Docker Compose

One docker-compose.yaml for the whole stack: backing services, ovc-backend (API + worker), guacd and ovc-frontend, using the published container images. guacd stays on the internal Compose network: only ovc-frontend’s server talks to it (GUACD_URL: ovc-guacd:4822), never the browser.

Ready to deploy?

quick-install/docker is a hardened, ready-to-run version of this - everything behind a single nginx entrypoint, Keycloak’s realm auto-imported, the session secret generated on first run. This page explains the why; the linked README has the actual compose file and up.sh / down.sh.

Stack Explorer - quick-install/docker

Docker Compose9 servicesKubernetes31 manifests

▶ Follow a request

BrowserOperators

nginxSingle entrypoint

ovc-frontendReact 19 · SSR web UI

ovc-backendFastAPI · REST API

ovc-backend-workerRabbitMQ consumer

guacdConsole proxy

KeycloakOIDC · optional

RabbitMQMessage bus

PostgreSQLSystem of record

ValkeyCache & locks

Hyper-V hostsovc-agent per host

React Flow

Press enter or space to select a node. You can then use the arrow keys to move the node around. Press delete to remove it and escape to cancel.

Press enter or space to select an edge. You can then press delete to remove it or escape to cancel.

Click a component · drag to rearrange

quick-install/docker

One Compose file, one entrypoint

9 services and 4 named volumes behind a single nginx on :80. Published images from GHCR - run ./up.sh and open http://localhost.

containers

9

containers

volumes

4

volumes

port to open

1

port to open

Components

• Browser
• nginx
• ovc-frontend
• ovc-backend
• ovc-backend-worker
• guacd
• Keycloak
• RabbitMQ
• PostgreSQL
• Valkey
• Hyper-V hosts

Outside the stackEntrypointOpen vCenterBacking serviceIdentity

OIDC login

By default ovc-backend and ovc-frontend wire up to Keycloak (or any other OIDC/OAuth2 provider) for real login - see OIDC provider and Roles for how roles are read and what each one grants.

No IdP, quick testing only: set OVC_AUTH_MODE: stub on both ovc-backend and ovc-frontend instead - every request is then treated as a fixed admin user, no login and no IdP needed. ovc-frontend shows a standing warning dialog while this is active; never use it beyond a trusted network. For local UI development the bypass is also available outside Docker - see Running in dev mode.

Bring it up

git clone https://github.com/openvcenter/Open-vCenter.git
cd Open-vCenter/quick-install/docker
./up.sh
curl localhost:8000/api/health   # {"ok":true,"db":true,"cache":true,"rabbit":true}

up.sh generates the frontend’s session secret into .env on first run, so use it rather than a bare docker compose up. Open http://localhost and log in as admin / admin. ./down.sh tears it down (--purge also drops the data volumes and .env).

Hosts are added and agents installed from the frontend once you’re logged in - see Running in dev mode › Agent for the Add Host / Setup Agent steps.