Docker Deployment

Run SWAO inside a Docker container for reproducible assessments, air-gapped environments, or team-shared infrastructure. This runbook covers the basic docker run invocation, a Docker Compose setup with named volumes, and offline operation using --skip-llm.

---

Prerequisites

• Docker Engine 24.x or later (or Docker Desktop 4.x)
• Docker Compose v2 (if using the Compose example)
• A workspace directory on the host machine

---

1. Basic docker run

docker run --rm \
  -e ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" \
  -v "$(pwd)/workspace:/workspace" \
  -v "$(pwd)/output:/output" \
  ghcr.io/accenture/swao:latest \
  assess --app sovereign-health --workspace /workspace --output /output

Key flags:

Flag	Purpose
--rm	Remove the container after it exits
-e ANTHROPIC_API_KEY	Pass the LLM API key from the host environment
-v workspace:/workspace	Mount the SWAO workspace into the container
-v output:/output	Write assessment output to a host directory

---

2. Environment variables

Variable	Required	Description
ANTHROPIC_API_KEY	Yes (unless using --skip-llm)	Anthropic API key for Claude
SWAO_LLM_PROVIDER	No	Override default LLM provider (anthropic, ollama, openai)
SWAO_LOG_LEVEL	No	Log verbosity: debug, info, warn, error
SWAO_WORKSPACE	No	Default workspace path inside the container

---

3. Run doctor before assess

# Check all probes before running a full assessment
docker run --rm \
  -e ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" \
  ghcr.io/accenture/swao:latest \
  doctor

---

4. Docker Compose example

For persistent named volumes and easier multi-run usage:

# docker-compose.yml
version: "3.9"

services:
  swao:
    image: ghcr.io/accenture/swao:latest
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
      - SWAO_LOG_LEVEL=info
    volumes:
      - workspace:/workspace
      - output:/output
    command: assess --app sovereign-health --workspace /workspace --output /output

  swao-mcp:
    image: ghcr.io/accenture/swao:latest
    environment:
      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
    ports:
      - "3737:3737"
    command: mcp --http --port 3737
    restart: unless-stopped

volumes:
  workspace:
  output:

Start the MCP server in the background and run a one-shot assessment:

docker compose up -d swao-mcp
docker compose run --rm swao

---

5. Populating the workspace volume

To seed the named workspace volume from a local directory:

# Copy workspace files into the named volume
docker run --rm \
  -v "$(pwd)/my-workspace:/src" \
  -v "swao_workspace:/workspace" \
  alpine sh -c "cp -r /src/. /workspace/"

Alternatively, bind-mount a host directory directly (replace the workspace: volume reference with an absolute host path):

volumes:
  - /path/to/my-workspace:/workspace

---

6. Air-gapped usage with --skip-llm

In environments without internet access, use --skip-llm to run only the static and Playwright analysis passes. No API key is required and no LLM calls are made.

docker run --rm \
  -v "$(pwd)/workspace:/workspace" \
  -v "$(pwd)/output:/output" \
  ghcr.io/accenture/swao:latest \
  assess --app sovereign-health --skip-llm --workspace /workspace --output /output

--skip-llm removes the comp (compliance LLM) and blocks (block analysis) passes from the pipeline. All deterministic passes -- inventory, SBOM, cryptography, data classification, 7R synthesis, and landing zone -- still run and emit signals. Output files are written exactly as in a live run, making this mode useful for pipeline testing and schema validation without incurring API costs.

Note: --llm-stub was removed in v0.4.7 (issue #0473). If you have scripts referencing it, replace with --skip-llm.

---

7. Pinning image versions

Avoid using the :latest tag in production pipelines. Pin to a specific release:

docker pull ghcr.io/accenture/swao:0.5.1
docker run --rm \
  -e ANTHROPIC_API_KEY="${ANTHROPIC_API_KEY}" \
  -v "$(pwd)/workspace:/workspace" \
  ghcr.io/accenture/swao:0.5.1 \
  assess --app sovereign-health --workspace /workspace

Current release tags are listed at https://github.com/Accenture/SWAO/releases.