Deployment

Run Cerbos as a systemd service

Run the Cerbos PDP as a managed systemd service on any Linux host with automatic restarts and logging.

Process management

Automatic restarts, dependency ordering, and resource limits managed by systemd

Journal logging

Cerbos logs integrate with the systemd journal for centralized log management

No container required

Run Cerbos as a native binary without Docker or any container runtime

What is Cerbos?

Cerbos is an open-source authorization layer that decouples access control from your application code. It runs as a stateless Policy Decision Point (PDP) that evaluates fine-grained policies at request time.

Authorization policies are written in human-readable YAML supporting RBAC, ABAC, and conditional rules. They can be updated, tested, and deployed independently of your application.

Deploying Cerbos via Systemd gives you a production-ready authorization service that scales horizontally and fits naturally into your existing infrastructure and observability stack.

Policy-as-codeHuman-readable YAML policies managed like source code Scalable PDPStateless policy decision point with sub-millisecond latency Centralized managementManage, test, and deploy policies from a single control plane

How to run Cerbos as a systemd service

Download the Cerbos binary, Grab the latest static binary from the Cerbos releases page for your architecture.
Create a Cerbos configuration file, Configure your policy source, server settings, and logging preferences in a YAML config file.
Create a systemd unit file, Define a service unit that runs the Cerbos binary with your configuration, with restart and resource limit policies.
Enable and start the service, Run systemctl enable --now cerbos to start Cerbos and ensure it starts on boot.

FAQ

How do I run Cerbos as a systemd service?

Download the Cerbos binary, create a systemd unit file that points to your Cerbos configuration, then enable and start the service with systemctl. Cerbos will run as a managed background process with automatic restarts.

Does Cerbos require any external dependencies?

No. Cerbos is a single static binary with no external dependencies. It requires no database, message queue, or container runtime.

How do I view Cerbos logs with systemd?

Use `journalctl -u cerbos` to view Cerbos logs through the standard systemd journal. Cerbos supports structured JSON logging for integration with log aggregation tools.