Frequently asked questions
#Installation
Why two addresses and not one? The web console serves the browser and does not pass other clients' requests through to the API. Pipelines, the CLI and runtime agents need the API, so it gets its own name. That also lets you restrict it separately. See Ports and networking.
Which ports must be open? TCP 443 inbound, plus TCP 80 if you use Let's Encrypt. Nothing else. The application's own ports, 3000 and 3001, are internal.
Can it run behind our proxy or without internet access?
Both. Set HTTPS_PROXY and NO_PROXY for a proxy. For no internet at all use the offline mode (Running dpndncY without internet access (air-gapped)).
Can we run several copies for high availability? No. It is one container per installation, with a SQLite database in a volume. Make the machine bigger rather than adding copies, and keep backups. Recovery is restoring the volume.
Can we use PostgreSQL or another database? No. SQLite is the only supported database.
Docker, a virtual machine, or Kubernetes? Whichever you already run. One Linux machine with the installer is the quickest. Kubernetes uses the Helm chart. All three run the same image.
How big a machine? 4 vCPU, 8 GB of memory and 50 GB of disk for a team. The minimum is 2 vCPU, 4 GB and 20 GB. See Deploying dpndncY.
How do we get the image? From the registry with a login, from a file, or through your own registry. See Getting the software.
#Using it
What does a scan send out of our network? Package names and versions, to look up advisories. Never source code. See Security and data.
What decides whether a build passes? The tenant's scan policy, chosen in the console. The CLI exits 0 when the scan passes it and 1 when it fails. See Scan policies.
Our pipeline fails on everything. Why? Probably a strict policy. Start with Pull Request Gate or Known Exploited Only, then tighten step by step.
Why does every repository land in one project?
The checkout folder has a meaningless name. Pass --project <name> or set DPNDNCY_PROJECT.
How do we add people? The organisation owner adds them under Settings, Users, with a role. With single sign-on, add each person first; signing in does not place them in an organisation. See Tenants, users and access.
Can one installation serve several customers? Yes. The operator creates one tenant per customer. They cannot see each other's data.
#Operations
How do we back it up? Take a consistent copy of the database while it runs, or snapshot the whole volume. See Running dpndncY.
How do we upgrade?
Back up, change the version, pull and restart, check /health. Pin a version so an upgrade is a decision.
Why was everyone signed out after a restart? Browser sessions end when the server restarts. API tokens are not affected.
How do we rotate secrets?
The signing key rotates by itself every 90 days, without signing anyone out. API tokens can be capped in lifetime. APP_SECRET is replaced with a tool that re-encrypts stored credentials. See Running dpndncY.
What happens when the licence ends? There is a 7-day grace period, then the installation is read-only: data stays visible, and new scans are blocked until a licence is applied.
#Security
Does it phone home? No telemetry. A licence check-in (licence id and totals) is off by default and always off in air-gapped mode.
Is the data encrypted? In transit with HTTPS. Stored credentials are encrypted. The database file is not, so use disk or volume encryption.
Where are the audit logs? Settings, Activity, for the operator. They are kept for 90 days by default.