Official image ↗amd64 · arm64free · no license

One image.
Every feature.
Hardened.

A single hardened Docker image with the whole engine compiled in. Pull it, run it, and free Community edition is live at full power, a license file flips it to Enterprise at boot.

Ways to use it Install Crowkis

quickstart, ~60s to a cache hit

$ docker pull crowkis/crowkis:latest
✓ pulled · signed · linux/amd64 · linux/arm64

$ docker run -d -p 6379:6379 -p 6380:6380 \
    -v crowkis-data:/data crowkis/crowkis
✓ crowkis up · RESP :6379 · dashboard :6380

$ curl 127.0.0.1:6380/health
{ "status": "ok", "admin_auth": "enabled" }
▮

Three ports, three surfaces

:6379RESP3

Redis wire protocol, crowkis cli or any Redis client.

:6380HTTP

Dashboard + management REST API + /health.

:6381gRPC

h2c, Get / Set / GetStream / Stats / Invalidate.

Four ways in

Make Crowkis part of your stack.

Run the engine with Docker, or reach it from your code with the SDKs and CLI. Pick the one that fits, they all talk to the same cache.

The whole engine in one hardened image, the way to run it in production.

$ docker pull crowkis/crowkis

Run with Docker →

Drop-in SDK: sync + async, get_or_compute, streaming. Cache LLM calls in three lines.

$ pip install crowkis

Python guide →

Typed client with retry/backoff and a CachedOpenAI wrapper for TS and JS.

$ npm install crowkis

Node guide →

The command line, talk to any instance, script it, pipe it. Ships in the binary.

$ crowkis cli

Command reference →

Let Claude Code and agents use the cache as a tool over MCP, one config block.

$ crowkis mcp

MCP guide →

One command per platform

Install Crowkis.

Native installs through the package manager you already use, or the Docker image, which works today with no setup. Same engine either way.

macOS

Homebrew

$ brew install crowkis/tap/crowkis

Every build is signed, with checksums published alongside the release. Latest stable · macOS · Linux · Windows · Docker.

Step 1 · run it

Pick run or compose.

One docker run for a quick spin, or the hardened compose file for the real thing. Ports publish to localhost only, going public is an explicit choice, never a default you discover.

$ docker pull crowkis/crowkis:latest

Docker Hub & GHCR · signed releases

docker run -d --name crowkis \
  -p 127.0.0.1:6379:6379 \
  -p 127.0.0.1:6380:6380 \
  -p 127.0.0.1:6381:6381 \
  -v crowkis-data:/data \
  crowkis/crowkis:latest

Verify it's healthy

Ask the container itself, the health endpoint reports status and whether admin auth is active.

$ curl 127.0.0.1:6380/health

expect "admin_auth": "enabled"

Prove the auth boundary

Don't trust it, test it. Unauthenticated management reads must bounce when auth is on.

$ curl -i 127.0.0.1:6380/api/metrics

rejected without a key

Talk to it

The binary ships the REPL, or point any Redis client at 6379 and watch the dashboard.

$ docker exec -it crowkis crowkis cli

built-in REPL

Hardened by default

The compose file is the security checklist.

Everything below is the stock deployment shape. You harden it by not editing it.

✓read_only: true

The container filesystem is immutable. Data lives on the mounted volume; /tmp is tmpfs.

✓cap_drop: ALL

Every Linux capability dropped. The process needs none of them.

✓no-new-privileges

Even a compromised process can't gain privileges it didn't start with.

✓Non-root user

Built into the image, not something you have to remember to configure.

✓pids_limit: 512

Fork bombs hit a wall.

✓Localhost-only ports

Published to 127.0.0.1 by default. Going public is an explicit choice.

✓HEALTHCHECK built in

/health endpoint wired into the image, so orchestrators see real readiness.

✓Binary-only image

One stripped Rust binary, a non-root user, /data. No shell tooling, no package manager, no supply chain.

Environment reference

The knobs that matter.

None are required, the image boots with sensible defaults. Full reference in the configuration docs.

Variable	Default	What it does
CROWKIS_ADMIN_KEY	change-me-admin-key	Auth key for the management API and dashboard metrics.
CROWKIS_AUTH_TOKEN	change-me-resp-grpc-token	Bearer token required for RESP and gRPC traffic.
CROWKIS_BIND_ADDR	127.0.0.1	Published-port bind address. Keep localhost until you mean it.
CROWKIS_MEMORY_LIMIT	512m	Runtime memory ceiling for the cache process.
CROWKIS_BLOCK_CACHE_BYTES	64m	Block cache capacity for hot SSTable reads.
CROWKIS_MAX_CONNECTIONS	10000	Concurrent connection ceiling.
CROWKIS_LOG_QUERY_PREVIEWS	0	Keeps prompt text out of logs. On by default, on purpose.
CROWKIS_LICENSE_PATH	/etc/crowkis/license.json	Enterprise license file. Absent = Community edition, free.

Local experiments only: CROWKIS_ALLOW_UNAUTHENTICATED_ADMIN=1 disables the management auth gate. Never set it on anything with a public interface.

Day-2 commands

$ docker pull crowkis/crowkis:latest && docker compose up -d

the entire upgrade path, binary swap, stable on-disk format, no migrations

$ docker compose down

stop, keep data

$ docker compose down -v

stop and remove the data volume

Where to next

Quickstart →

First commands against a running instance.

Configuration →

Every environment variable, explained.

MCP for AI apps →

Let Claude Code and agents use the cache.

Enterprise →

Community is free. Enterprise unlocks with a license file.

One image.Every feature.Hardened.