Deploy with a Rust backend

Rust services — Axum, Actix Web, Rocket, or anything else — pair with the sidecar the same way Go services do: the sidecar is its own static binary and container, nothing links into your crate, and no dependency is added to your Cargo.toml. Your application build is untouched.

This guide assumes you have a config bundle or a hand-written sidecar.yaml + token.

Docker Compose

compose.yaml

services:
  app:
    image: acme/acme-svc:latest        # your Rust image (distroless, musl, …)
    ports:
      - "8080:8080"

  ringzero-sidecar:
    image: ghcr.io/ringzero/sidecar:1
    restart: unless-stopped
    ports:
      - "7301:7301"                    # challenge listener — reachable at every (re)registration
    volumes:
      - ./ringzero-sidecar-config:/etc/ringzero:ro

musl / distroless images

If your service builds with x86_64-unknown-linux-musl into a scratch or distroless image, keep doing that — the sidecar runs beside it, not inside it. The sidecar binary is itself statically linked (no glibc requirement), so the same minimal-image discipline applies if you ever co-package it, though the separate-container layout above is the recommended one.

Kubernetes

On Kubernetes, prefer gateway mode

For ClusterIP-only services (the common case) — and any private cluster — use gateway mode: sidecars dial an in-cluster Scan Gateway outbound, no ingress needed. The direct-mode manifests below are for internet-reachable clusters; there, a Service round-robins the challenge to the wrong pod, so for replicated workloads use the DaemonSet per-node pattern — see Kubernetes: direct mode.

The per-pod sidecar (when each pod has its own reachable address):

Kubernetes 1.29+ (native sidecar)

deployment.yaml

apiVersion: apps/v1
kind: Deployment
metadata:
  name: acme-svc
spec:
  replicas: 1
  selector:
    matchLabels: { app: acme-svc }
  template:
    metadata:
      labels: { app: acme-svc }
    spec:
      initContainers:
        - name: ringzero-sidecar
          image: ghcr.io/ringzero/sidecar:1
          restartPolicy: Always          # native sidecar (K8s 1.29+)
          ports:
            - containerPort: 7301
          volumeMounts:
            - name: ringzero-config
              mountPath: /etc/ringzero
              readOnly: true
          resources:
            requests: { cpu: 10m, memory: 16Mi }
            limits: { memory: 64Mi }
      containers:
        - name: app
          image: acme/acme-svc:latest
          ports:
            - containerPort: 8080
      volumes:
        - name: ringzero-config
          secret:
            secretName: ringzero-sidecar

Older Kubernetes

deployment.yaml (fragment)

# identical, but the sidecar goes under `containers` instead of
# `initContainers` (drop restartPolicy).
containers:
  - name: app
    image: acme/acme-svc:latest
  - name: ringzero-sidecar
    image: ghcr.io/ringzero/sidecar:1
    ports:
      - containerPort: 7301
    volumeMounts:
      - name: ringzero-config
        mountPath: /etc/ringzero
        readOnly: true

Create the ringzero-sidecar Secret from your bundle as shown in Automated setup.

Bare metal / VMs

Download the static binary and run it under systemd — the install steps and unit file are stack-independent. One sidecar per host covers every service on it.

Verify

Sidecar logs show host registered; Settings → Hosts lists the host as active (see the host lifecycle); the health probe reports "registered": true. Troubleshooting: manual setup.