Deploy with Docker

Deploy Graph Explorer locally using the official Docker image from Amazon’s ECR Public Registry.

You can find the latest version of the image on Amazon’s ECR Public Registry.

This guide is an example, not a recommended production configuration. Review its network, access control, and IAM choices against your own security requirements before you run it in production. For the hosting setups Graph Explorer supports, see Supported Hosting. For general guidance on securing a production workload, see the Security Pillar of the AWS Well-Architected Framework.

Note

The sagemaker-* image tags are now aliases for the same image as the regular tag. They exist only for compatibility with existing SageMaker lifecycle scripts and will stop being published in a future release. Use the regular tag for new deployments.

Because of this, a sagemaker-* tag starts with the standard defaults: HTTPS on port 443, which needs HOST set to generate its certificate. To serve HTTP on port 9250 with logs formatted for CloudWatch instead, set these variables:

Publish the port with -p 127.0.0.1:9250:9250 and open http://localhost:9250/explorer. Sending the logs to CloudWatch also takes Docker’s awslogs log driver.

Important

The Graph Explorer server, not your browser, connects to the database for proxied connections, so it needs network access to the database endpoint. See System overview for details.

Important

Graph Explorer performs no authentication or authorization, so controlling who can reach a deployment is the deployer’s responsibility. Never expose it publicly without an access control layer in front of it. See Access Control.

Prerequisites

Docker installed on your machine
AWS CLI installed on your machine

Steps

Authenticate with the Amazon ECR Public Registry

aws ecr-public get-login-password --region us-east-1 | docker login --username AWS --password-stdin public.ecr.aws

Pull down the docker image

docker pull public.ecr.aws/neptune/graph-explorer

Create and run a docker container using the image
```
docker run -p 127.0.0.1:443:443 \
 --restart unless-stopped \
 --env HOST=localhost \
 --name graph-explorer \
 public.ecr.aws/neptune/graph-explorer
```
The HOST environment variable is used for SSL certificates generation since HTTPS is the default. If you are hosting this on a public domain, you should replace HOST=localhost with your domain name.

Important
-p 127.0.0.1:443:443 publishes the container on the loopback interface only, so only the host itself can reach it. To reach it from other machines, such as on a public domain, use -p 443:443, which publishes it on every network interface of the host, and limit who can reach port 443 with network rules you provide. Confirm your rules apply to the port you publish, because container platforms can publish ports in a way host firewalls don’t filter.
Open a browser and type in the URL of the Graph Explorer server instance
```
https://localhost/explorer
```
You will receive a warning as the SSL certificate used is self-signed. Since the application is set to use HTTPS by default and contains a self-signed certificate, you will need to add the Graph Explorer certificates to the trusted certificates directory and manually trust them. See the HTTPS Connections section.

Note
A new container generates a new certificate, so replacing the container undoes this trust step. To keep the certificate, see Keeping the certificate across container replacements.
After completing the trusted certification step and refreshing the browser, you should now see the Connections UI. See Connections for details on configuring your first connection.