Skip to content
Foxx Cyberfoxxcyber/docs

Installation

Run the C3PAO client container and complete first-run instance setup.

Requirements

  • Docker (or a compatible container runtime) with Docker Compose on the assessment machine or VDI
  • No connection to the Bedrock CMMC platform — not during installation, not during setup, and not afterwards. The client is fully air-gapped; assessment data enters only through package import.

Run the container

The Compose file starts two services: the C3PAO client itself and a bundled PostgreSQL database that stores all instance data. Two environment values must be set before first run (see deploy/.env.example in the distribution): a database password and a configuration encryption key.

docker compose up -d

The client listens on port 3001 over HTTPS with a self-signed certificate, so your browser will show a certificate warning the first time you open it — this is expected for an air-gapped appliance.

Treat the Docker volumes as assessment records. The database volume holds every finding, note, and imported package; the app data volume holds the TLS certificate and uploaded evidence files. Do not delete them or recreate the stack without a backup while an engagement is in progress. See How your data moves for details on what lives where.

First-run setup wizard

The first time you open the client in a browser, the Bedrock C3PAO Setup wizard appears. Setup is entirely local: there is no API URL, license key, or activation step, and nothing is validated against the Bedrock CMMC platform.

  1. On the welcome card, click Get Started.
  2. On the Create Admin Account step, fill in:
    • C3PAO Organization Name — the name shown throughout the portal.
    • Full Name, Email, Password, and Confirm Password for the local administrator account. The password must be at least 12 characters.
  3. Click Complete Setup. The wizard shows Setup Complete and redirects you to the login page.

The admin account created here manages instance configuration and user accounts — it is separate from assessor accounts, which the admin creates afterwards (see Instance administration).

Next steps

Continue to Signing in to log in and tour the portal.

Last updated August 27, 2026