Install

Run TriCoreDB with Docker or Kubernetes

Both run the same server. TLS is required and the data volume is encrypted unless you turn them off, and there is no built-in password, so you create the certificate, the key and the first admin yourself.

Dockertrinesh14/tricoredb:0.1.0-rc.3-r2 KubernetesHelm chart 0.2.2

Docker

A secured server in five commands

Each command is one line and works in bash, zsh, PowerShell and cmd. You only need Docker.

Docker Hub

Create a TLS certificate

Self-signed for localhost. Use your CA’s certificate in production.

shell

docker volume create tricoredb-secrets
docker run --rm -v tricoredb-secrets:/s --entrypoint sh alpine/openssl -c "openssl req -x509 -newkey rsa:3072 -nodes -days 825 -subj /CN=localhost -addext subjectAltName=DNS:localhost,IP:127.0.0.1 -addext basicConstraints=critical,CA:FALSE -addext keyUsage=critical,digitalSignature,keyEncipherment -addext extendedKeyUsage=serverAuth -keyout /s/tricoredb_tls_key -out /s/tricoredb_tls_cert && chown -R 10001:10001 /s && chmod 600 /s/tricoredb_tls_key"

Create the encryption key

shell

docker run --rm -v tricoredb-secrets:/s --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.3-r2 storage keygen --out /s/tricoredb_data_key

Create the first admin

Set TRICORE_ADMIN_PASSWORD in your shell first: export TRICORE_ADMIN_PASSWORD=... in bash, or $env:TRICORE_ADMIN_PASSWORD="..." in PowerShell.

shell

docker run --rm -v tricoredb-data:/var/lib/tricoredb -v tricoredb-secrets:/run/secrets:ro -e TRICORE_ADMIN_PASSWORD --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.3-r2 auth init-admin --user admin --password-env TRICORE_ADMIN_PASSWORD --data-dir /var/lib/tricoredb/data --key-file /run/secrets/tricoredb_data_key

Start the server

Here with every data model enabled.

shell

docker run -d --name tricoredb --restart unless-stopped --read-only --cap-drop ALL --security-opt no-new-privileges -p 127.0.0.1:8427:8427 -e TRICORE_MODULES=all -v tricoredb-data:/var/lib/tricoredb -v tricoredb-secrets:/run/secrets:ro trinesh14/tricoredb:0.1.0-rc.3-r2

Copy out the certificate, and back up the key

Store the key backup away from this machine. Without the key, nobody can read the data.

shell

docker cp tricoredb:/run/secrets/tricoredb_tls_cert tricoredb-ca.crt
docker cp tricoredb:/run/secrets/tricoredb_data_key tricoredb-data-key.backup

Connect

Connect on port 8427 as admin, trusting tricoredb-ca.crt. Each SDK’s README shows how to connect with TLS.

For local development only

No TLS and no encryption, bound to this machine only. Create the admin first, then start the server.

shell

docker run --rm -v tricoredb-dev:/var/lib/tricoredb -e TRICORE_ADMIN_PASSWORD --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.3-r2 auth init-admin --user admin --password-env TRICORE_ADMIN_PASSWORD --data-dir /var/lib/tricoredb/data
docker run -d --name tricoredb-dev -p 127.0.0.1:8427:8427 -e TRICORE_TLS=off -e TRICORE_ENCRYPTION=off -e TRICORE_MODULES=all -v tricoredb-dev:/var/lib/tricoredb trinesh14/tricoredb:0.1.0-rc.3-r2

Without TLS, passwords and data cross the network in clear text. Keep this mode on127.0.0.1and never expose it.

Choosing modules

Recreate the container with a new value to change them; the data volume keeps its data. A call to a disabled module fails with engine.disabled.

You pass	Modules that run
nothing	sql, document, cache
-e TRICORE_MODULES=all	sql, document, cache, vector, graph, llm
-e TRICORE_MODULES=sql,vector	only those listed

Ports and volumes

-p 127.0.0.1:8427:8427 publishes to this host only;-p 8427:8427exposes the port to every network the host is on.

Port or path	Use
8427	Native protocol, used by every SDK
8429	Health and metrics probes (container loopback by default)
/var/lib/tricoredb	Data volume
/run/secrets/	TLS certificate, TLS key and encryption key

Environment variables

If TLS or encryption is on and its file is missing, the container stops with a message naming the file. Invalid or contradictory settings also stop startup.

Variable	Default	Effect
TRICORE_MODULES	sql,document,cache	all, or a comma list of sql, document, cache, vector, graph, llm
TRICORE_TLS	on	off sends passwords and data in clear text; trusted networks only
TRICORE_TLS_CERT_FILE	/run/secrets/tricoredb_tls_cert	Server certificate (PEM)
TRICORE_TLS_KEY_FILE	/run/secrets/tricoredb_tls_key	Server private key (PEM)
TRICORE_TLS_CA_FILE	—	CA for client certificates (mutual TLS)
TRICORE_TLS_REQUIRE_CLIENT_CERT	off	Require client certificates
TRICORE_ENCRYPTION	on	Encryption at rest for the data volume
TRICORE_ENCRYPTION_KEY_FILE	/run/secrets/tricoredb_data_key	Encryption key

Verify the image

Every image is published with an SBOM and build provenance; the Helm chart is signed. Deploy a version tag or a digest, never an unpinned tag.

shell

docker buildx imagetools inspect trinesh14/tricoredb:0.1.0-rc.3-r2 --format '{{json .SBOM}}'
docker buildx imagetools inspect trinesh14/tricoredb:0.1.0-rc.3-r2 --format '{{json .Provenance}}'
docker scout cves registry://trinesh14/tricoredb:0.1.0-rc.3-r2

Kubernetes

Install the Helm chart

The chart is published at oci://ghcr.io/trinesh14/charts/tricoredb and keeps the image’s secure defaults. The Secrets come first: three for one node, four for a cluster.

Artifact Hub

1
Create a namespace
shell
```
kubectl create namespace tricoredb
```

Create the TLS Secret

A CA and a server certificate it signs, covering the Service names. cert-manager writes the same three keys, so a Certificate resource works too. Keep ca.key offline.

shell

NS=tricoredb
D=$NS.svc.cluster.local
cat > leaf.ext <<EOF
basicConstraints = critical, CA:FALSE
keyUsage = critical, digitalSignature, keyEncipherment
extendedKeyUsage = serverAuth, clientAuth
subjectAltName = DNS:tricoredb.$D, DNS:tricoredb.$NS.svc, DNS:tricoredb, DNS:tricoredb-headless.$D, DNS:*.tricoredb-headless.$D, DNS:localhost, IP:127.0.0.1
EOF
openssl req -x509 -newkey rsa:3072 -sha256 -nodes -days 3650 -subj "/CN=TriCoreDB CA" -keyout ca.key -out ca.crt
openssl req -newkey rsa:3072 -sha256 -nodes -subj "/CN=tricoredb.$D" -keyout tls.key -out tls.csr
openssl x509 -req -in tls.csr -CA ca.crt -CAkey ca.key -CAcreateserial -days 825 -sha256 -extfile leaf.ext -out tls.crt

kubectl -n $NS create secret generic tricoredb-tls --type=kubernetes.io/tls \
  --from-file=tls.crt --from-file=tls.key --from-file=ca.crt

Create the encryption key Secret

Back data.key up somewhere other than this cluster. Without it the volume cannot be read.

shell

docker run --rm --user 0:0 -v "$PWD:/out" \
  --entrypoint /usr/local/bin/tricore trinesh14/tricoredb:0.1.0-rc.3-r2 \
  storage keygen --out /out/data.key

kubectl -n tricoredb create secret generic tricoredb-data-key --from-file=data.key=data.key

Create the admin password Secret

shell

kubectl -n tricoredb create secret generic tricoredb-admin --from-literal=password='<a strong password>'

Install the chart

shell

helm install tricoredb oci://ghcr.io/trinesh14/charts/tricoredb --version 0.2.2 -n tricoredb
kubectl -n tricoredb rollout status statefulset/tricoredb

6
Connect
Inside the cluster, connect to tricoredb.tricoredb.svc.cluster.local:8427 as admin, trusting ca.crt. From your machine, forward the port and use tricoredb.tricoredb.svc.cluster.local or localhost as the TLS server name.
shell
```
kubectl -n tricoredb port-forward svc/tricoredb 8427:8427
```

A replicated cluster

Three, five or seven members each keep a full copy and elect a leader with Raft. A write returns once a majority has it, so the group keeps serving while a minority is down. A cluster also needs the password members use to authenticate to each other.

helm test checks that every member agrees on one leader. The full list of values is on Artifact Hub.

shell

kubectl -n tricoredb create secret generic tricoredb-peer --from-literal=password='<another strong password>'

helm install tricoredb oci://ghcr.io/trinesh14/charts/tricoredb --version 0.2.2 -n tricoredb \
  --set cluster.enabled=true --set replicas=3

helm test tricoredb -n tricoredb

Server running? Add an SDK.

Official clients for eleven languages, each with a quick start that connects, writes and reads.

Choose an SDK

Run TriCoreDB with Docker or Kubernetes

A secured server in five commands

Create a TLS certificate

Create the encryption key

Create the first admin

Start the server

Copy out the certificate, and back up the key

For local development only

Choosing modules

Ports and volumes

Environment variables

Verify the image

Install the Helm chart

Create a namespace

Create the TLS Secret

Create the encryption key Secret

Create the admin password Secret

Install the chart

Connect

A replicated cluster

Server running? Add an SDK.