Install¶

Run Sluice from a container image, a release archive or a source build.

These docs describe the main branch. A release can behave differently. The API and the policy schema can still change, so pin an exact version.

Container image¶

The image runs on linux/amd64 and linux/arm64. It has no shell and runs as a non-root user. The tag is the release version without the leading v. A pre-release never gets the tag latest. Set VERSION to the release that you want.

VERSION=0.1.0-rc.3
docker pull ghcr.io/bino-bi/sluice:${VERSION}
docker run --rm ghcr.io/bino-bi/sluice:${VERSION} version

The image is signed. Verify it with cosign:

cosign verify ghcr.io/bino-bi/sluice:${VERSION} \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Release archive¶

The releases page has archives for linux_amd64, linux_arm64, darwin_amd64 and darwin_arm64. The Linux binaries need glibc 2.38 or later, for example Debian 13 or Ubuntu 24.04. On an older system or on Windows, use the image or build from source. This example gets and checks the linux_amd64 archive:

VERSION=0.1.0-rc.3
BASE=https://github.com/bino-bi/sluice/releases/download/v${VERSION}
curl -fsSLO ${BASE}/sluice_${VERSION}_linux_amd64.tar.gz
curl -fsSLO ${BASE}/checksums.txt
sha256sum --check --ignore-missing checksums.txt
tar -xzf sluice_${VERSION}_linux_amd64.tar.gz
./sluice version

A release also holds a signature for checksums.txt and, for each archive, a CycloneDX SBOM that lists its software parts. multiple.intoto.jsonl holds the SLSA provenance, a signed build record. Verify the signature:

curl -fsSLO ${BASE}/checksums.txt.sig
curl -fsSLO ${BASE}/checksums.txt.pem
cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  --certificate-identity-regexp 'https://github.com/bino-bi/sluice/.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  checksums.txt

Build from source¶

You need Git, make, Go 1.26 or later and a C compiler. Sluice needs cgo, so a build with CGO_ENABLED=0 fails.

git clone https://github.com/bino-bi/sluice.git
cd sluice
make build
export PATH="$PWD/bin:$PATH"
sluice version

make build writes bin/sluice. sluice version prints the version, the commit, the build time and the parser. make all also formats, checks and tests the code.

Check the binary¶

The binary lists its commands:

sluice --help

SQL access-policy gateway

Usage:
  sluice [command]

Available Commands:
  apikey      Manage API-key hashes
  audit       Inspect sluice audit logs
  budget      Inspect per-subject query budgets
  completion  Generate the autocompletion script for the specified shell
  config      Inspect and validate sluice configuration
  datasource  Inspect configured data sources
  help        Help about any command
  mcp         Run the MCP server for AI agents (stdio by default)
  policy      Inspect, validate, and explain policies
  schema      Inspect the policy DSL schema
  serve       Start the sluice server
  synth       Build and inspect synthetic data snapshots
  version     Print sluice build identity

Flags:
  -h, --help   help for sluice

Use "sluice [command] --help" for more information about a command.

DuckDB extensions¶

The images hold every DuckDB extension that Sluice needs. Other builds can download an extension when they first attach a data source. Deployment lists what each build includes and how to build your own image.

See also¶

• Quickstart
• Server config
• CLI