trinesh14/tricoredb repository overview

⁠TriCoreDB

One database server for SQL, documents, cache, vectors and graphs, secure by default.

• All data models in one image. Choose which run with one variable.
• TLS required and data volume encrypted (AES-256-GCM) unless you explicitly turn them off.
• Minimal and hardened. Distroless base, no shell, no package manager, non-root (uid 10001), stripped binaries, no source code, no default credentials.
• Verifiable. Published with an SBOM and build provenance.

⁠Tags

Deploy a version tag or a digest, never an unpinned tag.

⁠Quick start

Needs only Docker. Each command is one line and works in bash, zsh, PowerShell and cmd.

1. Create a TLS certificate (self-signed for localhost; use your CA's certificate in production):

docker volume create tricoredb-secrets
docker run --rm -v tricoredb-secrets:/s --entrypoint sh alpine/openssl -c "openssl req -x509 -newkey rsa:3072 -nodes -days 825 -subj /CN=localhost -addext subjectAltName=DNS:localhost,IP:127.0.0.1 -keyout /s/tricoredb_tls_key -out /s/tricoredb_tls_cert && chown -R 10001:10001 /s && chmod 600 /s/tricoredb_tls_key"

2. Create the encryption key:

docker run --rm -v tricoredb-secrets:/s --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.1 storage keygen --out /s/tricoredb_data_key

3. Create the first admin. Set TRICORE_ADMIN_PASSWORD in your shell first (export TRICORE_ADMIN_PASSWORD=... in bash, $env:TRICORE_ADMIN_PASSWORD="..." in PowerShell):

docker run --rm -v tricoredb-data:/var/lib/tricoredb -v tricoredb-secrets:/run/secrets:ro -e TRICORE_ADMIN_PASSWORD --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.1 auth init-admin --user admin --password-env TRICORE_ADMIN_PASSWORD --data-dir /var/lib/tricoredb/data --key-file /run/secrets/tricoredb_data_key

4. Start the server (here with every data model):

docker run -d --name tricoredb --restart unless-stopped --read-only --cap-drop ALL --security-opt no-new-privileges -p 127.0.0.1:8427:8427 -e TRICORE_MODULES=all -v tricoredb-data:/var/lib/tricoredb -v tricoredb-secrets:/run/secrets:ro trinesh14/tricoredb:0.1.0-rc.1

5. Copy out the certificate clients trust, and back up the key:

docker cp tricoredb:/run/secrets/tricoredb_tls_cert tricoredb-ca.crt
docker cp tricoredb:/run/secrets/tricoredb_data_key tricoredb-data-key.backup

Store the key backup away from this machine. Without the key, the data cannot be read by anyone.

Connect on port 8427 as admin, trusting tricoredb-ca.crt.

⁠Development only: no TLS, no encryption

docker run -d --name tricoredb-dev -p 127.0.0.1:8427:8427 -e TRICORE_TLS=off -e TRICORE_ENCRYPTION=off -e TRICORE_MODULES=all -v tricoredb-dev:/var/lib/tricoredb trinesh14/tricoredb:0.1.0-rc.1

Seed an admin as in step 3, without the secrets mount and --key-file, and with the server stopped.

⁠Choosing modules

To change modules, recreate the container with a new value; the data volume keeps its data. A client that calls a disabled module gets the error engine.disabled, with instructions to enable it.

⁠Environment variables

If TLS or encryption is on and its file is missing, the container stops with a message naming the file and how to fix it. Invalid or contradictory settings also stop startup.

⁠Ports and volumes

Publish ports on a named interface: -p 127.0.0.1:8427:8427 is this host only, while -p 8427:8427 exposes the port to every network the host is on.

⁠Security notes

• Keys stay out of the data volume. In production, supply the three files from a secret store (Docker or Kubernetes secrets, or a vault) at the same /run/secrets/... paths.
• Encryption is decided when the data directory is first created. An existing unencrypted volume cannot be encrypted in place.
• New users are added the same way as the first admin, with the server stopped.
• The health check pings the native port over TLS when TLS is on.
• What is not hidden. Compiled binaries can be disassembled by anyone holding the image, and the Studio web UI is JavaScript served to browsers. Neither contains source code or credentials.

⁠Verify the image

docker buildx imagetools inspect trinesh14/tricoredb:0.1.0-rc.1 --format '{{json .SBOM}}'
docker buildx imagetools inspect trinesh14/tricoredb:0.1.0-rc.1 --format '{{json .Provenance}}'
docker scout cves trinesh14/tricoredb:0.1.0-rc.1

⁠License

Apache-2.0