Skip to content
Foxx Cyberfoxxcyber/docs

Installation

Run the C3PAO client container and complete first-run instance setup.

Requirements

  • Docker (or a compatible container runtime) with Docker Compose on the assessment machine or VDI
  • No network access to the Bedrock CMMC platform is required — the default build is fully air-gapped

Run the container

The Compose file starts two services: the C3PAO client itself and a bundled PostgreSQL database that stores all instance data. Two environment values must be set before first run (see deploy/.env.example in the distribution): a database password and a configuration encryption key.

docker compose up -d

The client listens on port 3001 over HTTPS with a self-signed certificate, so your browser will show a certificate warning the first time you open it — this is expected for an air-gapped appliance.

Treat the Docker volumes as assessment records. The database volume holds every finding, note, and imported package; the app data volume holds the TLS certificate and uploaded evidence files. Do not delete them or recreate the stack without a backup while an engagement is in progress. See How your data moves for details on what lives where.

First-run setup wizard

The first time you open the client in a browser, the Bedrock C3PAO Setup wizard appears.

  1. On the welcome card, click Get Started.
  2. On the Create Admin Account step, fill in:
    • C3PAO Organization Name — the name shown throughout the portal.
    • Full Name, Email, Password, and Confirm Password for the local administrator account. The password must be at least 12 characters.
  3. Click Complete Setup. The wizard shows Setup Complete and redirects you to the login page.

The admin account created here manages instance configuration and user accounts — it is separate from assessor accounts, which the admin creates afterwards (see Instance administration).

Connected deployments

Deployments configured for connected (non-air-gapped) operation show one extra wizard step, Connection Settings, before the admin step:

  1. Enter the Bedrock API URL of the Bedrock CMMC platform.
  2. Enter your Instance API Key (it starts with bri-). Contact your Bedrock administrator if you don't have one.
  3. Click Validate & Connect. On success the admin step shows a Connected to banner with your C3PAO's name and license details.

The shipped container image runs air-gapped by default. Connected mode is a deployment-time choice made by whoever operates the container — it is not a toggle inside the app.

Next steps

Continue to Signing in to log in and tour the portal.

Last updated July 29, 2026