Self-host OpenSearch

copy# OpenSearch — search and analytics engine with OpenSearch Dashboards — based on the sample docker-compose.yml in the OpenSearch Docker install docs, reduced to one node, pinned to 3.9.0
# the demo security config rejects admin passwords without upper, lower, digit and special characters or a weak zxcvbn score: the Aa1- prefix covers the classes, the random hex the strength
echo "OPENSEARCH_INITIAL_ADMIN_PASSWORD=Aa1-$(openssl rand -hex 16)" > .env
# OpenSearch refuses to start on the kernel default vm.max_map_count; upstream requires at least 262144 (persist it in /etc/sysctl.conf to survive a reboot)
sudo sysctl -w vm.max_map_count=262144
cat > docker-compose.yml <<'EOF'
services:
  opensearch:
    image: opensearchproject/opensearch:3.9.0
    restart: unless-stopped
    environment:
      - cluster.name=opensearch-cluster
      - node.name=opensearch
      - discovery.type=single-node
      - bootstrap.memory_lock=true
      - "OPENSEARCH_JAVA_OPTS=-Xms1g -Xmx1g"
      - OPENSEARCH_INITIAL_ADMIN_PASSWORD=${OPENSEARCH_INITIAL_ADMIN_PASSWORD}
    ulimits:
      memlock:
        soft: -1
        hard: -1
      nofile:
        soft: 65536
        hard: 65536
    volumes:
      - opensearch_data:/usr/share/opensearch/data
    ports:
      - 9200:9200
      - 9600:9600
  opensearch-dashboards:
    image: opensearchproject/opensearch-dashboards:3.9.0
    restart: unless-stopped
    environment:
      OPENSEARCH_HOSTS: '["https://opensearch:9200"]'
    ports:
      - 5601:5601
    depends_on:
      - opensearch
volumes:
  opensearch_data:
EOF
docker compose up -d
# Dashboards answers 503 until the node is up and the demo security config has been installed
timeout 300 bash -c 'until curl -s -o /dev/null -w "%{http_code}" http://localhost:5601/ | grep -q "^[23]"; do sleep 5; done'
# → http://SERVER_IP:5601 — sign in as admin with the password in .env; the OpenSearch API itself is HTTPS on 9200 behind a self-signed demo certificate (curl -k)