Requirements
Docker Engine 20.10+ or Docker Desktop. No internet connection required after the initial image pull.
Quick Start
docker run -p 8080:8080 \ -v $(pwd)/outputs:/app/outputs \ vaultdiff/app:latest
Open http://localhost:8080 in your browser. Generated PDFs and the run log are written to ./outputs/ on the host.
Air-Gapped Deployment
On a machine with internet access:
docker pull vaultdiff/app:latest docker save vaultdiff/app:latest \ -o vaultdiff.tar
Transfer vaultdiff.tar to the air-gapped server, then:
docker load -i vaultdiff.tar docker run -p 8080:8080 \ -v $(pwd)/outputs:/app/outputs \ vaultdiff/app:latest
The container makes no outbound network connections at runtime. Once loaded, it is fully self-contained.
What the Container Logs
- HTTP request logs (method, path, status, timestamp) to stdout — no file contents logged
- Uploaded files are deleted immediately after PDF generation — never written to container storage
- Run metadata (analyst name, timestamp, SHA-256 hashes, row/column counts, config) written to
outputs/vaultdiff.db(SQLite) - No data is sent externally under any circumstances
Updates
Air-gapped: re-pull, re-save, and re-transfer the image. Your outputs/ volume is preserved across image replacements.
Connected: docker pull vaultdiff/app:latest to fetch the latest image.
Licensing (Pilot)
Pilot licenses operate on a named-analyst honour model. No license key is required to run the container. Production licenses include a signed deployment agreement specifying permitted analyst count and use cases.