Home / Deployment

Deploy ThreatLark where your data lives

Self-hosted by design. Run it in Docker, install it on a hardened Linux host, or add the browser extension. Your scan data stays inside your environment.

Deployment options

Three ways to run it

Pick the model that suits your environment; Docker and direct installs are kept at feature parity.

Fastest start

Docker

One command builds and starts a complete instance. Every scanner binary is baked into the image, so the host needs only Docker and Docker Compose.

Bare-metal / VM

Distro-aware installer

./install.sh detects Kali/Debian or a RHEL-family distro, installs prerequisites, generates secrets and a TLS certificate, builds, migrates and starts the app. Safe to re-run. Pairs with in-app one-click updates.

Chrome & Edge

Browser extension

A Manifest V3 companion (served from the app behind authentication) that runs tech-detect, SSL/TLS, port scan, WHOIS and CVE lookups against the current tab through your signed-in session, with no API keys stored in the extension.

Docker quick start

One command to a running instance

The simplest way to run a complete instance.

What the container does for you

All scanner binaries baked in: nmap (with raw-socket capabilities), sslscan, whois, Chromium for PDF export, massdns, nuclei with its full template set, and the bundled recon tools. No runtime downloads.
First-boot self-configuration: generates persistent secrets and a local CA→leaf TLS certificate once, applies database migrations and creates the first-run admin.
One data volume: the encrypted database, secrets, TLS material and backups live in a single named volume, so down/up keeps your data.

# build and start a complete instance
git clone <your-clone-url> ThreatLark && cd ThreatLark
docker compose up -d --build

# first-run admin password (forced change + MFA setup)
docker compose logs | grep -A4 FIRST-RUN

# then open https://localhost:4000 and sign in as "admin"

Variable	Purpose	Default
`APP_HOST`	Hostname or LAN IP browsers use; sets the app origin and the certificate SAN	localhost
`HOST_PORT`	Published host port (the container always listens on 4000)	4000
`ALLOW_PRIVATE_TARGETS`	Allow scanning private/RFC1918 targets (typical for internal assessments)	true

Requirements

What you need

Docker needs nothing on the host but Docker itself; a direct install needs a few system tools.

Docker deployment
Host	Linux with Docker and Docker Compose
Scanner tooling	None required on the host, baked into the image
Network	Reach to the ranges you are authorized to scan

Bare-metal deployment
Runtime	Node.js 24+ and npm
Platform	Linux x86_64 (for the bundled scanner binaries); Kali/Debian and RHEL families supported by the installer
Host tools	`whois`, `ping`, `free`, `df`; `chromium` or Google Chrome for PDF export; `massdns` for active subdomain brute-forcing

Where a Debian-only binary is unavailable, the affected tool degrades gracefully. For example, the SSL/TLS scanner falls back to an nmap engine when sslscan is not installed.

Operations

Run it like production software

Day-two features are built in.

TLS out of the box

A local CA→leaf certificate is issued on first boot. Install your own CA-signed certificate from the admin panel with no restart, or terminate TLS at a reverse proxy.

Backup & restore

AES-256-GCM encrypted snapshots on demand or on a schedule, with optional push to remote SSH/SFTP targets. Restores require re-entering the admin password.

In-app updates

On supervised installs, one click backs up the database, pulls the new release, rebuilds and restarts. Docker deployments redeploy the image instead.

Corporate proxy support

Route outbound scanning and threat-intel traffic through your HTTP, HTTPS or SOCKS proxy, applied live. Raw TCP/UDP/ICMP tools such as nmap bypass it by nature.

Operational visibility

Live server health (CPU, memory, disk, database size) and background-scheduler heartbeats show whether scheduled scans and backups are running.

Offline licensing

Licence keys are signed tokens verified locally with no phone-home, so a licensed instance works on isolated networks.

Stack

Built on a conventional, auditable stack

Open standards and mainstream components throughout.

Layer	Technology
Frontend	React + TypeScript, Vite, Tailwind CSS, TanStack Query, Recharts (a single-page app served by the same process)
Backend	Node.js + TypeScript, Express, Prisma ORM
Database	Encrypted libSQL / SQLite, an embedded file with no separate database container
Auth	Argon2id, server-side sessions, CSRF double-submit cookie, TOTP MFA, WebAuthn, hash-chained audit log
Reports	Headless Chromium for PDF rendering
Testing / CI	Vitest unit tests and continuous integration

Planning a deployment?

Tell us about your environment and we will walk through sizing, network placement and access control.

Request a demo