# Install with Docker

Docker is the fastest way to get a Sentinel instance running, and a good fit for evaluation or a single-node deployment.

## Prerequisites

- Docker installed on the host.

That's it to get running — Sentinel self-configures on first start and doesn't require an external database up front. See [Databases](/docs/sentinel/databases/) if you want to point it at an external engine instead of the default embedded storage.

Without a license key, Sentinel runs on an automatic 30-day trial — a license is required beyond that for production use. See [License](/docs/sentinel/security/license/) for how to configure `LICENSE_KEY`.

## Run the container

The image is published to three registries; use whichever is fastest to reach from your infrastructure.

- `ghcr.io/altcha-org/sentinel` — GitHub Container Registry
- `public.ecr.aws/n6m6b4n8/altcha-org/sentinel` — AWS ECR
- `ccr.ccs.tencentyun.com/altcha-org/sentinel` — Tencent Cloud (China)

Both `amd64` and `arm64` are supported and selected automatically.

```bash
docker run -d \
-p 8080:8080 \
-v altcha_sentinel_data:/data \
ghcr.io/altcha-org/sentinel:latest
```

The `/data` volume holds Sentinel's configuration and data, including an auto-generated `.env` file with cryptographically secure random secrets — mount it to a persistent volume so you don't lose it on container restart.

Once running, open `http://localhost:8080` and sign in with the default credentials `root` / `root`. Change this password immediately after first login.

> **Warning:**
>
> Only port `8080` (the main HTTP port) should be exposed to the internet. Sentinel also uses internal ports `6389` (Redis) and `4080` (database API) — keep these unpublished unless you're actively debugging.

For TLS termination directly on the container, resource limits, and other configuration, see [ENV Variables](/docs/sentinel/operations/env-variables/) — or terminate TLS at a proxy in front of it, see [Reverse Proxy](/docs/sentinel/operations/reverse-proxy/).

## Production configuration

A single container works out of the box on the embedded database — good for evaluation, but production deployments should run multiple instances for redundancy, which needs four variables set identically on every container:

```bash
docker run -d \
-p 8080:8080 \
-v altcha_sentinel_data:/data \
-e SECRET_SEED="<a long random string, identical on every node>" \
-e LICENSE_KEY="<license key>" \
-e POSTGRES_URL="postgresql://user:password@your-db-host:5432/altcha_sentinel" \
-e REDIS_URL="redis://default@your-redis-host:6379" \
ghcr.io/altcha-org/sentinel:latest
```

See [Clustering](/docs/sentinel/operations/clustering/#minimum-production-configuration) for what each variable does, and [ENV Variables](/docs/sentinel/operations/env-variables/) for the full reference.

## Next steps

- **[Configure](/docs/sentinel/configure/)** — set up your first Security Group and API Key.
- **[Reverse Proxy](/docs/sentinel/operations/reverse-proxy/)** — put Sentinel behind HTTPS for production.
- **[Monitoring & Logging](/docs/sentinel/operations/monitoring-logging/)** — track Sentinel's health once it's live.