Operations
Deployment
Run the NYXDB server from the container image — ports, flags, data directory, and the CPU microarchitecture note.
Container image
docker run --rm \
-p 7777:7777 \
-v nyxdb-data:/var/lib/nyxdb \
ghcr.io/nyxl-io/db:latestThe entrypoint runs:
nyxdb --host=0.0.0.0 --port=7777 --data-dir=/var/lib/nyxdb| Flag | Default | Purpose |
|---|---|---|
--host | 0.0.0.0 | Bind address (bind all interfaces in a container) |
--port | 7777 | SQL wire-protocol port |
--data-dir | /var/lib/nyxdb | DDL journal, DML journal, and columnar parts |
Persist /var/lib/nyxdb on a volume so data survives restarts. The container
runs as the non-root user nyxdb (uid 10001).
Ports
| Port | Use |
|---|---|
7777 | Wire protocol (Docker default) |
7510 | Wire protocol (common local dev default) |
8086 | Tracy profiler (when built with -DNYXDB_TRACY=ON) |
CPU microarchitecture note
NYXDB uses SIMD (via Google Highway). Release images are built for a baseline
microarchitecture for portability; building from source lets you target a
specific -march. Match the build to the host's CPU features when chasing
peak throughput.
TODO-verify: the exact -march baseline of the published image and any
runtime SIMD-dispatch flags for your release.
Security
The wire protocol is plaintext and unauthenticated by default. For production:
- terminate TLS in front of the server (proxy / load balancer);
- enable authentication (
--require-authwith an admin password — TODO-verify the exact flags for your release); - restrict network exposure to trusted clients.