Skip to content

Deployment & Setup

Tip

The easiest way to run OpenCVE is to use OpenCVE Cloud (no installation, configuration or maintenance needed).

You can install the complete OpenCVE stack with Docker. It includes all the services needed to run OpenCVE (Django webserver, Airflow, Redis, PostgreSQL, Nginx).

Quickstart

git clone https://github.com/opencve/opencve.git
cd opencve/docker

./install.sh prepare    # default: master branch

# edit docker/.env and web/opencve/conf/.env (passwords)

./install.sh start      # ~30-60 min

# OpenCVE → http://localhost:80
# Airflow → http://localhost:8080

See Configuration for the settings to review before ./install.sh start.

For a specific release: ./install.sh -r v3.0.0 prepare && ./install.sh start

If the Docker build fails due to network issues, see Troubleshooting.

Requirements

  • OS: Debian 11/12 or equivalent (also tested on similar Linux distributions)
  • Docker: v25.0.x or later with the Docker Compose V2 plugin (docker compose)
  • Git: required only to clone the repository (not used by install.sh itself)
  • User: a user with permission to run Docker (root or member of the docker group)
  • Hardware: 4 cores, 4 GB RAM minimum; ~25–30 GB disk space

The Discovery d2-8 instance from OVHcloud is a good fit to start.

Architecture

flowchart LR
    User([Browser]) --> Nginx
    Nginx --> Webserver[Django webserver]
    Webserver --> Postgres[(PostgreSQL)]
    Webserver --> Repos[(repositories volume)]
    Scheduler[Airflow scheduler] --> Postgres
    Scheduler --> Redis[(Redis)]
    Worker[Airflow worker] --> Redis
    Worker --> Postgres
    Worker --> Repos
    User --> Airflow[Airflow webserver]
    Airflow --> Scheduler

The local Git clone provides Docker configuration files and examples. Application code (web + DAGs) is fetched from GitHub and built into Docker images using OPENCVE_VERSION in docker/.env. To update the running application, use ./install.sh upgrade, not git pull.

Installation

Step 1 — Clone the repository

git clone https://github.com/opencve/opencve.git
cd opencve/docker

Step 2 — Prepare configuration files

./install.sh prepare

Running ./install.sh with no arguments is equivalent to ./install.sh prepare.

Note

Default branch is master. Application code is built into Docker images (see OPENCVE_VERSION in docker/.env). For a specific release: ./install.sh -r v3.0.0 prepare. Full option list: Reference.

Expected output:

🟢 The configuration files are all set, you can update them now if you want before starting the entire docker stack:
 Nginx           : ./conf/opencve.conf.template
 Airflow         : ../scheduler/airflow.cfg
 Webserver       : ../web/opencve/conf/.env & ../web/opencve/conf/settings.py
 Docker compose  : ./.env

See the documentation for details: https://docs.opencve.io/deployment/configuration/

 🚀 You can now run: ./install.sh start

Step 3 — Configure (before first start)

Warning

Change default passwords and secrets in docker/.env before running ./install.sh start. If you change POSTGRES_PASSWORD, update OPENCVE_DATABASE_URL in web/opencve/conf/.env as well.

Minimum checklist:

  • POSTGRES_PASSWORD in docker/.env
  • _AIRFLOW_WWW_USER_USERNAME / _AIRFLOW_WWW_USER_PASSWORD in docker/.env
  • AIRFLOW__CORE__FERNET_KEY in docker/.env
  • OPENCVE_DATABASE_URL in web/opencve/conf/.env (if PostgreSQL credentials changed)

See the full Configuration guide for all settings, ports, and Nginx templates.

Step 4 — Start the stack

./install.sh start

This runs all installation steps automatically (about 30–60 minutes):

  1. init-docker-stack — build & start containers, migrate DB, collect static files, Airflow connections, secret key
  2. clone-repositories — clone KB repositories into the Docker volume
  3. verify-container-versions — ensure images match OPENCVE_VERSION
  4. start-opencve-dag — unpause all Airflow DAGs
  5. create-superuser — interactive admin account creation
  6. install-end — display access URLs and credentials summary

When complete:

🟢 Everything is set up, you can now access to OpenCVE locally:

- on port 80 for OpenCVE web instance
 You can login with your account and password set at the previous step 'Create OpenCVE admin user'.
 You can set a new one with the following command: ./install.sh create-superuser
 The installed version is: master

- on port 8080 for OpenCVE Airflow scheduler
 You can login with the username "xxx" and password "xxx".

 👋 Installation complete! Thank you for choosing OpenCVE!

Ports depend on OPENCVE_PORT and AIRFLOW_WEBSERVER_PORT in docker/.env.

Info

Configure email notifications after installation with the SMTP guide.

See the Reference for all script options and commands.

Further reading