Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). This approach provides capabilities that traditional Software Composition Analysis (SCA) solutions cannot achieve.
Dependency-Track monitors component usage across all versions of every application in its portfolio in order to proactively identify risk across an organization. The platform has an API-first design and is ideal for use in CI/CD environments.
# Downloads the latest Docker Compose file curl -LO https://dependencytrack.org/docker-compose.yml # Starts the stack using Docker Compose docker-compose up -d
# Downloads the latest Docker Compose file curl -LO https://dependencytrack.org/docker-compose.yml # Initializes Docker Swarm (if not previously initialized) docker swarm init # Starts the stack using Docker Swarm docker stack deploy -c docker-compose.yml dtrack
# Pull the image from the Docker Hub OWASP repo docker pull dependencytrack/bundled # Creates a dedicated volume where data can be stored outside the container docker volume create --name dependency-track # Run the bundled container with 8GB RAM on port 8080 docker run -d -m 8192m -p 8080:8080 --name dependency-track -v dependency-track:/data dependencytrack/bundled
NOTICE: Always use official binary releases in production.
Dependency-Track has four distribution variants. They are:
|API Server||Executable WAR||✅||✅||✅||✅|
|Frontend||Single Page Application||✅||✅||✅||✅|
The API Server contains an embedded Jetty server and all server-side functionality, but excludes the frontend user interface. This variant is new as of Dependency-Track v4.0.
The Frontend is the user interface that is accessible in a web browser. The Frontend is a Single Page Application (SPA) that can be deployed independently of the Dependency-Track API Server. This variant is new as of Dependency-Track v3.8.
The Bundled variant combines the API Server and the Frontend user interface. This variant was previously referred to as the executable war and was the preferred distribution from Dependency-Track v3.0 - v3.8. This variant is supported but deprecated and will be discontinued in a future release.
The Traditional variant combines the API Server and the Frontend user interface and must be deployed to a Servlet container. This variant is not supported, deprecated, and will be discontinued in a future release.
You can install on Kubernetes using the community-maintained chart like this:
helm repo add evryfs-oss https://evryfs.github.io/helm-charts/ helm install evryfs-oss/dependency-track --name dependency-track --namespace dependency-track
by default, it will install PostgreSQL and use persistent volume claims for the data-directory used for vulnerability feeds.
To create the API Server executable WAR that is ready to launch:
mvn clean package -P embedded-jetty
To create the API Server executable WAR that is ready to be deployed in a Docker container:
mvn clean package -P embedded-jetty -Dlogback.configuration.file=src/main/docker/logback.xml
To create the Bundled (API Server + Frontend) executable WAR that is ready to be deployed in a Docker container:
mvn clean package -P embedded-jetty -P bundle-ui -Dlogback.configuration.file=src/main/docker/logback.xml
Dependency-Track is Copyright (c) Steve Springett. All Rights Reserved.
Permission to modify and redistribute is granted under the terms of the Apache License 2.0.
Dependency-Track makes use of several other open source libraries. Please see the notices file for more information.