Camunda 8 Self-Managed - Docker Compose

Usage

For end user usage, please check the official documentation of Camunda 8 Self-Managed Docker Compose.

Application configuration

Camunda services read their application settings from YAML mounted by Docker Compose:

The lightweight docker-compose.yaml keeps its Orchestration and Connectors YAML inline under configs, preserving the single-file setup.
The full and standalone setups share component files under .identity/ and .web-modeler/. The standalone-only Identity overlay remains inline in docker-compose-web-modeler.yaml.
The full setup additionally uses .orchestration/application.yaml, .connectors/application.yaml, and the files under .optimize/. Web Modeler cluster registrations are isolated in .web-modeler/application-full.yaml.

The mounted files reference values from .env with ${VARIABLE:default} placeholders. Keep environment-specific endpoints and secrets in .env; direct Spring environment variables can still override file values. PostgreSQL, Keycloak, Elasticsearch, Web Modeler WebSockets, the separate Web Modeler webapp, and Console continue to use their native environment-based configuration.

Enabling multi-tenancy

Lightweight configuration

The lightweight docker-compose.yaml runs with basic authentication and an unprotected API. To enable multi-tenancy, protect the API and switch on the tenancy checks by creating a docker-compose.override.yaml next to the compose file:

services:
  orchestration:
    environment:
      - CAMUNDA_SECURITY_AUTHENTICATION_UNPROTECTEDAPI=false
      - CAMUNDA_SECURITY_MULTITENANCY_CHECKSENABLED=true
      - CAMUNDA_SECURITY_MULTITENANCY_APIENABLED=true
  connectors:
    environment:
      - CAMUNDA_CLIENT_AUTH_METHOD=basic
      - CAMUNDA_CLIENT_AUTH_USERNAME=demo
      - CAMUNDA_CLIENT_AUTH_PASSWORD=demo

Then start the stack with docker compose up -d and manage tenants through the Orchestration Cluster API (or the Identity UI at http://localhost:8088/identity):

# create a tenant
curl -u demo:demo -X POST http://localhost:8088/v2/tenants \
  -H 'Content-Type: application/json' -d '{"tenantId": "tenant-a", "name": "Tenant A"}'
# assign the demo user to it
curl -u demo:demo -X PUT http://localhost:8088/v2/tenants/tenant-a/users/demo

API clients must authenticate with basic auth once the API is protected (camunda.client.auth.method=basic plus username and password in the Camunda client SDKs).

Full configuration

The full docker-compose-full.yaml already protects the API through Keycloak, so only the tenancy checks need to be switched on. Add the following to .env:

CAMUNDA_SECURITY_MULTITENANCY_CHECKSENABLED=true
CAMUNDA_SECURITY_MULTITENANCY_APIENABLED=true

Then start the stack with docker compose -f docker-compose-full.yaml up -d and manage tenants through the Orchestration Cluster API with an OAuth token (or the Identity UI at http://localhost:8088/identity):

TOKEN=$(curl -s -X POST 'http://localhost:18080/auth/realms/camunda-platform/protocol/openid-connect/token' \
  -d 'grant_type=client_credentials' -d 'client_id=orchestration' -d 'client_secret=secret' | jq -r .access_token)
# create a tenant
curl -X POST http://localhost:8088/v2/tenants -H "Authorization: Bearer $TOKEN" \
  -H 'Content-Type: application/json' -d '{"tenantId": "tenant-a", "name": "Tenant A"}'
# assign the demo user to it
curl -X PUT http://localhost:8088/v2/tenants/tenant-a/users/demo -H "Authorization: Bearer $TOKEN"

Versions

CAMUNDA_VERSION=8.8.44
CAMUNDA_CONNECTORS_VERSION=8.8.24
CAMUNDA_IDENTITY_VERSION=8.8.21
CAMUNDA_OPERATE_VERSION=8.8.44
CAMUNDA_TASKLIST_VERSION=8.8.44
CAMUNDA_OPTIMIZE_VERSION=8.8.44
CAMUNDA_WEB_MODELER_VERSION=8.8.24
CAMUNDA_CONSOLE_VERSION=8.8.148
ELASTIC_VERSION=8.17.10
KEYCLOAK_SERVER_VERSION=quay-26.6.4
MAILPIT_VERSION=v1.21.8
POSTGRES_VERSION=15-alpine3.22

Verification

To verify the integrity of the artifact using Cosign:

# Download Docker Compose artifact.
curl -LO https://github.com/camunda/camunda-distributions/releases/download/docker-compose-8.8/docker-compose-8.8.zip
# Download Docker Compose Cosign bundle.
curl -LO https://github.com/camunda/camunda-distributions/releases/download/docker-compose-8.8/docker-compose-8.8.cosign.bundle
# Verify with cosign.
cosign verify-blob docker-compose-8.8.zip \
  --bundle docker-compose-8.8.cosign.bundle \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
  --certificate-identity "https://github.com/camunda/camunda-distributions/.github/workflows/docker-compose-release-template.yaml@refs/heads/main"

Notes

Release strategy: Camunda Docker Compose release is a rolling release. Hence, it's always 1 artifact per Camunda minor version.
Latest update: Mon Nov 2 14:05:46 UTC 2026

camunda/camunda-distributions docker-compose-8.8 on GitHub