Requirements and network
Host size, Docker version, Elasticsearch version, LLM endpoint, hostname, and the inbound / outbound ports to open.
Shape
Elastic AI Copilot ships as Docker only: one gateway container, a Caddy reverse proxy (TLS) and an optional Postgres (multi-user account table). It does not ship Elasticsearch: it connects to an existing ES 8.x / Kibana, reads logs and alerts from the cluster and writes only a handful of .rst_copilot_* indices of its own.
Host
| Item | Requirement |
|---|---|
| OS | Ubuntu 20.04 / 22.04 / 24.04 or equivalent Linux (Debian, RHEL family) |
| Size | 2 vCPU / 4 GB RAM / 20 GB disk minimum; the gateway container is capped at 2 CPU / 2 GB by default (RST_GATEWAY_CPUS / RST_GATEWAY_MEM) |
| Runtime | Docker Engine 24+, Docker Compose v2 (docker compose version works) |
| Access | An account that can run docker; deploy.sh runs as a docker-group user or with sudo |
A local embedding model (air-gapped knowledge base) adds about 3 GB RAM for Ollama + bge-m3, CPU only.
Elasticsearch
| Item | Requirement |
|---|---|
| Version | 8.x (verified on 8.12). 7.x is not supported |
| Network | The gateway host reaches ES on 9200 (or 9243); with HTTPS and a private CA, put the CA under ./certs/ |
| Account | A dedicated user, privileges in ES permissions |
| Kibana | Optional; only for "Open in Kibana" links and webhook alert push |
LLM
Any OpenAI-compatible endpoint: Volcengine Ark, DeepSeek, Qwen, Azure OpenAI, self-hosted vLLM / Ollama. You need the URL, an API key and a model name. Air-gapped sites use a local model with the "airgapped" masking mode. More providers for failover can be added later under AI models.
Hostname
CADDY_SITE_ADDRESS must be a hostname (e.g. copilot.corp.local), not a bare IP: an IP literal is not a valid TLS SNI and some browsers refuse the handshake. Without internal DNS, add a hosts entry on the analysts' machines.
Ports
Inbound (to the gateway host):
| Port | From | Purpose |
|---|---|---|
| 443 / TCP | Analyst network | https://<hostname>/v2/, the only entry point |
| 80 / TCP | Analyst network | HTTP → HTTPS redirect (optional) |
Gateway 8000, ES 9200 and Kibana 5601 are not exposed; they stay on the compose-internal network. On cloud hosts open 443 in the security group as well.
Outbound (the gateway host must reach):
| Target | Port | Purpose | Required |
|---|---|---|---|
license.reallysec.com | 443 | Activation + heartbeat + online updates | Online licences; not for offline ones |
| LLM endpoint | 443 | Inference + embeddings | Yes (internal for local models) |
| Elasticsearch | 9200 / 9243 | Queries / audit / knowledge base | Yes |
| Kibana | 5601 | Deep links | Optional |
| Feishu / DingTalk / WeCom / SMTP | 443 / 465 / 587 | Notifications | Optional |
Quick start
The shortest path from the delivery archive to a working login: one Linux host, Docker, an existing Elasticsearch, one run of deploy.sh.
Installing from the archive
What the delivery archive contains, what every step of deploy.sh does and how to answer each prompt, how to install by hand, and the post-install checklist.