Self-host with Docker

Run ShieldReplay on your infrastructure — same dashboard, agent, WAF, and automations.

Enterprise self-host

Deploy ShieldReplay with Docker Compose (MySQL + API). Suitable for private cloud, VPC, or air-gapped environments.

Quick start

git clone <your-repo> shieldreplay
cd shieldreplay
cp server/.env.example server/.env
# Edit JWT_SECRET, AUTOMATION_SECRET_KEY, IP_HASH_SALT (32+/16+ chars)
# Set ADMIN_IP_ALLOWLIST=* (or your office/VPN IPs) for admin UI access
# Set TRUST_PROXY=1 when behind TLS termination

docker compose up --build -d
docker compose exec app sh -c "cd server && node scripts/seed-auth.mjs"

Open http://localhost:3000/admin and sign in with the seeded credentials from .env.

What’s included

  • Session replay ingest + dashboard
  • Client-side WAF policy
  • Automation Studio (Slack, Jira, Datadog, PagerDuty, etc.)
  • Organization admin + OIDC SSO (Okta, Azure AD, Google)
  • Per-site integration marketplace

Production checklist

  • Set a strong JWT_SECRET (32+ chars), AUTOMATION_SECRET_KEY (16+), and IP_HASH_SALT (16+)
  • Set ADMIN_IP_ALLOWLIST to * or comma-separated IPs (required for admin APIs in production)
  • Set TRUST_PROXY=1 when behind nginx/Caddy/cloud load balancer so HTTPS snippets work
  • Configure REPLAY_BASE_URL to your public HTTPS URL (e.g. https://your-host/replay)
  • Add allowed domains per site in the setup wizard before expecting ingest/WAF
  • Enable OIDC SSO via OIDC_ISSUER, OIDC_CLIENT_ID, OIDC_CLIENT_SECRET
  • Put TLS termination in front (nginx, Caddy, cloud load balancer)

Compare to LogRocket

LogRocket offers mature hosted SaaS and enterprise contracts. ShieldReplay self-host gives you data residency, WAF + replay in one stack, and built-in automations without a separate integration marketplace subscription.