Services, ports and profiles
Every container in the CID stack: published ports, compose profile, memory limit, healthcheck and image source.
- Type: reference
One row per compose service. Regenerate with make docs-generate.
- Profile empty means the service starts with a plain
docker compose up -d. Anything else needs--profile <name>. - Ports are as published on the host.
127.0.0.1:means loopback only. - Memory is the declared limit (
deploy.resources.limits.memoryormem_limit), not usage.
Services
| Service | Ports | Profile | Memory limit | Healthcheck | Image / build | Purpose |
|---|---|---|---|---|---|---|
attack-guard | 127.0.0.1:8003:8003 | default | 4G | yes | build ./cid-attack-guard | ONNX Jailbreak + libinjection SQLi/XSS scan |
caddy | 80:80443:443443:443/udp | default | — | yes | caddy:2-alpine | — |
cid-inline-proxy | — | inline-proxy | — | no | build ./cid-inline-proxy | mitmproxy forward-proxy (opt-in: --profile inline-proxy) |
cid-proxy | 127.0.0.1:8080:8080 | default | 128M | yes | build ./cid-proxy | Go reverse-proxy front (auth + routing) |
cid-userid-agent | 127.0.0.1:${USERID_AGENT_PORT:-8090}:8090 | userid-agent | — | no | build ./cid-userid-agent | AD User-ID attribution (opt-in: --profile userid-agent) |
cost-analyzer | 127.0.0.1:8016:8016 | routing | 1G | yes | build ./cid-cost-analyzer | — |
deepteam | 127.0.0.1:8010:8010 | default | 2G | yes | build ./cid-deepteam | Red-team testing |
doc-classifier | 127.0.0.1:8017:8017 | default | 2G | no | build ./cid-doc-classifier | — |
document-parser | 127.0.0.1:8012:8012 | default | 2G | yes | build ./cid-document-parser | PDF/DOCX extraction |
frontend | 127.0.0.1:${FRONTEND_PORT:-5173}:5173 | default | — | yes | build ./cid-dashboard (target development) | React Dashboard |
hallucination-guard | 127.0.0.1:${HALLUCINATION_GUARD_HOST_PORT:-8022}:8022 | default | 4G | yes | build ./cid-hallucination-guard | RAG hallucination (LettuceDetect EN+TR) |
hap-guard-v2 | 127.0.0.1:8004:8000 | default | 6G | yes | build ./cid-hap-guard-v2 | ONNX Toxicity (100+ langs) |
language-detector | 127.0.0.1:8008:8008 | default | 2G | yes | build ./cid-language-detector | Language detection |
llm-inference | 127.0.0.1:8021:8000 | llm | — | yes | ${LLM_INFERENCE_IMAGE:-vllm/vllm-openai:latest} | — |
mailpit | 127.0.0.1:8025:8025 | mailtest | — | no | axllent/mailpit:latest | — |
mcp-server | 127.0.0.1:${MCP_SERVER_HOST_PORT:-8020}:8020 | llm-analyst | 1G | yes | build ./cid-mcp-server | Read-only MCP server over Postgres (opt-in: --profile llm-analyst) |
ml-detector | 127.0.0.1:8001:8000 | default | 6G | yes | build ./cid-security-ml | ONNX NER PII |
nestjs-core | 127.0.0.1:3000:3000${ICAP_PUBLISH:-127.0.0.1}:1344:1344 | default | — | yes | build . (target production) | API Gateway |
ocr-service | 127.0.0.1:8009:8009 | default | 4G | yes | build ./cid-ocr | Image OCR |
openldap-test | 127.0.0.1:389:389127.0.0.1:636:636 | ldap-test | — | no | osixia/openldap:1.5.0 | — |
pgadmin | 127.0.0.1:5050:80 | tools | — | no | dpage/pgadmin4:latest | — |
postgres | 127.0.0.1:5433:5432 | default | — | yes | postgres:16-alpine | PostgreSQL 16 |
prompt-compressor | 127.0.0.1:8015:8015 | default | 3G | yes | build ./cid-prompt-compressor | — |
reconfigure-agent | — | default | — | no | build . | — |
redactor | 127.0.0.1:8013:8013 | default | 2G | yes | build ./cid-redactor | Image/doc redaction |
redis | 127.0.0.1:6380:6379 | default | — | yes | redis:7-alpine | Redis Cache |
redis-commander | 127.0.0.1:8081:8081 | tools | — | no | rediscommander/redis-commander:latest | — |
report-renderer | 127.0.0.1:8014:8014 | default | 512M | yes | build ./cid-report-renderer | Report rendering (PDF/HTML) |
risk-analyst | 127.0.0.1:${RISK_ANALYST_HOST_PORT:-8019}:8019 | llm-analyst | 3G | yes | build ./cid-risk-analyst | Local-LLM risk analyst agent loop (opt-in: --profile llm-analyst) |
weights-fetch | — | llm-build | — | no | build ./cid-llm/tools | — |
Declared memory in the default profile
19 services start without a profile; their declared limits total
37.6 GB. 6 of them declare no limit at all
(caddy, frontend, nestjs-core, postgres, reconfigure-agent, redis), so the total is a floor, not a ceiling.
Startup dependencies
| Service | depends_on |
|---|---|
attack-guard | redis |
caddy | frontend, nestjs-core, cid-proxy |
cid-inline-proxy | nestjs-core |
cid-proxy | nestjs-core, redis |
deepteam | nestjs-core |
document-parser | ocr-service |
frontend | nestjs-core |
hap-guard-v2 | redis |
mcp-server | postgres |
ml-detector | redis |
nestjs-core | postgres, redis, ml-detector, hap-guard-v2, attack-guard, language-detector, hallucination-guard, ocr-service, redactor, document-parser, report-renderer |
pgadmin | postgres |
redis-commander | redis |
risk-analyst | mcp-server |