Docker

Run the gateway as a sidecar next to your agent's container, sharing a network path so egress can be enforced without changing application code.

The sidecar terminates the agent's outbound traffic and the gateway's MCP/A2A connections, so enforcement happens without the application container needing to know Cirvix exists beyond its configured proxy.

Sidecar pattern

docker-compose.yml

services:  agent:    build: .    environment:      HTTPS_PROXY: http://cirvix-gateway:8443      CIRVIX_ENV: staging    depends_on: [cirvix-gateway]   cirvix-gateway:    image: cirvix/cirvix:latest    command: ["gateway", "--servers", "/etc/cirvix/mcp.json", "--policy", "/etc/cirvix/cirvix.policy.json"]    volumes:      - ./policies:/etc/cirvix/policies:ro      - ./cirvix.policy.json:/etc/cirvix/cirvix.policy.json:ro    ports:      - "8443:8443"

Running it directly

TerminalShell

$ docker run --rm -d \    -e CIRVIX_JWT_SECRET="$(openssl rand -hex 32)" \    -e CIRVIX_DATA=/data/cirvix.db \    -v cirvix-data:/data \    -p 8787:8787 \    cirvix/control-plane:0.1.0

Environment variables

Variable	Purpose
`CIRVIX_ENV`	Environment context for policy — `local`, `staging`, `production`
`CIRVIX_API_URL` / `CIRVIX_API_KEY`	Control plane to sync policy from and ship telemetry to
`CIRVIX_LOG_LEVEL`	`error` \| `warn` \| `info` \| `debug`
`CIRVIX_VAULT_ADDR`	Vault endpoint, when `secrets.vault = "vault"`
`CIRVIX_API_KEY`	Control-plane API key, for hosted mode only

ConfigurationEvery flag and environment variable.KubernetesThe same pattern, chart-managed.

Edit this page on GitHub

Was this page helpful?