Docker Compose

One docker-compose.yaml for the whole stack: backing services, ovc-backend (API + worker), guacd and ovc-frontend, using the published container images. guacd stays on the internal Compose network: only ovc-frontend’s server talks to it (GUACD_URL: ovc-guacd:4822), never the browser.

Ready to deploy?

quick-install/docker is a hardened, ready-to-run version of this - everything behind a single nginx entrypoint, Keycloak’s realm auto-imported, the session secret generated on first run. This page explains the why; the linked README has the actual compose file and setup.sh / up.sh / down.sh.

Stack Explorer - quick-install/docker

Docker Compose9 servicesKubernetes31 manifests

▶ Follow a request

BrowserOperators

nginxSingle entrypoint

ovc-frontendReact 19 · SSR web UI

ovc-backendFastAPI · REST API

ovc-backend-workerRabbitMQ consumer

guacdConsole proxy

KeycloakOIDC · optional

RabbitMQMessage bus

PostgreSQLSystem of record

ValkeyCache & locks

Hyper-V hostsovc-agent per host

React Flow

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.

Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

Click a component · drag to rearrange

quick-install/docker

One Compose file, one entrypoint

9 services and 4 named volumes behind a single nginx on :80. Published images from GHCR - run ./up.sh and open http://localhost.

containers

9

containers

volumes

4

volumes

port to open

1

port to open

Components

• Browser
• nginx
• ovc-frontend
• ovc-backend
• ovc-backend-worker
• guacd
• Keycloak
• RabbitMQ
• PostgreSQL
• Valkey
• Hyper-V hosts

Outside the stackEntrypointOpen vCenterBacking serviceIdentity

OIDC login

By default ovc-backend and ovc-frontend wire up to Keycloak (or any other OIDC/OAuth2 provider) for real login - see OIDC provider and Access control for how groups are read and what they grant.

No IdP, quick testing only: set OVC_AUTH_MODE: stub on both ovc-backend and ovc-frontend instead - every request is then treated as a fixed admin user, no login and no IdP needed. ovc-frontend shows a standing warning dialog while this is active; never use it beyond a trusted network. For local UI development the bypass is also available outside Docker - see Running in dev mode.

Bring it up

git clone https://github.com/openvcenter/Open-vCenter.git
cd Open-vCenter/quick-install/docker
./up.sh
curl localhost:8000/api/health   # {"ok":true,"db":true,"cache":true,"rabbit":true}

On first run up.sh calls setup.sh, which asks one question: the hostname or IP that browsers and your Hyper-V hosts use to reach this machine (default localhost, which only suits a browser on the same machine). It writes .env with every URL derived from that host - the app (http://<host>), Keycloak (http://<host>:8080), the agents’ RabbitMQ URL (amqp://<host>:5672/) - plus a generated session secret. Re-run ./setup.sh to change the host (--host <name> skips the prompt).

When everything is up, up.sh checks sign-in from inside the frontend container and prints OK or what failed. Open http://<host> and log in as admin / admin. ./down.sh tears it down (--purge also drops the data volumes and .env).

Keycloak imports the realm only on first boot. After changing the host on an existing install, ./down.sh --purge and ./up.sh again, or update the ovc-frontend client’s redirect URIs in the Keycloak admin console.

Hosts are added and agents installed from the frontend once you’re logged in - see Running in dev mode › Agent for the Add Host / Setup Agent steps.