Official image ↗amd64 · arm64free · no license

One image.
Every feature.
Hardened.

A single hardened Docker image with the whole engine compiled in. Pull it, run it, and free Community edition is live at full power — a license file flips it to Enterprise at boot.

Ways to use it Install Crowkis

quickstart — ~60s to a cache hit

$ docker pull crowkis/crowkis:latest
✓ pulled · signed · linux/amd64 · linux/arm64

$ docker run -d -p 6379:6379 -p 6380:6380 \
    -v crowkis-data:/data crowkis/crowkis
✓ crowkis up · RESP :6379 · dashboard :6380

$ curl 127.0.0.1:6380/health
{ "status": "ok", "admin_auth": "enabled" }
▮

Three ports, three surfaces

:6379RESP3

Redis wire protocol — crowkis cli or any Redis client.

:6380HTTP

Dashboard + management REST API + /health.

:6381gRPC

h2c — Get / Set / GetStream / Stats / Invalidate.

Four ways in

Make Crowkis part of your stack.

Run the engine with Docker, or reach it from your code with the SDKs and CLI. Pick the one that fits — they all talk to the same cache.

The whole engine in one hardened image — the way to run it in production.

$ docker pull crowkis/crowkis

Run with Docker →

Drop-in SDK: sync + async, get_or_compute, streaming. Cache LLM calls in three lines.

$ pip install crowkis

Python guide →

Typed client with retry/backoff and a CachedOpenAI wrapper for TS and JS.

$ npm install crowkis

Node guide →

The command line — talk to any instance, script it, pipe it. Ships in the binary.

$ crowkis cli

Command reference →

Let Claude Code and agents use the cache as a tool over MCP — one config block.

$ crowkis mcp

MCP guide →

One command per platform

Install Crowkis.

Native installs through the package manager you already use — or the Docker image, which works today with no setup. Same engine either way.

macOS

Homebrew

$ brew install crowkis/tap/crowkis

Every build is signed, with checksums published alongside the release. Latest stable · macOS · Linux · Windows · Docker.

Step 1 · run it

Pick run or compose.

One docker run for a quick spin, or the hardened compose file for the real thing. Ports publish to localhost only — going public is an explicit choice, never a default you discover.

$ docker pull crowkis/crowkis:latest

Docker Hub & GHCR · signed releases

docker run -d --name crowkis \
  -p 127.0.0.1:6379:6379 \
  -p 127.0.0.1:6380:6380 \
  -p 127.0.0.1:6381:6381 \
  -v crowkis-data:/data \
  crowkis/crowkis:latest

Verify it's healthy

Ask the container itself — the health endpoint reports status and whether admin auth is active.

$ curl 127.0.0.1:6380/health

expect "admin_auth": "enabled"

Prove the auth boundary

Don't trust it — test it. Unauthenticated management reads must bounce when auth is on.

$ curl -i 127.0.0.1:6380/api/metrics

rejected without a key

Talk to it

The binary ships the REPL — or point any Redis client at 6379 and watch the dashboard.

$ docker exec -it crowkis crowkis cli

built-in REPL

Hardened by default

The compose file is the security checklist.

Everything below is the stock deployment shape. You harden it by not editing it.

✓read_only: true

The container filesystem is immutable. Data lives on the mounted volume; /tmp is tmpfs.

✓cap_drop: ALL

Every Linux capability dropped. The process needs none of them.

✓no-new-privileges

Even a compromised process can't gain privileges it didn't start with.

✓Non-root user

Built into the image — not something you have to remember to configure.

✓pids_limit: 512

Fork bombs hit a wall.

✓Localhost-only ports

Published to 127.0.0.1 by default. Going public is an explicit choice.

✓HEALTHCHECK built in

/health endpoint wired into the image, so orchestrators see real readiness.

✓Binary-only image

One stripped Rust binary, a non-root user, /data. No shell tooling, no package manager, no supply chain.

Environment reference

The knobs that matter.

None are required — the image boots with sensible defaults. Full reference in the configuration docs.

Variable	Default	What it does
CROWKIS_ADMIN_KEY	change-me-admin-key	Auth key for the management API and dashboard metrics.
CROWKIS_AUTH_TOKEN	change-me-resp-grpc-token	Bearer token required for RESP and gRPC traffic.
CROWKIS_BIND_ADDR	127.0.0.1	Published-port bind address. Keep localhost until you mean it.
CROWKIS_MEMORY_LIMIT	512m	Runtime memory ceiling for the cache process.
CROWKIS_BLOCK_CACHE_BYTES	64m	Block cache capacity for hot SSTable reads.
CROWKIS_MAX_CONNECTIONS	10000	Concurrent connection ceiling.
CROWKIS_LOG_QUERY_PREVIEWS	0	Keeps prompt text out of logs. On by default, on purpose.
CROWKIS_LICENSE_PATH	/etc/crowkis/license.json	Enterprise license file. Absent = Community edition, free.

Local experiments only: CROWKIS_ALLOW_UNAUTHENTICATED_ADMIN=1 disables the management auth gate. Never set it on anything with a public interface.

Day-2 commands

$ docker pull crowkis/crowkis:latest && docker compose up -d

the entire upgrade path — binary swap, stable on-disk format, no migrations

$ docker compose down

stop, keep data

$ docker compose down -v

stop and remove the data volume

Where to next

Quickstart →

First commands against a running instance.

Configuration →

Every environment variable, explained.

MCP for AI apps →

Let Claude Code and agents use the cache.

Enterprise →

Community is free. Enterprise unlocks with a license file.

One image.Every feature.Hardened.