Ports & Service Matrix
Which service listens on which port, which Compose profile or Helm chart provides it, and whether it is
reachable from outside. Three views: the Docker Compose stack, the public hostnames of a domain deployment, and the
Dockerfile EXPOSE lines.
- Compose
deploy/compose/docker-compose.yml(Full) andlite.yml(Lite). See Docker Compose Stack.- Kubernetes
deploy/helm/charts/*; container ports match the Compose ones, exposure is decided by your Ingress values.- Host binding
- Compose publishes ports on
BIND_ADDR(default127.0.0.1). Exceptions: LiveKit (LIVEKIT_BIND_ADDR) and Caddy in the domain overlay (PUBLIC_BIND_ADDR, default all interfaces).
Jump to: 1. Compose · 2. Public hostnames · 3. Dockerfile EXPOSE
1. Docker Compose stack
"Host" is the published mapping (host : container). "internal" means no ports: block — reachable only on the compose network by service name (e.g. http://sidecar:8001). Most host ports can be moved with the matching *_HOST_PORT variable.
| Service | Image | Host : container | Profile | Notes |
|---|---|---|---|---|
postgres | ghcr.io/cd-lc/postgres:16 (pgvector + AGE; deploy/postgres) | 5432 : 5432 | core set, Lite | App database. |
pgbouncer | edoburu/pgbouncer:v1.24.1-p1 | internal (6432) | core set | Must stay session pooling (schema-per-tenant); see ADR-0002. |
valkey | valkey/valkey:8.1-alpine | 6379 : 6379 | core set, Lite | Redis API. |
seaweedfs | chrislusf/seaweedfs:3.97 | 8333 : 8333 | core set | S3 gateway; Lite uses local disk instead. |
keycloak-db | postgres:16-alpine | internal | core set | Keycloak's dedicated Postgres (Lite uses a dev-file store). |
keycloak | quay.io/keycloak/keycloak:26.0.7 | 8180 : 8080 | core set, Lite | Issuer http://localhost:8180/realms/agentic-ai locally; admin console only on 127.0.0.1 in domain mode. |
sidecar | ghcr.io/cd-lc/sidecar | 8001 : 8001 | core set; Lite rag | Embeddings, extraction, rerank, STT/TTS. |
core | ghcr.io/cd-lc/core | 8080 : 8080 | core set, Lite | API. |
web | ghcr.io/cd-lc/web | 3000 : 3000 | core set, Lite | Tenant console. |
web-admin | ghcr.io/cd-lc/web-admin | 3001 : 3001 | core set | Platform-operator console. |
core-worker, core-jobs | ghcr.io/cd-lc/core-worker, core-jobs | internal | temporal, jobs | Temporal worker; scheduled sweeps. |
temporal, temporal-ui, temporal-postgresql | temporalio/auto-setup:1.24.2, temporalio/ui:2.31.2, postgres:16-alpine | 7233 : 7233; 8088 : 8080; internal | temporal | |
redpanda | redpandadata/redpanda:v24.2.18 | 9092 : 9092 | events | Kafka API (BSL-1.1, see NOTICE). |
prometheus, alertmanager, grafana, loki | prom/prometheus:v2.55.1, prom/alertmanager:v0.27.0, grafana/grafana:11.3.1, grafana/loki:3.2.1 | 9090; 9093; 3003 : 3000; 3100 | observability | promtail and valkey-exporter are internal. |
langfuse-web | langfuse/langfuse:3 | 3002 : 3000 | tracing | Trace UI. langfuse-worker, -postgres, -clickhouse, -valkey, -s3 are internal. |
livekit | livekit/livekit-server:v1.13.9 | 7880; 7881; 50000-50100/udp (default; LIVEKIT_RTC_PORT_RANGE_START / _END move it) | voice | Bound to LIVEKIT_BIND_ADDR; set it to 0.0.0.0 for remote callers. |
voice-agent | ghcr.io/cd-lc/voice-agent | internal | voice | Outbound-only LiveKit worker. |
code-intel | ghcr.io/cd-lc/code-intel | 8090 : 8090 | code-intel, builder | |
code-intel-docker | docker:27-dind | internal | code-intel, builder | Privileged Docker-in-Docker executor. |
app-builder | ghcr.io/cd-lc/app-builder | 8091 : 8091 | builder | |
tool-sandbox | ghcr.io/cd-lc/tool-sandbox | internal (8095) | sandbox | Core reaches it at http://tool-sandbox:8095. |
mcp-stdio-runner | ghcr.io/cd-lc/mcp-stdio-runner (-browser variant) | internal (8097) | tools, browser, sandbox | Core reaches it at mcp-stdio-runner:8097. |
rl-trainer | ghcr.io/cd-lc/rl-trainer | 8095 : 8095 | rl | Same number as tool-sandbox's internal port, different container. |
caddy | caddy:2.11.7-alpine | 80, 443 (tcp + udp) | domain overlay | Automatic Let's Encrypt; CADDY_AUTO_HTTPS=off with CADDY_SITE_SCHEME=http:// behind your own TLS proxy or tunnel. |
Overlays. docker-compose.ci.yml and docker-compose.local-llm.yml each publish 127.0.0.1:9101:9101 (the deploy/mock-provider OpenAI-compatible mock).
2. Public hostnames (domain deployment)
With scripts/vegaduta up --full --domain <your-domain>, Caddy routes these hosts (deploy/caddy/Caddyfile). With Helm, the same names are set in your Ingress values.
| Purpose | Host | Upstream |
|---|---|---|
| Console | app.<your-domain> | web:3000 |
| Admin console | admin.<your-domain> | web-admin:3001 |
| API | api.<your-domain> | core:8080 |
| Keycloak | auth.<your-domain> (realm agentic-ai) | keycloak:8080 |
| Code intelligence (optional) | codeintel.<your-domain> | code-intel:8090 |
| App builder (optional) | builder.<your-domain> | app-builder:8091 |
| LiveKit (optional) | livekit.<your-domain> | livekit:7880 |
Keep sidecar, the databases, Langfuse, Temporal and the sandboxes internal. Never point a browser-facing or token-issuer URL at localhost on a server; internal compose DNS names such as http://keycloak:8080 are the sanctioned exception. scripts/vegaduta doctor checks this.
3. Dockerfile EXPOSE
| Dockerfile | EXPOSE | Base image (FROM) |
|---|---|---|
core/Dockerfile | 8080 | maven:3.9-eclipse-temurin-21 (build), eclipse-temurin:21-jre-jammy |
web/Dockerfile | 3000 | node:22.23.3-bookworm-slim |
web-admin/Dockerfile | 3001 | node:22.23.3-bookworm-slim |
services/sidecar/Dockerfile | 8001 | python:3.12.15-slim-trixie |
services/code-intel/Dockerfile | 8090 | python:3.12.15-slim-trixie |
services/app-builder/Dockerfile | 8091 | python:3.12.15-slim-trixie |
services/tool-sandbox/Dockerfile | 8095 | eclipse-temurin:21-jdk-jammy, python:3.12.15-slim-trixie |
services/rl-trainer/Dockerfile | 8095 | python:3.12.15-slim-trixie |
services/voice-agent/Dockerfile | 8081 | python:3.12.15-slim-trixie |
services/mcp-stdio-runner/Dockerfile | no EXPOSE line | node:22.23.3-bookworm-slim |
examples/mcp-servers/http-gateway/Dockerfile | 8099 | node:22.23.3-bookworm-slim |
deploy/mock-provider/Dockerfile | 9101 | python:3.12.15-slim-trixie |
deploy/postgres/Dockerfile | no EXPOSE line | ${BASE_IMAGE} (PostgreSQL 16) |
Cross-references
- Runtime map and diagrams: Service Topology & Runtime Map.
- Variables that carry these URLs: Environment Variable Reference.
Evidence & references
deploy/compose/docker-compose.yml(service list,image:,ports:,profiles:),lite.yml,docker-compose.domain.yml,docker-compose.ci.yml,docker-compose.local-llm.yml- All
Dockerfilefiles listed in section 3;deploy/caddy/Caddyfile deploy/README.md,deploy/helm/README.md