or telemetry is involved.

1. Run the server

You need Docker Engine 24 or later with the Compose plugin, and about 2 CPUs, 2 GB of memory and 10 GB of disk for a few hundred servers.

git clone --depth 1 https://github.com/stackurity/stackurity.git
cd stackurity/deploy
./init-secrets.sh
docker compose up -d          # pulls the signed image ghcr.io/stackurity/stackurity
docker compose logs stackurity | grep -A2 "one-time token"

Open http://your-server:8080 and create the first administrator with the one-time token from the log. For anything beyond a trial, serve it over HTTPS through a reverse proxy; see the installation guide.

On Kubernetes, install it with the Helm chart in deploy/helm instead; see Kubernetes (Helm). Images are published for amd64 and arm64.

2. See it working

Load a labelled demo estate (a server with outdated packages, an application and two repositories) to explore before connecting your own:

docker compose exec stackurity stackurity admin load-demo

3. Connect your estate

Servers: in the dashboard, Assets → Add server gives a one-line install command. The agent is read-only and unprivileged.
Code: add repositories under Integrations, or run stackurity scan . --fail-on critical in CI.
Kubernetes: apply the read-only role in deploy/kubernetes/stackurity-reader.yaml and add the cluster under Settings → Integrations → Add → Plugin → Kubernetes; see the Kubernetes guide.
Containers, SBOMs and AWS: add them under Integrations.
More technologies: install the stack packs you need, such as Java, Rust, Elixir, Swift and C/C++, under Settings → Stack packs.

Verify what you run

Release binaries and images are signed with Sigstore and come with build provenance and an SBOM. To check the image before you run it:

cosign verify ghcr.io/stackurity/stackurity:0.13.7 \
  --certificate-identity-regexp '^https://github.com/stackurity/stackurity/.github/workflows/release.yml@refs/tags/' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

The security guide covers binaries and provenance too. Compatibility lists supported platforms and what each can assess.

Need automatic fixing, several teams, the evidence report or single sign-on? They are part of Pro, on the same installation with a licence key. Talk to us.