🔸 DefectDojo Pro (On-Premise)
Run DefectDojo Pro in your own environment instead of the hosted product. The pages in this section cover sizing the deployment, the two self-hosted models (Docker Compose and Kubernetes with the Helm chart), upgrading, FIPS 140-3 mode, backups, and reaching external services through a forward proxy.
Start with Self-Hosting DefectDojo Pro for the deployment models and prerequisites, then follow the install guide for your platform. Deploying on a private network, with FIPS images or mirrored images? Read Planning a Private Deployment first.
Expand the storage available for uploaded files on a Docker Compose deployment without altering the deployment itself
The four things to capture, where each one lives for Compose and Kubernetes deployments, and how to confirm a backup can actually be restored
Use dojo-compose-cli doctor and the certs commands to find what stops a Docker Compose deployment from starting, upgrading, or reaching a service behind an internal CA
Install DefectDojo Pro on Kubernetes using the Helm chart, covering infrastructure, secrets, and the install itself
Upgrade a self-hosted DefectDojo Pro deployment that runs on Docker Compose with dojo-compose-cli
Upgrade an existing DefectDojo Pro Helm release, including pulling the chart, running the upgrade, and rolling back
What is specific to OpenShift when deploying self-hosted DefectDojo Pro: security context constraints, Routes, and ReadWriteMany storage
Deploy DefectDojo Pro with FIPS 140-3 validated cryptography using the -fips container images, for FedRAMP SC-13 and similar requirements
Running DefectDojo Pro FIPS images on Amazon ECS with the Fargate launch type
General guidance for sizing compute, memory, and storage for a self-hosted DefectDojo Pro deployment
Stage the DefectDojo Pro install artifacts on a host with internet access, then move them into an air-gapped network
Install self-hosted DefectDojo Pro on a single host using dojo-compose-cli, with PostgreSQL on a separate server
Use dojo-helm-cli to pull the DefectDojo Pro Helm chart and images, validate a cluster, deploy, and collect diagnostics
Step-by-step OSS to Pro migration on Kubernetes, a troubleshooting index keyed on the exact error text, and a post-migration verification checklist
Move your open source DefectDojo database and media files into a self-hosted DefectDojo Pro deployment
Run self-hosted DefectDojo Pro against a managed PostgreSQL server that refuses passwords, using Microsoft Entra ID, Amazon RDS IAM or Cloud SQL IAM authentication
Questions to settle before deploying self-hosted DefectDojo Pro on a private network, such as Amazon EKS in AWS GovCloud with FIPS images, mirrored images, managed PostgreSQL and Redis, and SSO
How often self-hosted DefectDojo Pro is released, which release is supported, and where to report scan results or a vulnerability in DefectDojo
Bring a backed-up DefectDojo Pro deployment back on the same host or a new one: configuration and keys, both databases, uploaded files, and the same pinned version, for Docker Compose and Kubernetes
Stop a self-hosted DefectDojo Pro instance from calling DefectDojo or any third-party feed when it has no route off its network
Configure DefectDojo Pro on-prem to reach Jira, SonarQube, and Connectors through an outbound HTTPS proxy
Turn on the DefectDojo Pro sandbox on a self-hosted instance with one setting, and what it creates in your database
The self-hosted deployment models for DefectDojo Pro (Docker Compose and Kubernetes), what you need before you start, and how the rest of this section fits
What a self-hosted DefectDojo Pro instance sends to DefectDojo support by default, how to opt in, and how the cloud portal secret is treated
Supported upgrade procedure for self-hosted DefectDojo Pro, on both the Helm chart and Docker Compose
Why a large scan file fails to upload on Docker Compose, and which limit to raise
Why a large scan file fails to upload on Kubernetes, and which limit to raise in the Helm chart
Check the signature on a DefectDojo Pro container image and pull its SPDX and CycloneDX SBOMs, including from a mirrored registry with no internet access