Quick start

Install the open-source StackRadar scanner in any Kubernetes cluster with a single Helm command and see your first SBOMs and vulnerabilities within minutes.

Prerequisites

A Kubernetes cluster and a kubectl context with permission to create a namespace and install workloads.
Helm 3.8 or newer (3.8+ is required for the OCI install method).
A free StackRadar account — no credit card required.
Outbound HTTPS (port 443) from the cluster to api.stackradar.io. That is the only endpoint the scanner talks to.

1. Get your credentials

Sign in to the dashboard, create a cluster, and copy its cluster ID and cluster-scoped API key. Each cluster gets its own key — see API keys & cluster scoping for why.

bash

export STACKRADAR_API_KEY=<your-api-key>
export STACKRADAR_CLUSTER_ID=<your-cluster-id>

2. Install the scanner

The scanner is a single Helm chart. Install it either from the OCI registry (Helm 3.8+) or from the classic Helm repository — both install the same chart.

Option A — OCI registry

bash

helm install stackradar-scanner \
    oci://ghcr.io/lockdep/charts/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

Option B — Helm repository

bash

helm repo add lockdep https://charts.lockdep.io
helm repo update
helm install stackradar-scanner lockdep/stackradar-scanner \
    --namespace stackradar --create-namespace \
    --set stackradar.apiKey=$STACKRADAR_API_KEY \
    --set stackradar.clusterId=$STACKRADAR_CLUSTER_ID

The scanner is open source — you can read every line of what runs in your cluster on GitHub and inspect the chart on Artifact Hub.

3. Verify it's running

Check that the scanner pod is up:

bash

kubectl get pods --namespace stackradar

Within a minute the scanner sends its first heartbeat and the cluster shows as connected in the dashboard. As pods start (or restart) in the cluster, the scanner generates a CycloneDX SBOM for each container image and uploads it. Your first components and vulnerabilities typically appear within a few minutes on an active cluster.

Next steps

Scanner architecture & data flow — what runs in your cluster and exactly what data leaves it.
Installing on a managed platform? See the guides for EKS, GKE, or AKS — or the general guide for any Kubernetes cluster, which also covers configuration, upgrades, and uninstalling.
Cluster can't reach the public internet? See private registry & restricted-network installs.
Something not working? See Troubleshooting.