Local: Docker Compose

Run the agent in Docker on a host that is outside AWS (your laptop, an on-prem VM, an edge box, a build server). The agent reaches into one AWS account by assuming a role inside it.

When to pick this

You want the agent running on a host you control end to end.
You want compose-style management (docker compose up/down, a checked-in YAML, env vars from a .env file).
You are evaluating Argus from your laptop before committing to a cloud deploy.

Prerequisites

Complete Pre-flight first.
Docker 24 or newer with Compose v2 (docker compose, not the legacy docker-compose).
A role in the target AWS account with the discovery policy attached, and a trust policy allowing your local AWS principal to assume it. See Local-path assumed role.
AWS source credentials reachable by the SDK default chain on the host, either:
- ~/.aws/credentials (with the right profile selected via AWS_PROFILE), mounted into the container, or
- AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY exported in the shell that runs docker compose.
An enrollment token or permanent API key.

Walkthrough

In a fresh directory, save the snippet from the drawer’s Local > Docker Compose tab as docker-compose.yml. With placeholders substituted it looks like:

# Argus DSPM agent - Bootstrap flow (enrollment token)
services:
  argus-agent:
    image: ghcr.io/argusdspm/argus-agent:stable
    restart: unless-stopped
    environment:
      ARGUS_BACKEND_URL: https://api.argusdspm.com
      CLOUD_PROVIDER: aws
      ENROLLMENT_TOKEN: "argus_et_<your-token-here>"
      ENROLLMENT_POOL: baseline
      AWS_ROLE_ARN: ${AWS_ROLE_ARN}
      AWS_EXTERNAL_ID: ${AWS_EXTERNAL_ID}
    volumes:
      - argus_agent_data:/var/lib/argus

volumes:
  argus_agent_data:

Create a .env file next to docker-compose.yml:
```
AWS_ROLE_ARN=arn:aws:iam::111122223333:role/argus-discovery
AWS_EXTERNAL_ID=your-external-id
```
Compose reads .env automatically and substitutes ${AWS_ROLE_ARN} / ${AWS_EXTERNAL_ID} inside the YAML.
Make sure the SDK default chain can find source credentials. Either export them in the shell that runs compose:
Terminal window
```
export AWS_ACCESS_KEY_ID=AKIA...
export AWS_SECRET_ACCESS_KEY=...
```
…or mount your AWS config into the container by adding a volume:
```
    volumes:
      - argus_agent_data:/var/lib/argus
      - ${HOME}/.aws:/home/argus_agent/.aws:ro
```

Start the agent:

docker compose up -d
docker compose logs -f argus-agent

Verify

Logs should show:

secure_credential_manager - Role ARN provided, will assume role arn:aws:iam::111122223333:role/argus-discovery
Bootstrapping via enrollment token (pool=baseline)...
Bootstrap succeeded - API key persisted for restart-safe auth.
Authenticated as '<your-agent-name>' (agent_xxx)
Polling for jobs (capacity=4)...

The persisted API key lives inside the named volume. Verify restart-safety:

docker compose exec argus-agent ls -la /var/lib/argus
# expect: -rw------- argus_agent argus_agent 59 agent.key
docker compose restart argus-agent
# logs after restart should re-use the persisted key, not re-bootstrap

See Verifying connection.

Teardown

docker compose down -v

The -v removes the named volume so the persisted API key is wiped. Omit -v to keep the agent’s identity on the next docker compose up.