Docker Deployment

AI Guard is distributed as a multi-platform Docker image supporting both linux/amd64 and linux/arm64 architectures.

Docker Image

The production image is built from a Chainguard wolfi-base base image with:

Pulling the Image

Release Versions

Semver-tagged releases are available with both the version tag and latest:

docker pull docker.onetrust.dev/ai-guard:1.2.3
docker pull docker.onetrust.dev/ai-guard:latest

Development Builds

Images built from development branches are tagged with the branch name:

docker pull docker.onetrust.dev/ai-guard:AIGI-106-feature-name

Running the Container

Basic Usage

docker run -p 4443:4443 ai-guard:latest

The service starts with the default configuration at /etc/ai-guard/config.yaml.

Custom Configuration

Override the configuration by mounting a custom config file:

docker run -p 4443:4443 \
  -v /path/to/my-config.yaml:/etc/ai-guard/config.yaml \
  ai-guard:latest

Or specify a completely different config path:

docker run -p 4443:4443 \
  -v /path/to/my-config.yaml:/opt/config.yaml \
  ai-guard:latest --config /opt/config.yaml

Mounting TLS Certificates

Mount your TLS key and certificate into the container:

docker run -p 4443:4443 \
  -v /path/to/server.key:/etc/ssl/litenode/tls.key:ro \
  -v /path/to/server.crt:/etc/ssl/litenode/tls.crt:ro \
  ai-guard:latest

Environment Variable Overrides

All configuration values support ${VAR} substitution, so you can override any setting via environment variables:

docker run -p 4443:4443 \
  -e AI_GUARD_SERVICE_PORT=0.0.0.0:4443 \
  -e OT_SERVICE_BASE_URL=https://your-tenant.onetrust.com \
  -e TLS_KEY_PATH=/etc/ssl/litenode/tls.key \
  -e CERTIFICATE_PATH=/etc/ssl/litenode/tls.crt \
  -e RUST_LOG=info \
  ai-guard:latest

Building the Image

To build the image from source, you need a GIT_TOKEN environment variable for accessing private dependencies:

docker buildx build \
  --platform linux/arm64,linux/amd64 \
  --secret id=GIT_TOKEN,env=GIT_TOKEN \
  --tag ai-guard:latest \
  .

Health Check

Verify the container is running:

curl -k https://localhost:4443/health

Docker Compose Health Check

services:
  ai-guard:
    image: ai-guard:latest
    ports:
      - "4443:4443"
    healthcheck:
      test: ["CMD", "curl", "-k", "-f", "https://localhost:4443/health"]
      interval: 10s
      timeout: 5s
      retries: 3

Graceful Shutdown

The AI Guard service handles Docker stop signals (SIGTERM, SIGINT) gracefully:

1. The signal is logged
2. The HTTP server stops accepting new connections
3. The metrics exporter is flushed and shut down
4. The process exits cleanly

docker stop <container-id>  # Sends SIGTERM

What's Next?

• Kubernetes Deployment — Deploy on the OneTrust Workernode
• Networking Requirements — Required network connectivity
• Service Configuration — Full configuration reference