Docker Deployment

Overview#

JustC2 includes a docker-compose.yml with multiple profiles for building and running the different components:

Building with Docker#

Build Server + Extenders#

This is the most common Docker build — it produces the server binary and all extender plugins:

make docker-build-server-ext

Or equivalently:

make docker-build-all

The output is placed in JustServer/server-dist/.

Build Server Only#

make docker-build-server

Build Extenders Only#

make docker-build-extenders

Build Client AppImage#

make docker-build-client

The client AppImage is output to JustClient/client-dist/.

Running with Docker#

Start the Server#

Once built, start the runtime container:

make docker-up

This launches the server in detached mode with:

• Host networking — The container shares the host’s network stack, so the server listens on the host’s interfaces directly
• Persistent data — JustServer/server-dist/data/ is mounted as a volume for the SQLite database and downloads
• Read-only config — profile.yaml is mounted read-only
• Resource limits — 2 CPUs and 2 GB RAM maximum; 1 CPU and 1 GB reserved
• Auto-restart — The container restarts unless explicitly stopped

View Logs#

make docker-logs

This follows the server logs in real time. Press Ctrl+C to stop following.

Stop the Server#

make docker-down

Restart#

make docker-restart

Configuration#

Before starting the runtime container, edit the configuration:

# Edit the profile after building
nano JustServer/server-dist/profile.yaml

Generate TLS certificates in the server-dist directory:

cd JustServer/server-dist
openssl req -x509 -nodes -newkey rsa:2048 \
    -keyout server.rsa.key -out server.rsa.crt -days 3650

Cleaning Docker Resources#

# Remove build containers and images
make docker-clean

# Remove everything (containers, images, volumes, networks)
make docker-clean-all

Custom Docker Compose#

The default docker-compose.yml can be customized. Key sections:

services:
  just-server-runtime:
    profiles:
      - runtime
    network_mode: host
    volumes:
      - ./JustServer/server-dist/data:/app/data
      - ./JustServer/server-dist/profile.yaml:/app/profile.yaml:ro
    environment:
      - TZ=${TZ:-UTC}
    restart: unless-stopped
    deploy:
      resources:
        limits:
          cpus: '2.0'
          memory: 2G
        reservations:
          cpus: '1.0'
          memory: 1G

Adjusting Resource Limits#

Modify the deploy.resources section to match your server capacity:

deploy:
  resources:
    limits:
      cpus: '4.0'
      memory: 4G

Setting the Timezone#

TZ=America/New_York make docker-up

Or set it in your environment:

export TZ=Europe/Madrid
make docker-up

Production Deployment Notes#

For production (engagement) deployments:

1. Always change default passwords in profile.yaml before deploying
2. Use proper TLS certificates — self-signed is fine for testing, but consider using certificates that match your cover infrastructure
3. Restrict network access — Use firewall rules to limit who can reach the teamserver port
4. Monitor disk space — Downloads and the database can grow significantly during an engagement
5. Back up regularly — The data/ directory contains the SQLite database with all engagement data