Docker Quickstart

Deploy Purple8 Hyper Graph (v0.72.0) as a complete in-process AI backend — REST API, LCNC operational console, and 125-tool MCP server — in seconds using Docker.

Default Port Reference

• Docker (docker run / docker compose up): port 8000 (http://localhost:8000, MCP SSE at http://localhost:8000/mcp/sse)
• Local Python (python -m purple8_graph.secure_server): port 8100 (http://localhost:8100, MCP SSE at http://localhost:8100/mcp/sse)

Single command (Developer Free Image)

docker run -d \
  --name purple8-graph \
  -p 8000:8000 \
  -e P8G_PORT=8000 \
  -e P8G_API_KEY=devkey \
  -e P8G_JWT_SECRET=your-secret-key-minimum-32-characters \
  -e P8G_ADMIN_EMAIL=admin@yourcompany.com \
  -e P8G_ADMIN_PASSWORD=YourSecurePassword123 \
  -e P8G_DATA_PATH=/data \
  -v purple8-data:/data \
  ghcr.io/purple8-technologies/purple8-graph:developer

You can also pin the exact version tag ghcr.io/purple8-technologies/purple8-graph:0.72.0.

• REST API: http://localhost:8000
• Interactive OpenAPI Docs: http://localhost:8000/docs
• LCNC Admin & Operations Console: http://localhost:8000/lcnc/
• MCP SSE Endpoint: http://localhost:8000/mcp/sse (125 tools across 16 namespaces)

With Docker Compose

# docker-compose.yml
services:
  purple8-graph:
    image: ghcr.io/purple8-technologies/purple8-graph:developer
    ports:
      - "8000:8000"
    environment:
      P8G_PORT: "8000"
      P8G_API_KEY: "${P8G_API_KEY:-devkey}"
      P8G_JWT_SECRET: "your-secret-key-minimum-32-characters"
      P8G_ADMIN_EMAIL: "admin@yourcompany.com"
      P8G_ADMIN_PASSWORD: "YourSecurePassword123"
      P8G_DATA_PATH: "/data"
    volumes:
      - purple8-data:/data
    restart: unless-stopped

volumes:
  purple8-data:

docker compose up -d

Quick smoke test

# 1. Get a token
TOKEN=$(curl -s -X POST http://localhost:8000/auth/login \
  -H "Content-Type: application/json" \
  -d '{"email":"admin@yourcompany.com","password":"YourSecurePassword123"}' \
  | jq -r .access_token)

# 2. Add a node
curl -s -X POST http://localhost:8000/nodes \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"id":"doc1","labels":["Document"],"properties":{"title":"Hello Purple8"}}'

# 3. Query it
curl -s -X POST http://localhost:8000/query \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"MATCH (n:Document) RETURN n.title"}'

Red Hat UBI9 / OpenShift-Certified Image

As a Red Hat Technology Partner, Purple8 provides an enterprise-hardened Red Hat Universal Base Image 9 (Dockerfile.rhel) built for OpenShift and regulated Kubernetes environments:

• Runs cleanly under OpenShift's arbitrary non-root UID security context (USER 1001, group 0 permissions on /data and runtime paths).
• Includes /licenses metadata and full Red Hat container certification labels.

docker build -f Dockerfile.rhel -t purple8-graph:0.72.0-ubi9 .

Self-Hosted Licensing Tiers (2 Tiers)

The same container supports both self-hosted tiers:

Tier	License Variable	Included Capabilities
Developer (Self-Hosted Free)	None required ($0)	Up to 50K nodes, 1 MCP agent, full GraphEngine (BrickCoreStorage + BrickWAL + CortexAutoConfig + HNSW + Cypher + Journey + RAG) for local development, prototyping, and evaluation.
Enterprise / Custom (Self-Hosted)	PURPLE8_LICENSE_JWT=<token> (PURPLE8_REQUIRE_LICENSE=1)	Unlimited nodes & MCP agents, SSO/OIDC/SAML, 4-tier RBAC, immutable audit trail, managed KMS (Vault · AWS · GCP · Azure), Raft HA & automatic failover, horizontal sharding, Supergraph federation, SOC vertical, and SLA-backed support.

With encryption at rest (KMS)

Add KMS_PROVIDER to enable AES-256-GCM envelope encryption on all node and edge values:

environment:
  P8G_JWT_SECRET: "your-secret-key-minimum-32-characters"
  KMS_PROVIDER: "local"           # local | vault | aws | gcp | azure
  KMS_LOCAL_KEYSTORE: "/data/kms"

For cloud KMS providers, see the Encryption & KMS guide.

Environment variables

Variable	Required	Default	Description
P8G_PORT	No	8000 (Docker) / 8100 (local CLI)	HTTP listen port
P8G_API_KEY	Recommended	—	Bootstrap API key for REST and MCP (/mcp/sse)
P8G_JWT_SECRET	Yes (production)	dev default	JWT signing secret (min 32 chars)
P8G_ADMIN_EMAIL	No	—	Bootstrap admin user email
P8G_ADMIN_PASSWORD	No	—	Bootstrap admin user password
P8G_DATA_PATH	Yes (Docker)	./data	Persistent data directory (BrickCoreStorage + BrickWAL + HNSW)
PURPLE8_LICENSE_JWT	Enterprise only	—	Signed Enterprise license token
PURPLE8_REQUIRE_LICENSE	No	0	Set to 1 in Enterprise production to fail closed if license is missing
KMS_PROVIDER	No	local	local | vault | aws | gcp | azure

Full environment variable reference → /reference/env-vars