Example: Docker Compose

A complete reference docker-compose.yml for running SemiLayer locally or in a single-node staging environment. Requires an enterprise license for the Docker images.

ℹ️

Docker images are available to licensed enterprise customers. Contact root@semilayer.dev to request access.

docker-compose.yml

version: '3.9'

services:
  # ── SemiLayer API ──────────────────────────────────────────────────────
  service:
    image: ghcr.io/semilayer/service:latest
    ports:
      - '3001:3001'
    environment:
      PORT: 3001
      DATABASE_URL: postgresql://semilayer:semilayer@db:5432/semilayer
      DEPLOYMENT_MODE: enterprise

      # Auth — generic OIDC (swap provider freely)
      AUTH_PROVIDER: oidc
      AUTH_ISSUER: ${AUTH_ISSUER}
      AUTH_CLIENT_ID: ${AUTH_CLIENT_ID}
      AUTH_CLIENT_SECRET: ${AUTH_CLIENT_SECRET}
      AUTH_AUDIENCE: ${AUTH_AUDIENCE}

      # Embeddings
      EMBEDDING_PROVIDER: ${EMBEDDING_PROVIDER:-openai}
      EMBEDDING_API_KEY: ${EMBEDDING_API_KEY}
      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-text-embedding-3-small}

      # Encryption (local provider — fine for dev/staging)
      ENCRYPTION_PROVIDER: local
      ENCRYPTION_LOCAL_KEY: ${ENCRYPTION_LOCAL_KEY}
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped

  # ── SemiLayer Worker ──────────────────────────────────────────────────
  worker:
    image: ghcr.io/semilayer/worker:latest
    environment:
      DATABASE_URL: postgresql://semilayer:semilayer@db:5432/semilayer
      DEPLOYMENT_MODE: enterprise

      EMBEDDING_PROVIDER: ${EMBEDDING_PROVIDER:-openai}
      EMBEDDING_API_KEY: ${EMBEDDING_API_KEY}
      EMBEDDING_MODEL: ${EMBEDDING_MODEL:-text-embedding-3-small}

      ENCRYPTION_PROVIDER: local
      ENCRYPTION_LOCAL_KEY: ${ENCRYPTION_LOCAL_KEY}
    depends_on:
      db:
        condition: service_healthy
    restart: unless-stopped

  # ── Data store ────────────────────────────────────────────────────────
  db:
    image: pgvector/pgvector:pg16
    environment:
      POSTGRES_USER: semilayer
      POSTGRES_PASSWORD: semilayer
      POSTGRES_DB: semilayer
    ports:
      - '5433:5432'   # 5433 to avoid conflicts with a local Postgres
    volumes:
      - semilayer_data:/var/lib/postgresql/data
    healthcheck:
      test: ['CMD-SHELL', 'pg_isready -U semilayer']
      interval: 5s
      timeout: 5s
      retries: 5
    restart: unless-stopped

volumes:
  semilayer_data:

.env File

# .env
AUTH_ISSUER=https://your-idp.example.com
AUTH_CLIENT_ID=your-client-id
AUTH_CLIENT_SECRET=your-client-secret
AUTH_AUDIENCE=https://api.semilayer.com

EMBEDDING_PROVIDER=openai
EMBEDDING_API_KEY=sk-...
EMBEDDING_MODEL=text-embedding-3-small

# Generate with: openssl rand -hex 32
ENCRYPTION_LOCAL_KEY=your-32-byte-hex-key

Start

docker compose up -d

The service starts on port 3001. Run the migrations on first boot:

docker compose exec service pnpm db:migrate

Then connect the CLI:

semilayer login --service-url http://localhost:3001
semilayer init

Air-Gapped (Ollama for Embeddings)

Replace the embedding config with Ollama:

  ollama:
    image: ollama/ollama:latest
    volumes:
      - ollama_data:/root/.ollama
    restart: unless-stopped

And update the env vars in service and worker:

EMBEDDING_PROVIDER: ollama
EMBEDDING_BASE_URL: http://ollama:11434
EMBEDDING_MODEL: nomic-embed-text

Pull the model before starting ingest:

docker compose exec ollama ollama pull nomic-embed-text

Production Checklist

Before promoting this setup to production:

Replace ENCRYPTION_LOCAL_KEY with a managed KMS (AWS KMS, GCP KMS, etc.)
Add a load balancer in front of service for TLS termination
Move AUTH_CLIENT_SECRET and EMBEDDING_API_KEY to a secrets manager
Set up automated backups for the semilayer_data volume
Consider running service and worker as separate replicas to scale independently

For a production Kubernetes or ECS reference, see the full enterprise deployment guide available in your Console under Organization → Enterprise.