Docker

Enterprise container images are distributed exclusively through the AWS Marketplace ECR registry. Subscribe to the Spice.ai Enterprise listing on AWS Marketplace, then authenticate with aws ecr get-login-password before pulling.

Prerequisites

• Docker
• AWS CLI (aws) installed and configured with credentials for the account subscribed to the AWS Marketplace listing

Images

Replace <repo> below with either spiceai-enterprise-byol (Bring Your Own License) or spiceai-enterprise-plan (Marketplace subscription). See AWS Marketplace for details. Replace <version> with the release to deploy, such as 2.4.1.

Pull an Image

aws ecr get-login-password --region us-east-1 \
  | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com

docker pull 709825985650.dkr.ecr.us-east-1.amazonaws.com/spice-ai/spiceai-enterprise-byol:2.4.1-enterprise-models

Run

docker run -p 8090:8090 -p 50051:50051 -p 9090:9090 \
  709825985650.dkr.ecr.us-east-1.amazonaws.com/spice-ai/spiceai-enterprise-byol:2.4.1-enterprise-models \
  --http 0.0.0.0:8090 \
  --metrics 0.0.0.0:9090 \
  --flight 0.0.0.0:50051

With a Spicepod Configuration

Mount a Spicepod YAML file into the container:

docker run -p 8090:8090 -p 50051:50051 -p 9090:9090 \
  -v $(pwd)/spicepod.yaml:/app/spicepod.yaml \
  709825985650.dkr.ecr.us-east-1.amazonaws.com/spice-ai/spiceai-enterprise-byol:2.4.1-enterprise-models \
  --http 0.0.0.0:8090 \
  --metrics 0.0.0.0:9090 \
  --flight 0.0.0.0:50051

The image sets no default arguments. Without them, spiced serves HTTP and Flight on 127.0.0.1 only, and serves no metrics. Pass the --http, --metrics, and --flight addresses on every docker run so the published ports reach the runtime.

Exposed Ports

Image Details

Enterprise images are built FROM scratch with a minimal filesystem containing:

• The spiced binary
• CA certificates
• Timezone database
• Required shared libraries

The container runs as UID 65534 (nobody) for security.

Environment Variables