Production deployment

Run Decentralization Manager with Docker

Production architecture

Deploy one Decentralization Manager instance for each participating organization. Separate the authenticated HTTP surface from the peer communication surface. Provide private connectivity to Canton Admin and Ledger APIs, persistent storage, an approved identity provider, centralized logs, metrics, backups, and secret management.

Required controls

• Pin an approved image by immutable digest.
• Run as a non-root user with minimum filesystem permissions.
• Disable insecure mode.
• Use TLS for the operator surface and approved TLS or mTLS for Canton and peer paths.
• Restrict inbound traffic to approved callers and peers.
• Store credentials outside the image and rotate them.
• Persist the Noise key, operational database, and required DAR state.
• Configure health, readiness, resource limits, and restart policy.

Deployment sequence

1. Approve the compatibility row and image digest.
2. Provision namespaces, identities, certificates, secrets, storage, and network policy.
3. Configure Canton and identity-provider clients.
4. Deploy one instance without adding peers.
5. Verify login, Canton connectivity, persistence, metrics, logs, and backup.
6. Exchange peer records through an authenticated channel.
7. Validate mesh health.
8. Run one low-risk workflow.
9. Record the deployment and recovery evidence.

Persistent data

Back up the Noise identity and SQLite database using an application-consistent procedure. Test restoration in an isolated environment. Protect backups as sensitive material.

Availability

The application should have a disruption policy, resource requests, probes, monitoring, and alerting. Do not add multiple active replicas behind one identity unless the supported architecture explicitly permits it.

Upgrades

Peer protocol changes can require coordinated mesh upgrades. Confirm whether a release supports rolling upgrade. If not, schedule a lockstep maintenance window, pause workflows, back up state, update every peer, and verify compatibility before resuming.

Production checklist

• Approved release and image digest
• Identity provider and roles
• TLS or mTLS and certificates
• Network policies and firewall rules
• Secret storage and rotation
• Persistent storage and tested restoration
• Health checks, logs, metrics, alerts, and resource limits
• Mesh upgrade and rollback plan
• Incident and support contacts

Technical source

• Production deployment guide

Related pages

• Decentralization Manager authentication and operator roles
• Decentralization Manager security architecture
• Decentralization Manager backup, recovery, and mesh upgrades
• Decentralization Manager compatibility, releases, and troubleshooting

Next step

👉 Lock down operator access: Decentralization Manager authentication and operator roles.