Deploying the NeuVector runtime security platform on Docker infrastructure requires precise configuration of Linux capabilities, namespace sharing, and host-level mounts. The following deployment strategy separates the management plane from the host enforcement agents to ensure clean architecture and scalable operations.

Management Controller & Scanner Configuration

Create a dedicated compose file for the central management controller and image scanner. This stack handles policy distribution, vulnerability scanning, and web console access. The configuration uses modern long-form volume syntax for explicit read-only bindings and isolates traffic on a dedicated internal bridge network.

services:
  nv_manager:
    image: neuvector/allinone:latest
    container_name: nv-ctrl-node
    restart: unless-stopped
    pid: host
    cap_add:
      - SYS_ADMIN
      - NET_ADMIN
      - SYS_PTRACE
      - IPC_LOCK
    security_opt:
      - apparmor:unconfined
      - seccomp:unconfined
      - label:disable
    environment:
      CLUSTER_JOIN_ADDR: "10.0.0.50"
      NV_PLATFORM_INFO: "platform=Docker"
    ports:
      - "18300:18300"
      - "18301:18301"
      - "18400:18400"
      - "18401:18401"
      - "18301:18301/udp"
      - "8443:8443"
    networks:
      - nv_internal
    volumes:
      - type: bind
        source: /lib/modules
        target: /lib/modules
        read_only: true
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
      - type: bind
        source: /proc
        target: /host/proc
        read_only: true
      - type: bind
        source: /sys/fs/cgroup
        target: /host/cgroup
        read_only: true
      - nv_persist:/var/neuvector

  nv_scanner:
    image: neuvector/scanner:latest
    container_name: nv-scanner-node
    restart: unless-stopped
    environment:
      CLUSTER_JOIN_ADDR: "10.0.0.50"
    ports:
      - "18402:18402"
    networks:
      - nv_internal
    volumes:
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true

volumes:
  nv_persist:
    driver: local

networks:
  nv_internal:
    driver: bridge

Replace the placeholder IP in CLUSTER_JOIN_ADDR with the actual IPv4 address of the management host. The controller exposes the HTTPS console on port 8443 and reserves UDP/TCP channels for inter-node coordination.

Host Agent Deployment

Every compute node requires an enforcer container to monitor runtime behavior, enforce network policies, and intercept system calls. Deploy this agent using a separate compose definition on each worker machine. The agent communicates upstream to the controller established in the previous section.

services:
  nv_agent:
    image: neuvector/enforcer:latest
    container_name: nv-enforcer-host
    restart: unless-stopped
    pid: host
    cap_add:
      - SYS_ADMIN
      - NET_ADMIN
      - SYS_PTRACE
      - IPC_LOCK
    security_opt:
      - apparmor:unconfined
      - seccomp:unconfined
      - label:disable
    environment:
      CLUSTER_JOIN_ADDR: "10.0.0.50"
      NV_PLATFORM_INFO: "platform=Docker"
    ports:
      - "18301:18301"
      - "18401:18401"
      - "18301:18301/udp"
    networks:
      - nv_internal
    volumes:
      - type: bind
        source: /lib/modules
        target: /lib/modules
        read_only: true
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock
        read_only: true
      - type: bind
        source: /proc
        target: /host/proc
        read_only: true
      - type: bind
        source: /sys/fs/cgroup/
        target: /host/cgroup/
        read_only: true

networks:
  nv_internal:
    driver: bridge

Ensure the CLUSTER_JOIN_ADDR value precisely matches the management node's IP. The enforcer leverages the host PID namespace and specific capabilities to inject kernel modules and attach eBPF prrobes for real-time threat detection.

Service Orchestration

Initialize the management stack by executing the following command in the directory containing the controller configuration:

docker compose -f compose-ctrl.yaml up -d

Deploy the enforcement agents across your infrastructure using the corresponding file:

docker compose -f compose-agent.yaml up -d

Validate container health, state transitions, and port bindings on each node:

docker compose -f compose-ctrl.yaml ps
docker compose -f compose-agent.yaml ps

Allow approximately 30 to 60 seconds for the kernel modules to compile and load, after which the enforcer agents will automatically register with the central controller.

Web Console Access

Access the management interface via a secure HTTPS connection using the manager's IP adress:

https://<manager_ip>:8443/

Authenticate using the default credantials:

• Username: admin
• Password: admin

Upon initial login, update the default credentials and configure role-based access control policies to align with organizational security baselines.