> Section: [7. Running it](https://jaque.sh/docs/deployment/overview.md)
> Next: deployment/security
> Index: https://jaque.sh/llms.txt


jaque ships a distroless, multi-arch container image with the binary
and its dashboard assets baked in. There is no entrypoint script, no
shell and no package manager in the image; everything the process
needs is decided by flags, and every flag has an environment-variable
form, so a container is configured the same way a systemd unit is. The
image is published only to the project's private registry today.

Status: public distribution of the image is undecided. See
[project status](https://jaque.sh/docs/project/status.md).

## 1. The image

Multi-arch (amd64 and arm64), built on
`gcr.io/distroless/static-debian12:nonroot`. One static binary, no shell,
and the process runs as a non-root user by default.

## 2. Run it

```sh
docker run --rm -p 8080:8080 \
  -v $(pwd)/jaque.cue:/etc/jaque/config.cue:ro \
  -e JAQUE_CONFIG=/etc/jaque/config.cue \
  -e JAQUE_LISTEN=0.0.0.0:8080 \
  jaque:latest
```

Every flag has a `JAQUE_<FLAG>`-shaped environment variable equivalent
(see [CLI flags](https://jaque.sh/docs/reference/cli-flags.md)). That is the whole
container configuration story: no wrapper, no templated config file,
no entrypoint to maintain.

## 3. Perfdata sinks

A CUE config's `sinks:` block (see [Sinks and
perfdata](../observability/sinks-and-perfdata.md)) works the same way
inside a container as anywhere else. Point it at whatever metrics
stack is already running, with the config mounted the same way as in
section 2.

## 4. Security considerations

`-p 8080:8080` publishes the dashboard, the API and `/metrics` to every
interface of the host, and nothing on that listener is authenticated
except the command API when `JAQUE_API_TOKEN` is set. Secrets passed
with `-e` are readable by anything that can inspect the container.
[Security](https://jaque.sh/docs/deployment/security.md) states the posture; a reverse
proxy in front of the published port is the recommended shape for
anything beyond a workstation.