Get Started

Deploy QA-PaaS on your machine
in under 5 minutes

QA-PaaS runs entirely on your own infrastructure — no cloud dependency, no data leaving your network. Three commands and you're live.

On-premise AI-powered Air-gap ready Single image Offline license
Your OS:

Prerequisites

Docker Desktop 4.28+

Must be running in Linux container mode. On Windows: right-click the tray icon → Switch to Linux containers.

Install Docker Desktop
System resources

8 GB RAM minimum (16 GB recommended). 20 GB free disk. 4 CPU cores minimum.

QA-PaaS License Key

A free trial key is included with every registration — no credit card needed. Emailed instantly after sign-up.

Get free trial
Node.js 24+ (optional)

Only needed for local development. Not required for Docker deployment.

Download Node.js
Install Docker — windows
winget install Docker.DockerDesktop
01

Deploy the platform

Download the archive, pull the image, and run the first‑boot script — all secrets are auto‑generated.

1. Download the compose files

Grab the latest platform archive from Google Drive . The archive contains the Docker Compose file and the first‑boot scripts.

2. Unzip the archive — windows
# PowerShell – qapaas-platform.zip with the actual file name
Expand-Archive -Path .\qapaas-platform.zip -DestinationPath .\qapaas-platform
cd .\qapaas-platform
3. Pull the platform image
docker pull qapaas/qa-paas:8.8.4
4. Start the platform — windows
# PowerShell (inside the extracted folder)
.\first-boot.ps1 -Pek '${YOUR_PEK}'
Open your browser at https://localhost after the script finishes (~15 seconds). Your browser will show a self-signed certificate warning on first visit — click Advanced → Proceed to continue.
On first boot the container automatically generates and persists all required secrets to the persistent data volume. Subsequent starts reuse the same secrets — no manual configuration needed.

Verify the container is healthy:

terminal
docker compose ps

# Expected output:
# NAME     IMAGE                        STATUS
# qapaas   qapaas/qa-paas:8.8.4   running
02

Verify image signatures (recommended)

Prove the image was built by the official pipeline and has not been tampered with.

Install cosign — windows
winget install sigstore.cosign
terminal — verify the orchestrator image
cosign verify \
  --certificate-identity-regexp=".*" \
  --certificate-oidc-issuer-regexp=".*" \
  docker.io/qapaas/qa-paas:8.8.4
A successful verification prints the signing certificate details and exits 0. Any tampering causes a non-zero exit. For digest-pinned verification commands (the most secure form), see VERIFY.md . Every image is also signed with Notation (Notary V2 / X.509) and has a CycloneDX SBOM attached as a signed attestation.
03

Activate your license

Your license key was emailed after registration. It encodes your plan tier, quota limits, and expiry date.

AOpen the dashboard

Navigate to https://localhost in your browser. Register or sign in.

BGo to Settings → License

Click the Settings icon in the sidebar, then select the License tab.

CPaste & Activate

Paste your license key and click Activate. The platform binds to your machine on first use.

Activation is a one-time step. Once activated, your license works fully offline — no internet connection required for day-to-day use.
04

Run your first test

Six specialized engines. Pick the one that matches your stack.

API Testing (Auto-CRUD)

Upload your OpenAPI / Swagger spec. QA-PaaS auto-generates CRUD test suites, validates responses, and checks schema conformance using Jest + Axios.

Security Pen Testing

OWASP Top 10 checks, injection probes, and authentication bypass tests — automated with OWASP ZAP + Playwright. AI-generated remediation included.

Performance Testing

k6-powered load profiles with real-time Grafana + InfluxDB dashboards. Latency percentiles, throughput analysis, and bottleneck identification.

E2E / BDD Testing

Playwright-powered end-to-end tests generated from Gherkin feature files. Runs headless in the container — no browser install needed.

Database Testing

Six-pillar database validation strategy across MSSQL, MySQL, PostgreSQL, and Oracle. Schema, data integrity, constraints, and performance.

Postman Collection Generator

Automatically generates Postman v2.1 collections from your OpenAPI spec. Export and share with your team in seconds.

05

Review your report

Every test run produces a structured report with AI-generated remediation suggestions.

HTML Report

Interactive, shareable report with drill-down per endpoint and trend charts.

PDF Export

Executive-ready summary for stakeholders and compliance audits (SOC2, GDPR, PCI, HIPAA).

CSV / JSON

Machine-readable output for CI/CD pipeline integration and custom dashboards.

Configuration

The platform starts with zero configuration. All secrets are auto-generated on first boot. Use the .env file or the dashboard Settings panel to customise behaviour.

Optional add-on profiles

terminal — add-on profiles
# Performance monitoring (Grafana + InfluxDB)
docker compose --profile performance up -d
# Grafana: http://localhost:3000  (admin / qapaas)

# Security scanning sidecar (OWASP ZAP)
docker compose --profile security up -d

# Both add-ons together
docker compose --profile performance --profile security up -d

AI provider configuration

API keys for AI providers (OpenAI, Gemini, Claude, DeepSeek) can be configured in Settings → AI Provider from the dashboard. Keys are stored encrypted locally and never leave your network.

SAML 2.0 SSO (Enterprise)

QA-PaaS supports SAML 2.0 SSO with Okta, Azure AD, and ADFS alongside local email/password auth.

.env — SAML SSO
SAML_CALLBACK_URL=https://your-domain.com/api/auth/saml/callback

Usage & lifecycle commands

Common commands — windows
# View live logs
docker compose logs -f orchestrator

# Stop (data preserved in qapaas-data volume)
docker compose down

# Full reset — removes all data
docker compose down -v

# Upgrade to a new version
docker pull qapaas/qa-paas:8.8.4
docker compose up -d

# Restart the service
docker compose restart orchestrator

Upgrading to a new version

terminal
# Pull the latest image and restart
docker pull qapaas/qa-paas:8.8.4
docker compose up -d

# Or pin to a specific version in .env:
# PLATFORM_VERSION=8.8.4
# Then:
docker pull qapaas/qa-paas:8.8.4 && docker compose up -d

Upgrading a single engine (production stack)

terminal
# Upgrade only the DB engine without touching the rest
DB_ENGINE_VERSION=1.1.0 docker compose -f docker-compose.prod.yml up -d --no-deps db-engine

Rolling back

.env + terminal
# Edit .env:
PLATFORM_VERSION=1.0.0

# Then restart:
docker compose up -d

Troubleshooting

Container exits immediately after starting

Check the logs first:

terminal
docker compose logs orchestrator

Common causes: the data volume is not writable, or the provisioning key (PEK) was not provided. Ensure you followed the first‑boot instructions above.

terminal
# Ensure the volume is writable
docker compose down -v
docker compose up -d
Port 443 is already in use

Set a different host port in your .env file:

.env
HOST_PORT=8443

Then access the dashboard at https://localhost:8443.

docker pull fails with "manifest unknown"

The version tag does not exist in the registry. Reset to latest:

.env
# Edit .env:
PLATFORM_VERSION=latest
terminal
docker pull qapaas/qa-paas:8.8.4
Container keeps restarting in a loop
terminal
docker compose logs orchestrator

Check the log output for the specific error. Common causes: invalid configuration, missing dependencies, or a corrupted data volume.

docker: error during connect

Docker Desktop is not running. Start it from the Start menu (Windows) or Applications (macOS) and wait for the whale icon in the system tray to stop animating. On Linux, ensure the Docker daemon is running: sudo systemctl start docker

cosign verify fails

The image was not pulled from the official registry, or the tag was overwritten. Pull directly using the digest reference from VERIFY.md. Digest-based verification is more trustworthy than tag-based because image digests are immutable.

Out of disk space / Docker storage full
terminal
# Show Docker disk usage
docker system df

# Remove unused images, containers, and networks
docker system prune -af

# Remove unused volumes (WARNING: deletes data)
docker volume prune
Browser shows "Your connection is not private" warning

This is expected on first visit. The default TLS certificate is self-signed. Click Advanced → Proceed to localhost (Chrome) or Accept the Risk and Continue (Firefox). For production deployments, mount your own TLS certificate via a reverse proxy (nginx, Caddy, Traefik).

Security & supply chain

Hardened images

Non-root UID 1001, multi-stage builds, JS obfuscation, no shell in final layer, Trivy-scanned (zero unfixed HIGH/CRITICAL CVEs at publish time).

Dual-standard signing

Every image is signed with Cosign (Sigstore keyless OIDC) and Notation (Notary V2 / X.509). CycloneDX SBOM attached as a signed attestation.

Network isolation

Engine containers run on an internal: true bridge — they cannot reach the internet or the host. Only the orchestrator is reachable from outside.

SOC2 audit trail

Every action is logged with user, timestamp, and outcome in an immutable audit trail stored in local SQLite.

Resources

Docker Hub — all imagesGitHub Container RegistryImage signature guide (VERIFY.md)GitHub Actions pipelinePricing & license tiersContact support

Ready to get started?

Register for a free trial — no credit card required. You'll receive your license key instantly and can have QA-PaaS running within minutes.

Get Free Trial Talk to an engineer