jaque ships a distroless, multi-arch container image with the binary and its dashboard assets baked in. There is no entrypoint script, no shell and no package manager in the image; everything the process needs is decided by flags, and every flag has an environment-variable form, so a container is configured the same way a systemd unit is. The image is published only to the project's private registry today.

Status: public distribution of the image is undecided. See project status.

1. The image

Multi-arch (amd64 and arm64), built on gcr.io/distroless/static-debian12:nonroot. One static binary, no shell, and the process runs as a non-root user by default.

2. Run it

docker run --rm -p 8080:8080 \
  -v $(pwd)/jaque.cue:/etc/jaque/config.cue:ro \
  -e JAQUE_CONFIG=/etc/jaque/config.cue \
  -e JAQUE_LISTEN=0.0.0.0:8080 \
  jaque:latest

Every flag has a JAQUE_<FLAG>-shaped environment variable equivalent (see CLI flags). That is the whole container configuration story: no wrapper, no templated config file, no entrypoint to maintain.

3. Perfdata sinks

A CUE config's sinks: block (see Sinks and perfdata) works the same way inside a container as anywhere else. Point it at whatever metrics stack is already running, with the config mounted the same way as in section 2.

4. Security considerations

-p 8080:8080 publishes the dashboard, the API and /metrics to every interface of the host, and nothing on that listener is authenticated except the command API when JAQUE_API_TOKEN is set. Secrets passed with -e are readable by anything that can inspect the container. Security states the posture; a reverse proxy in front of the published port is the recommended shape for anything beyond a workstation.