Docker (all-in-one)

The fastest way to get Classifyre running: one image carrying the whole stack — the API, the web UI, the Python scan workers, and PostgreSQL — with nothing to provision and nothing to connect.

docker run -d --name classifyre \  -p 3000:3000 \the only port it serves  --shm-size=1g \Postgres needs it; the default is too small  -v classifyre-pgdata:/var/lib/postgresql/data \your data  -v classifyre-data:/var/lib/classifyre \scan logs + credential key  -v classifyre-uv-cache:/cache/uv \survives upgrades  classifyre/all-in-one:0.5.6

What is inside the image

They are supervised by s6-overlay, which restarts anything that dies and makes docker stop and docker restart behave as expected. Only port 3000 is reachable — PostgreSQL binds to loopback inside the container’s own network namespace and is never exposed.

The scan workers are not a service: the API starts one process per scan and it exits with the scan, the same lifecycle Kubernetes gives them as Jobs.

The image ships a small embedding model (Xenova/all-MiniLM-L6-v2) already baked in, so semantic search and duplicate review work offline from the first scan.

Requirements

On macOS and Windows, Docker Desktop caps what containers may use and often defaults to 2 GB — below the floor. Raise it under Settings → Resources → Memory and restart Docker.

Both linux/amd64 and linux/arm64 are published, so Apple Silicon runs natively with no emulation.

Scanning a folder on your machine

Bind-mount it, then point a source at the path inside the container:

docker run -d --name classifyre \
  -p 3000:3000 --shm-size=1g \
  -v classifyre-pgdata:/var/lib/postgresql/data \
  -v classifyre-data:/var/lib/classifyre \
  -v classifyre-uv-cache:/cache/uv \
  -v "$HOME/Documents/case-files:/data/case-files:ro" \
  classifyre/all-in-one:latest

In the UI: Sources → New → Mounted Folder, path /data/case-files. See Mounted Folder.

Mount read-only (:ro) unless you have a reason not to. Classifyre only ever reads from a folder source, and :ro makes that the filesystem’s guarantee rather than the application’s.

Where the data lives

Three volumes, and you want all three:

Configuration

Everything is an environment variable, and everything has a working default. Pass them with -e NAME=value, or with --env-file.

Core

Database

Leave unset to use the PostgreSQL inside the image.

An external server must have pgvector available, and the user must be able to CREATE SCHEMA and CREATE EXTENSION — each workspace gets its own schema, created on demand. See PostgreSQL.

-e DATABASE_URL="postgresql://user:pass@db.internal:5432/classifyre?sslmode=require"

Object storage

Scan logs are written to disk by default. Point them at S3-compatible storage to keep them when the container is disposable. See S3 object storage.

Embeddings

See embeddings for what changing the model costs.

Resources

The container measures the memory and CPU it was given and sizes itself at startup. Override only with reason.

The startup log prints what it chose:

[classifyre] memory=8192MB cpus=4 shm=1024MB
[classifyre] node heap=2048MB rss guard=4928MB
[classifyre] postgres shared_buffers=512MB work_mem=16MB effective_cache_size=4096MB
[classifyre] scans: 1 concurrent, 4 worker(s) each

Upgrades

docker pull classifyre/all-in-one:latest
docker rm -f classifyre
# …then the same `docker run`, with the same volumes

Data lives in the volumes, so it carries over, and migrations run automatically on the first boot of the new version. Pin a version tag to control when that happens. Downgrades are not supported — migrations only go forwards. See upgrade & versioning.

Backup

Two things, and you need both:

docker exec classifyre pg_dump -U postgres classifyre > classifyre.sql
docker exec classifyre cat /var/lib/classifyre/masked-config.key

Troubleshooting

Moving to Kubernetes

Nothing here is a dead end. Export a workspace from this container and import it into a cluster install — sources, findings, cases and lineage all move. The Helm chart runs the same images this one is composed from.