Policy Decision Server (Single-Machine Docker Edition)

Productivity

A policy decision server you run on your own machine with Docker Compose and query over an API to ask whether a request is allowed; bound to 127.0.0.1, no account or key needed to start. Derived from a frozen snapshot of an Apache-2.0-licensed open-source project.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-13

In practice

Readiness4 / 5

What you need

Few changes needed3 / 5

Who it is for

Engineering and security teams who want to try or develop authorization decisions driven by policy files on their own machine.

How to start

$ cp .env.example .env
$ docker compose up -d

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸ast8

ast.go
compile_test.go
compilehelper_test.go
json/
location/
parser_ext_test.go
parser_test.go
policy_test.go

▸build92

bench-comment/
bench-nightly/
build-release.sh
check-working-copy.sh
commit-cli-docs.sh
commit-wasm-bins.sh
gen-checks-input.sh
gen-cli-docs.sh
gen-deb.sh
gen-man.sh
…

▸bundle4

bundle.go
bundle_test.go
keys_test.go
store_test.go

▸capabilities159

capabilities.go
v0.17.0.json
v0.17.1.json
v0.17.2.json
v0.17.3.json
v0.18.0.json
v0.19.0-rc1.json
v0.19.0.json
v0.19.1.json
v0.19.2.json
…

▸cmd68

bench.go
bench_jsonv2_test.go
bench_test.go
build.go
build_jsonv2_test.go
build_test.go
capabilities.go
capabilities_jsonv2_test.go
capabilities_test.go
check.go
…

▸compile2

compile.go
compile_test.go

▸config1

config.go

▸cover1

cover.go

▸debug1

debug.go

▸dependencies1

dependencies.go

▸docs535

.gitignore
.markdownlint-cli2.jsonc
.npmrc
.nvmrc
.vale.ini
Makefile
README.md
bin/
blog/
config/
…

▸download2

download.go
oci_download.go

▸e2e26

README.md
api/
cli/
go.mod
go.sum
proto/

▸features3

doc.go
tracing/
wasm/

▸format2

format.go
format_test.go

▸hooks1

hooks.go

▸internal183

bundle/
cidr/
cmd/
compile/
compiler/
config/
configpolicy/
debug/
deepcopy/
distributedtracing/
…

▸ir3

encoding/
ir.go

▸keys1

keys.go

▸loader4

extension/
filter/
loader.go
loader_test.go

▸logging2

logging.go
test/

▸logo4

logo-144x144.png
logo.ico
logo.png
logo.svg

▸metrics1

metrics.go

▸misc2

syntax/

▸plugins12

bundle/
discovery/
logs/
plugins.go
plugins_test.go
rest/
server/
status/

▸profiler1

profiler.go

▸proposals1

attic/

▸refactor1

refactor.go

▸rego2

rego.go
rego_test.go

▸repl2

repl.go
repl_test.go

▸resolver2

resolver.go
wasm/

▸runtime1

runtime.go

▸schemas1

schemas.go

▸sdk3

opa_test.go
sdk.go
test/

▸server7

authorizer/
features.go
handlers/
identifier/
server.go
types/
writer/

▸storage4

disk/
inmem/
storage.go

▸test4

authz/
cases/
e2e/

▸tester2

runner_test.go
tester.go

▸topdown6

builtins/
cache/
copypropagation/
lineage/
print/
topdown.go

▸tracing1

tracing.go

▸types1

types.go

▸util5

decoding/
test/
util.go

▸v1659

ast/
bundle/
capabilities/
compile/
config/
cover/
debug/
dependencies/
doc.go
download/
…

▸version1

version.go

▸wasm131

Dockerfile
Makefile
README.md
build/
src/
test.js
tests/

▫ADOPTERS.md

▫AGENTS.md

▫ATTRIBUTION.md

▫CHANGELOG.md

▫CODE_OF_CONDUCT.md

▫COMMUNITY_GUIDELINES.md

▫CONTRIBUTING.md

▫Dockerfile

▫Dockerfile.rego

▫GOVERNANCE.md

▫LICENSE

▫MAINTAINERS.md

▫Makefile

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫SECURITY_AUDIT.pdf

▫buf.yaml

▫builtin_metadata.json

▫capabilities.json

▫delivery-manifest.txt

▫docker-compose.yml

▫go.mod

▫go.sum

▫main.go

▫main_windows.go

▫netlify.toml

▫Config and hidden files 18

Latest passing run

Clone → Checkout → Toolchain → Run server

Pre-purchase Disclosure

What you are buying

A policy decision server that runs on your own computer: brought up with Docker Compose, you query it over an API to ask whether a request is allowed. You write the policy files yourself, put them in the designated folder and restart to load them.

Derived from an open-source project under the Apache-2.0 license, and not the original project itself.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 5f83d9d.

Known limitations

The service is bound to 127.0.0.1 on the local machine only (default port 8181) and is not open to other machines
The first start downloads the container image from an image registry
The dependencies were not scanned for licenses one by one
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 13d3ffe. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

2 PASS3 WARN0 FAIL

Source ReviewWARN

Read: docker-compose.yml, .env.example, QUICKSTART.md, LICENSE, PRODUCT.md and the file listing of the product repository. The Go application source was not read file by file.

Script SafetyPASS

The compose file was read: a single service from an image pinned by digest, a loopback-only port and a read-only policy mount. Upstream build scripts were not read.

RecencyWARN

This is a frozen snapshot that does not follow upstream. The date of the pinned upstream commit and recent upstream activity were not checked.

LicensePASS

SPDX:Apache-2.0

The LICENSE file in the product repository is the Apache-2.0 text, and PRODUCT.md records the upstream license as Apache-2.0. The upstream copy was not compared against it.

Dependency LicensesWARN

Dependencies are compiled into the third-party image or fetched at its build time. They were not scanned for licenses.