Prerequisites

What you need before deploying ir.mlab.sh.

Docker and Docker Compose installed on your server.
A license key for ir.mlab.sh — available on mlab.sh under Organization > Incident Response. A free license is automatically generated when you create your account.
Minimum 2 GB RAM and 10 GB disk (MySQL + ClickHouse + app).

Quick Start

Deploy the full platform in 3 commands.

terminal

# Create project directory
mkdir ir-mlab && cd ir-mlab

# Download config files
curl -O https://mlab.sh/assets/internals/ir.mlab.sh/docker-compose.yml
curl -o .env https://mlab.sh/assets/internals/ir.mlab.sh/.env.example

# Edit .env with your license key and passwords
nano .env

# Launch
docker-compose up -d

Default credentials: admin@localhost / adminadmin. Change these immediately after first login.

docker-compose.yml

Four services: the app, the executor, MySQL 8 and ClickHouse.

docker-compose.yml

Download

services:

  app:
    image: ghcr.io/mlab-sh/ir.mlab.sh:latest
    ports:
      - "${APP_PORT:-8080}:8080"
    depends_on:
      mysql:
        condition: service_healthy
      clickhouse:
        condition: service_healthy
    env_file: .env
    environment:
      - DB_HOST=mysql
      - CH_HOST=clickhouse
      - EXECUTOR_URL=http://executor:8090
      - APP_CALLBACK_URL=http://app:8080
    volumes:
      - uploads:/app_mlab_sh/uploads
      - logs:/app_mlab_sh/logs
    restart: unless-stopped

  executor:
    image: ghcr.io/mlab-sh/ir.mlab.sh-executor:latest
    depends_on:
      clickhouse:
        condition: service_healthy
    env_file: .env
    environment:
      - CH_HOST=clickhouse
      - EXECUTOR_PORT=8090
      - APP_CALLBACK_URL=http://app:8080
    restart: unless-stopped

  mysql:
    image: mysql:8
    environment:
      MYSQL_ROOT_PASSWORD: ${DB_ROOT_PASSWORD}
      MYSQL_DATABASE: mlabir
      MYSQL_USER: ${DB_USERNAME}
      MYSQL_PASSWORD: ${DB_PASSWORD}
    volumes:
      - mysql_data:/var/lib/mysql
    healthcheck:
      test: ["CMD", "mysqladmin", "ping", "-h", "localhost"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

  clickhouse:
    image: clickhouse/clickhouse-server:latest
    environment:
      CLICKHOUSE_USER: ${CH_USERNAME}
      CLICKHOUSE_PASSWORD: ${CH_PASSWORD}
      CLICKHOUSE_DB: mlabir
      CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
    volumes:
      - clickhouse_data:/var/lib/clickhouse
    healthcheck:
      test: ["CMD", "clickhouse-client", "--query", "SELECT 1"]
      interval: 5s
      timeout: 5s
      retries: 10
    restart: unless-stopped

volumes:
  mysql_data:
  clickhouse_data:
  uploads:
  logs:

Data is persisted in Docker volumes (mysql_data, clickhouse_data, uploads). Both databases include health checks — the app waits for them to be healthy before starting.

Environment Variables

Configure your .env file.

.env

Download

# ─── mlab.sh IR Platform ─────────────────────────────────────

# License key (required)
LICENSE_KEY=your-license-key-here

# ─── Application ─────────────────────────────────────────────
APP_PORT=8080

# ─── MySQL ───────────────────────────────────────────────────
DB_PORT=3306
DB_USERNAME=mlab_web
DB_PASSWORD=CHANGE_ME_mysql_password
DB_ROOT_PASSWORD=CHANGE_ME_mysql_root_password

# ─── ClickHouse ──────────────────────────────────────────────
CH_USERNAME=default
CH_PASSWORD=CHANGE_ME_clickhouse_password

Replace all CHANGE_ME_* values with strong passwords. DB_HOST and CH_HOST are set automatically by Docker Compose — do not add them to your .env unless you use external databases.

Variable Reference

Variable	Required	Description
`LICENSE_KEY`	Yes	Your ir.mlab.sh license key
`APP_PORT`	No	Port exposed on host (default: 8080)
`DB_USERNAME`	Yes	MySQL user
`DB_PASSWORD`	Yes	MySQL password
`DB_ROOT_PASSWORD`	Yes	MySQL root password
`CH_USERNAME`	Yes	ClickHouse user
`CH_PASSWORD`	Yes	ClickHouse password

Licensing

How license validation works.

Your license key is set via the LICENSE_KEY environment variable in your .env file. You can find your key on mlab.sh under Organization > Incident Response.

Validation Flow

License is validated against mlab.sh at boot.
Re-checked every hour via HMAC challenge-response.
If the license server is temporarily unreachable, a 48-hour grace period keeps the platform running.
After 48h without connectivity, the organization is locked until restored.

Tiers

Tier	Description
`free`	Basic access for individual analysts and evaluations
`lite`	Small teams needing core IR capabilities
`company`	Full-featured platform for mid-size security teams
`corpo`	Unlimited access with priority support and custom integrations

A free license is automatically created with your mlab.sh account. To upgrade, visit the pricing page or contact us.

Update

Pull the latest image and restart.

terminal

docker-compose pull app
docker-compose up -d app

Database migrations run automatically on startup. Your data in Docker volumes is preserved across updates.

Rollback

To pin a specific version, replace latest in your docker-compose.yml with a version tag:

docker-compose.yml

image: ghcr.io/mlab-sh/ir.mlab.sh:v0.8.0

Check the announcements page for release notes.

Support

Need help? We're here.

For questions, issues, or upgrade requests:

Email: [email protected]
Twitter/X: @CyberDreamIO
Help Center: /helpcenter/contact

Legal Page

Mlab.sh

How To ?

Prerequisites

Quick Start

docker-compose.yml

Environment Variables

Variable Reference

Licensing

Validation Flow

Tiers

Update

Rollback

Support