Self-Hosting
Phase Two publishes the same Keycloak image that runs our managed clusters, so you can run it on your own infrastructure. Organizations self-host when they have compliance, data residency, or network requirements that a managed service can't meet, or when they ship Keycloak inside their own product to customer sites.
If you don't have one of those requirements, the managed service is usually less work. See Managed vs Self-Hosted for a side-by-side comparison, and Pricing for support options when you self-host.
What is in the image
The image is quay.io/phasetwo/phasetwo-keycloak. It is Keycloak built from the p2-inc/keycloak fork, which differs from upstream only in adding CockroachDB support, plus the Phase Two extensions:
| Component | What it does | Source |
|---|---|---|
| Organizations | Multi-tenant organizations, roles, invitations, and domains, with APIs | p2-inc/keycloak-orgs |
| Events | Event listeners, including webhooks | p2-inc/keycloak-events |
| Magic Link | Passwordless login by email link or code | p2-inc/keycloak-magic-link |
| Themes | Login, email, and admin theme customization, including the phasetwo-ui admin theme | p2-inc/keycloak-themes |
| Admin Portal | Self-service portal for users and organization admins | p2-inc/phasetwo-admin-portal |
| IdP Wizards | Guided SSO and directory sync setup | p2-inc/idp-wizard |
| SCIM Server | SCIM 2.0 user and group provisioning | p2-inc/keycloak-scim-server |
| Atomic Auth Flows | Create and change authentication flows in a single API call | p2-inc/keycloak-atomic-auth-flows |
| User Migration | Migrate users from a legacy system on first login | daniel-frak/keycloak-user-migration |
| Apple Identity Provider | Sign in with Apple | klausbetz/apple-identity-provider-keycloak |
The image itself is built in the open at p2-inc/phasetwo-containers, which is also where to report image issues. For licensing, see Open Source.
What stays with the managed service
Self-hosting gives you the server and the extensions. These are part of the managed service and are not in the image:
- The dashboard for creating clusters and realms, custom domains, IP restrictions, logs, metrics, and environment variables
- Operation of the database, backups, and monitoring
- Version upgrades, security patching, and capacity planning
- The uptime SLA on Premium and Enterprise clusters
Where to start
- Docker image: tags, runtime defaults, and a local quick start
- Database: PostgreSQL or CockroachDB, and cache discovery
- Kubernetes: deploying with Helm or the Keycloak Operator
- Upgrading: moving between image versions safely
- On-prem distribution: shipping Keycloak to your customers' sites
Before going live, work through the Keycloak Production Readiness Checklist. Every server-level item in it applies when you self-host.