--- title: "OpenSearch Docker Compose and one-click hosting" description: "OpenSearch is an open-source search and analytics engine, forked from Elasticsearch. Self-host it with OpenSearch Dashboards in one click." --- [← All templates](https://pethost.dev/templates/) · [Developer tools](https://pethost.dev/templates/developer-tools/) # Deploy OpenSearch in one click Open-source search and analytics engine, with OpenSearch Dashboards: full-text and vector search, logs and dashboards A self-hosted alternative to Elasticsearch and Algolia. [Deploy on Pethost](https://console.pethost.dev/?template=opensearch) ## What is OpenSearch? OpenSearch is a search and analytics engine: you send it JSON documents over a REST API, and it finds them by full text, filters and aggregates them, and searches them by vector for AI apps with its k-NN plugin. OpenSearch Dashboards is its web interface: dashboards and charts, Discover for exploring logs and events, Dev Tools for sending queries, and pages for its plugins, such as security, alerting and anomaly detection. OpenSearch began in 2021 as a fork of Elasticsearch 7.10.2 and Kibana, when Elastic changed their license, and is open source under Apache 2.0. Since 2024 it is run by the OpenSearch Software Foundation, part of the Linux Foundation. This template runs one node with OpenSearch Dashboards at the project's address, with the security plugin on: its only users are the administrator, made from the fields before OpenSearch answers anyone, and Dashboards' own, so none of the image's demo users with published passwords. The catch: it runs on Java and takes more memory than lighter search engines, and one node keeps no replica of its indexes. ## Hosting OpenSearch on Pethost 1. You sign in to Pethost with a passkey, GitHub or Google. No machine yet? You pick a plan, and the link waits until it is ready. 2. New project opens at OpenSearch. You fill in what it asks for and click Create project: **Admin password**. 3. In a minute or two OpenSearch is live at its own address with HTTPS. Its secrets are made at random, and its data is in the nightly backup. 4. It is a project like any other: you or your agent can change it, roll it back or restore it. ## Questions about OpenSearch **Is OpenSearch free?** Yes. OpenSearch and OpenSearch Dashboards are open source under the Apache 2.0 license, with every plugin included and no paid edition. Amazon sells a managed version, Amazon OpenSearch Service. **OpenSearch vs Elasticsearch: what is the difference?** OpenSearch started as a fork of Elasticsearch 7.10.2 in 2021, so its query language and REST API look familiar, but the two have moved apart since. OpenSearch is Apache 2.0 with security, alerting and vector search built in, while Elasticsearch is sold by Elastic under its own licenses and the AGPL. **Can I use OpenSearch for vector search?** Yes. Its k-NN plugin stores vectors beside your documents and finds the nearest ones, with the Lucene and Faiss engines, and its neural search plugin combines that with text search, for semantic search and retrieval for AI apps. **How do my apps connect to OpenSearch?** Over its REST API on port 9200. Add a host on the project's Domains tab with a route to the opensearch service on that port, and connect with an official client (Python, JavaScript, Java, Go, Ruby, PHP, .NET or Rust) or plain HTTPS, signed in as admin or as a user you make for the app. **How much memory and disk does OpenSearch need?** OpenSearch runs on Java with a 512 MB heap: about 1.3 GB of memory with OpenSearch Dashboards at rest, more as indexes grow; for large indexes, raise the heap in OPENSEARCH_JAVA_OPTS. On Pethost the Starter plan is enough for it, with room for other apps beside it. ## OpenSearch Docker Compose file The template is this compose.yaml and the variables written into the project’s .env as it is created. Pethost runs the file as it is written. **Containers:** opensearch (opensearchproject/opensearch:3), dashboards (opensearchproject/opensearch-dashboards:3). **Volumes, in the nightly backup:** data. ``` services: opensearch: image: opensearchproject/opensearch:3 restart: unless-stopped environment: OPENSEARCH_JAVA_OPTS: -Xms512m -Xmx512m ADMIN_PASSWORD: ${ADMIN_PASSWORD} DASHBOARDS_PASSWORD: ${DASHBOARDS_PASSWORD} # The image's demo configuration would add its demo users, whose passwords are published, # and certificates whose keys are too: this start writes its own instead. DISABLE_INSTALL_DEMO_CONFIG: "true" # At each start: a certificate authority and a node certificate of this container's own for # the security plugin's transport layer, made with the JDK's keytool, as the image has no # openssl; opensearch.yml with them; and the users the security index is made from at the # first start: the administrator with the password given, not reserved, so that it can change # its password with no admin certificate, and OpenSearch Dashboards' server user. Once the index exists, OpenSearch reads its users from it, and a password changed in # OpenSearch Dashboards stays. A single node holds no replica, so an index asks for none. The # REST API answers over HTTP inside the project, where the proxy brings HTTPS requests. command: - bash - -c - | set -e cd /usr/share/opensearch if [ "$${#ADMIN_PASSWORD}" -lt 8 ]; then echo "The admin password must have 8 characters at least, as OpenSearch asks." >&2 exit 1 fi keytool=jdk/bin/keytool certs=config/certs store=$$(head -c 16 /dev/urandom | od -An -tx1 | tr -d ' \n') rm -rf "$$certs" mkdir -p "$$certs" $$keytool -genkeypair -alias ca -keyalg RSA -keysize 2048 -validity 3650 -dname CN=opensearch-ca -ext bc:c \ -keystore "$$certs/ca.p12" -storetype PKCS12 -storepass "$$store" 2> /dev/null $$keytool -exportcert -rfc -alias ca -keystore "$$certs/ca.p12" -storepass "$$store" -file "$$certs/ca.pem" 2> /dev/null $$keytool -genkeypair -alias node -keyalg RSA -keysize 2048 -validity 3650 -dname CN=opensearch \ -keystore "$$certs/node.p12" -storetype PKCS12 -storepass "$$store" 2> /dev/null $$keytool -certreq -alias node -keystore "$$certs/node.p12" -storepass "$$store" -file "$$certs/node.csr" 2> /dev/null $$keytool -gencert -rfc -alias ca -keystore "$$certs/ca.p12" -storepass "$$store" -validity 3650 \ -ext SAN=dns:opensearch,dns:localhost -ext KU=digitalSignature,keyEncipherment -ext EKU=serverAuth,clientAuth \ -infile "$$certs/node.csr" -outfile "$$certs/node.pem" 2> /dev/null $$keytool -importcert -noprompt -alias ca -file "$$certs/ca.pem" -keystore "$$certs/node.p12" -storepass "$$store" 2> /dev/null $$keytool -importcert -noprompt -alias node -file "$$certs/node.pem" -keystore "$$certs/node.p12" -storepass "$$store" 2> /dev/null $$keytool -importcert -noprompt -alias ca -file "$$certs/ca.pem" -keystore "$$certs/trust.p12" -storetype PKCS12 -storepass "$$store" 2> /dev/null rm "$$certs/ca.p12" "$$certs/node.csr" cat > config/opensearch.yml < /dev/null | tail -n 1; } cat > config/opensearch-security/internal_users.yml <