Skip to main content
EditionDeployment Type
EnterpriseSelf-Managed, Hybrid
Tyk distributes all components as OCI-compatible container images, which means they run unchanged on any OCI-compliant runtime: Docker Engine, containerd, CRI-O, or Podman. You do not need to rebuild images when moving between runtimes or cloud providers. Since Kubernetes v1.24 removed the dockershim compatibility layer, managed Kubernetes services (EKS, GKE, AKS, OpenShift) use containerd or CRI-O directly. Docker is no longer required or present by default on Kubernetes nodes. Tyk’s Helm-based installations work on all of these out of the box.

​
Supported runtimes

The table below shows the default container runtime for each major provider.
ProviderDefault runtimeNotes
AWS EKScontainerdDefault since dockershim removal; all Linux and Windows node groups
Google GKEcontainerdDefault since GKE 1.19; Docker deprecated by 1.24
Azure AKScontainerdLinux nodes ≥ 1.19; Windows nodes ≥ 1.23 (only option)
Red Hat OpenShiftCRI-OIncludes ROSA; uses CRI-O with runc/crun
Rancher (RKE2/K3s)containerdDefault for all cluster types
VMware TanzucontainerdDefault for all cluster types
DigitalOcean KubernetescontainerdDefault since Kubernetes 1.20
IBM Cloud Kubernetes ServicecontainerdDefault on all managed node pools
To check the container runtime on your cluster nodes: 
kubectl get node -o jsonpath='{range .items[*]}{.metadata.name}{"  "}{.status.nodeInfo.containerRuntimeVersion}{"\n"}{end}'

​
Running Tyk locally

​
Docker

Docker is the fastest way to try Tyk on a laptop or VM. Tyk’s quick starts and demo repositories use Docker Compose by default. See the Docker installation guide for step-by-step instructions.

​
Podman (RHEL 8+)

RHEL 8 ships Podman instead of Docker. Podman is daemonless, rootless-friendly, and uses the same CLI syntax as Docker. Tyk images run on Podman without modification. Running Tyk Gateway with Podman (rootless): 
podman run -d --name tyk-gateway \
  -p 8080:8080 \
  -v $PWD/tyk.standalone.conf:/opt/tyk-gateway/tyk.conf:Z \
  tykio/tyk-gateway:latest
The :Z suffix is required on SELinux-enabled systems (RHEL, Fedora) to relabel the bind-mounted volume so the container can access it. Alias Podman as Docker (optional): If your scripts call docker, you can alias Podman: 
alias docker=podman

​
Docker Compose and Podman Compose

Tyk’s demo repositories use standard compose.yaml files that work with both Docker Compose and Podman Compose. 
# Minimal example: Gateway + Redis
services:
  redis:
    image: redis:7-alpine
  gateway:
    image: tykio/tyk-gateway:latest
    ports: ["8080:8080"]
    volumes:
      - ./tyk.standalone.conf:/opt/tyk-gateway/tyk.conf:ro
    depends_on: [redis]

# Docker
docker compose up -d

# Podman
podman compose up -d

​
Running Tyk in Kubernetes

Use Tyk’s Helm charts for production Kubernetes deployments. The charts work across EKS, GKE, AKS, OpenShift (CRI-O), Rancher, and VMware Tanzu without modification. 
helm repo add tyk-helm https://helm.tyk.io/public/helm/charts/
helm repo update
helm install tyk tyk-helm/tyk-stack -n tyk --create-namespace -f values.yaml
For full installation instructions, see the Tyk Self-Managed Kubernetes guide or the Tyk Stack Helm Chart reference.

​
Building images

Both docker build and podman build produce OCI-compliant images that run on containerd, CRI-O, or Docker Engine without modification. 
# Build with Docker
docker build -t your-registry/tyk-gateway:TAG .

# Build with Podman (RHEL 8+)
podman build -t your-registry/tyk-gateway:TAG .
OCI images are supported by all major registries (ECR, ACR, Google Artifact Registry, Docker Hub). For production, pin images by digest rather than by tag for reproducible deployments.

​
FAQ

No. Docker-built images are OCI images and run unchanged on containerd and CRI-O.
Functionally, no. Images are identical. On RHEL, apply SELinux volume labels (:Z / :z) to bind mounts and be aware of rootless defaults.
Yes. Use podman compose or point Docker Compose at Podman’s Docker-compatible socket. See the Podman documentation for details.
Run the kubectl one-liner in the Supported runtimes section above.