Review Liquibase Secure server requirements

Before you install Liquibase Secure server, ensure your environment meets the following requirements.

Liquibase Secure server

Liquibase Secure server is the central service that receives, stores, and displays the operation data your team's Liquibase extensions send it. The requirements below cover what it takes to run it.

System requirements

Scaling and availability

Liquibase Secure server runs as a single Docker Compose deployment on one host. It does not cluster across nodes, fail over automatically, or replicate its databases, so size the host for your expected volume rather than planning to add nodes later.

The primary database is the component that limits throughput, and it scales vertically. Give the host more CPU, memory, or disk as your operation volume grows.

Software requirements

Liquibase Secure server is a containerized application. Docker and Docker Compose are required regardless of installation method. The liquibase-platform CLI runs Docker Compose under the covers.

Docker access on Linux

The installer runs Docker as the user who starts it. On a Linux host, that user must be root or a member of the docker group. Choose one:

• Use sudo: Run each liquibase-platform command with sudo.

• Add the user to the docker group: Run sudo usermod -aG docker $USER, then log out and back in, or run newgrp docker.

To confirm that the user can reach Docker, run docker ps. It lists containers when the user has access and prints permission denied when the user does not.

Note: Membership in the docker group gives a user root-level access to the host, so your security team may prefer sudo.

Docker Desktop on macOS and on Windows with WSL2 gives your user access to Docker without this step.

Supported host platforms

The installer bundle embeds its own runtime, so the registry serves a separate bundle for each host platform. Pull the bundle that matches the machine you run the installer on, and run uname -sm if you are unsure of its operating system and architecture.

Note: There is no native Windows bundle. On Windows, run the installer inside your WSL2 (Ubuntu) shell, which is where Docker Desktop and the installer run, and use the linux-x64 bundle.

Network requirements

The bundled reverse proxy is the only component that exposes ports on the host. All other services, including the databases, communicate over isolated internal Docker networks and are not reachable from outside the deployment.

The server must be reachable by two sets of clients:

• Liquibase CLI machines: Must be able to reach the server over HTTPS to send operation data

• Web app users: Must be able to reach the server over HTTPS to use the dashboard

Outbound access for install and upgrade

The host pulls container images when you install or upgrade the server. It needs outbound HTTPS to two places:

• The Liquibase registry: The registry URL your Liquibase account team sends you. The installer bundle and the Liquibase Secure server images come from it.

• Docker Hub: The deployment runs four public images, and Docker pulls them from Docker Hub.

Monitoring

The server does not export Prometheus or OpenTelemetry metrics. Monitor it with the health endpoints, its structured JSON logs, and your container runtime's own statistics.

Liquibase extension

The Liquibase extension is a plugin that runs on each machine executing Liquibase commands. It automatically collects operation metadata and reports it to Liquibase Secure server after each command completes. No changes to your changelogs or workflow are required.

To send operation data to the server, you need:

• Java 17+ (required to run the Liquibase CLI and extension JAR)

• Liquibase Secure 6.0+ installed

• Network connectivity from the CLI machine to the server API