redpanda-console

packaged by Chainguard

Chainguard Container for redpanda-console

Redpanda Console is a web UI for managing and debugging Kafka and Redpanda clusters.

Chainguard Containers are regularly-updated, secure-by-default container images.

Download this Container Image

For those with access, this container image is available on cgr.dev:

docker pull cgr.dev/ORGANIZATION/redpanda-console:latest

Be sure to replace the ORGANIZATION placeholder with the name used for your organization's private repository within the Chainguard Registry.

Compatibility Notes

The Chainguard Container for Redpanda Console is a drop-in replacement for the upstream redpandadata/console image. It is built on Chainguard OS, ships with few-to-zero CVEs, and runs as a non-root user. The entrypoint (./console) and configuration (--config.filepath or environment variables) match upstream.

Two differences matter when migrating an existing deployment:

This image runs as UID 65532 / GID 65532, whereas the upstream image runs as UID 100 / GID 101. Any configuration, TLS material, or other files you mount for the console to read must be readable by UID 65532, and Kubernetes users should set securityContext.runAsUser and fsGroup to match.

The upstream image bakes an /etc/ssh/ssh_known_hosts file that the Git-over-SSH integration (git.ssh.enabled) relies on. This image does not ship one, so if you enable that integration, mount a known-hosts file and set the SSH_KNOWN_HOSTS environment variable to its path.

Prerequisites

Redpanda Console is a UI for an existing Kafka or Redpanda cluster; it must be pointed at one or more brokers (default Kafka port 9092) to be useful. The console itself serves its web UI on port 8080 by default.

Console tests its Kafka connection at startup and exits if none of the configured brokers are reachable, so a broker must be running before you start the container.

Getting Started

Docker

Because the console exits without a reachable broker, this example first starts a single-node Redpanda broker, then runs the console against it on a shared Docker network. Create the network and start the broker:

docker network create redpanda-console-net

docker run -d --name redpanda --network redpanda-console-net \
  --entrypoint rpk \
  cgr.dev/ORGANIZATION/redpanda:latest \
  redpanda start --mode dev-container --smp 1 \
  --kafka-addr PLAINTEXT://0.0.0.0:9092 \
  --advertise-kafka-addr PLAINTEXT://redpanda:9092

Provide a small config file that points the console at the broker, then run it on the same network:

cat <<EOF > console.yaml
kafka:
  brokers:
    - redpanda:9092
server:
  listenPort: 8080
EOF

docker run --rm \
  --network redpanda-console-net \
  -p 8080:8080 \
  -v "$(pwd)/console.yaml:/etc/console/console.yaml:ro" \
  cgr.dev/ORGANIZATION/redpanda-console:latest \
  --config.filepath=/etc/console/console.yaml

The UI is then available at http://localhost:8080.

Kubernetes (Helm)

Redpanda publishes a Console Helm chart. Create a values file that points the chart at your broker(s) and overrides the image to use this Chainguard image:

cat > values.yaml <<EOF
image:
  registry: cgr.dev
  repository: ORGANIZATION/redpanda-console
  tag: latest
# The chart names its resources "<release>-console"; pin the name so the
# Service is addressable as "redpanda-console".
fullnameOverride: redpanda-console
config:
  kafka:
    brokers:
      - redpanda.default.svc.cluster.local:9092
EOF

helm repo add redpanda https://charts.redpanda.com
helm repo update

helm install redpanda-console redpanda/console --values values.yaml

Console is then reachable in-cluster at http://redpanda-console:8080. The full Redpanda Helm chart also bundles Console (console.enabled=true, wired to the cluster automatically); override console.image.* through your values file to use this image instead.

Configuration

Redpanda Console is configured through a YAML file passed with --config.filepath (values can also be overridden via environment variables). At minimum, set the Kafka/Redpanda brokers and the HTTP listenPort:

kafka:
  brokers:
    - redpanda:9092
server:
  listenPort: 8080

See the upstream configuration reference for the full set of options (schema registry, Redpanda Admin API, authentication, etc.).

Documentation and Resources

• Redpanda Console documentation
• Redpanda Console source code
• Redpanda Console Helm chart source

What are Chainguard Containers?

Chainguard's free tier of Starter container images are built with Wolfi, our minimal Linux undistro.

All other Chainguard Containers are built with Chainguard OS, Chainguard's minimal Linux operating system designed to produce container images that meet the requirements of a more secure software supply chain.

The main features of Chainguard Containers include:

• Minimal design, without unnecessary software bloat
• Daily builds to ensure container images are up-to-date with available security patches
• High quality build-time SBOMs attesting to the provenance of all artifacts within the image
• Verifiable signatures provided by Sigstore
• Reproducible builds with Cosign and apko (read more about reproducibility)

For cases where you need container images with shells and package managers to build or debug, most Chainguard Containers come paired with a development, or -dev, variant.

In all other cases, including Chainguard Containers tagged as :latest or with a specific version number, the container images include only an open-source application and its runtime dependencies. These minimal container images typically do not contain a shell or package manager.

Although the -dev container image variants have similar security features as their more minimal versions, they include additional software that is typically not necessary in production environments. We recommend using multi-stage builds to copy artifacts from the -dev variant into a more minimal production image.

Need additional packages?

To improve security, Chainguard Containers include only essential dependencies. Need more packages? Chainguard customers can use Custom Assembly to add packages, either through the Console, chainctl, or API.

To use Custom Assembly in the Chainguard Console: navigate to the image you'd like to customize in your Organization's list of images, and click on the Customize image button at the top of the page.

Learn More

Refer to our Chainguard Containers documentation on Chainguard Academy. Chainguard also offers VMs and Libraries — contact us for access.

Trademarks

This software listing is packaged by Chainguard. The trademarks set forth in this offering are owned by their respective companies, and use of them does not imply any affiliation, sponsorship, or endorsement by such companies.