Skip to Content

Rackvio Community Edition — Network Traffic Policy

Version: 1.1 Effective date: 2026-05-12 Applies to: Rackvio Community Edition (self-hosted Docker deployment)

Summary

Rackvio Community Edition makes zero outbound network connections by default. The Docker containers communicate only with each other on the Docker bridge network. There is no telemetry, no analytics, no phone-home, and no license verification.

Container Communication

The Rackvio stack consists of four containers that communicate exclusively over the Docker bridge network:

frontend (Next.js) ---HTTP---> backend (FastAPI) backend (FastAPI) ---TCP----> postgres (PostgreSQL 16) backend (FastAPI) ---TCP----> redis (Redis 7)

No container initiates connections outside the Docker bridge network unless explicitly configured by the administrator (see Optional Outbound Connections below).

Internal Traffic Matrix

SourceDestinationProtocolPortPurpose
frontendbackendHTTP8000API requests (server-side)
backendpostgresTCP5432Database queries
backendredisTCP6379Sessions, cache, task queue

Inbound Connections

The following ports are exposed to the host network and are configurable in docker-compose.yml:

PortServicePurposeConfigurable
3000frontendWeb UI (Next.js)Yes
8000backendREST API (FastAPI/Uvicorn)Yes

No other ports are exposed by default. PostgreSQL (5432) and Redis (6379) are accessible only within the Docker bridge network.

Outbound Connections

Default: None

Out of the box, Rackvio makes zero outbound network connections. Specifically:

Optional: User-Configured Outbound

The following outbound connections occur only if the administrator explicitly configures them:

FeatureDestinationWhen ActiveEnv Variable
SMTP email deliveryYour SMTP relayWhen SMTP is configured for invitationsSMTP_HOST
Device library online syncRackvio library endpointWhen sync mode set to online or bothRACKVIO_SYNC_MODE

Note on OIDC/SSO. SSO is an Enterprise-tier feature and is not in the community build. The community Dockerfile strips the entire backend/app/enterprise/ source tree, and the frontend webpack config replaces every @/enterprise/* import with a 404 component. The /admin/sso/* routes return HTTP 404 in community. If you self-host with SSO and need a local password-based admin, the bootstrap admin flow (auto-provisioned on first startup) is the supported path.

SMTP

If you configure SMTP (SMTP_HOST, SMTP_PORT, SMTP_USERNAME, SMTP_PASSWORD), the backend will connect to your mail relay to send user invitation emails.

No SMTP traffic occurs unless you set these variables. Without SMTP configured, invitation emails are logged to stdout instead.

Device Library Sync

The device equipment library sync mode is controlled by RACKVIO_SYNC_MODE:

ValueOutbound TrafficDescription
airgappedNoneDefault. Only accepts signed ZIP bundle uploads via the UI.
onlineYesFetches device type catalog from RACKVIO_LIBRARY_URL.
bothYesBoth channels active.

The default is airgapped. No outbound traffic for library sync unless you change this setting.

Docker Image Provenance

Rackvio Community Edition uses the following base images:

ImageSourcePurpose
pgvector/pgvector:pg16Docker HubPostgreSQL database
redis:7-alpineDocker HubCache and queue
Custom (Dockerfile)Built from sourceBackend and frontend

All images are pulled only during initial build. In air-gapped deployments, images can be pre-loaded via docker load (see the Installation Guide).

Verification

To verify zero outbound traffic in your environment:

# Monitor all outbound connections from the Rackvio containers # (should show only inter-container traffic on the Docker bridge) docker compose -f docker-compose.yml exec backend \ ss -tunp 2>/dev/null || netstat -tunp # Or use tcpdump on the host to monitor the Docker bridge sudo tcpdump -i docker0 -n 'not (src net 172.16.0.0/12 and dst net 172.16.0.0/12)'

If the above captures show no packets, Rackvio is making no outbound connections.

Changes to This Policy

This policy applies to Rackvio Community Edition as distributed. Any future features that introduce outbound connections will:

  1. Be opt-in only (disabled by default).
  2. Be documented in this policy before release.
  3. Be controlled by an explicit environment variable.
  4. Never be silently enabled via an upgrade.