Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docs/concepts/pdp/nexus-pdp-configuration.mdx
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
---
title: Nexus PDP configuration reference
sidebar_label: Configuration
description: "Look up the environment variables that configure Permit Nexus PDP (permitio/pdp-v3): credentials, storage, ports, logging, and storage-engine tuning."
description: "Look up the environment variables that configure Permit Nexus PDP (permitio/nexus-pdp): credentials, storage, ports, logging, and storage-engine tuning."
sidebar_position: 6
---

This reference lists the environment variables that configure Permit Nexus PDP (`permitio/pdp-v3`), a self-hosted policy decision point (PDP). It is for operators who deploy and tune Nexus PDP. The only required variable is `PDP_API_KEY`. For deployment requirements such as volumes, probes, and memory, see [Deploy Nexus PDP](/concepts/pdp/nexus-pdp-deployment).
This reference lists the environment variables that configure Permit Nexus PDP (`permitio/nexus-pdp`), a self-hosted policy decision point (PDP). It is for operators who deploy and tune Nexus PDP. The only required variable is `PDP_API_KEY`. For deployment requirements such as volumes, probes, and memory, see [Deploy Nexus PDP](/concepts/pdp/nexus-pdp-deployment).

:::caution Nexus PDP configuration can change between early-access releases
As of September 2026, Nexus PDP is in early access. Permit can rename, replace, or remove the variables and defaults on this page before general availability. Pin the Nexus PDP image to a specific tag, and check this page when you upgrade. If you depend on a specific variable, tell Permit support at [support@permit.io](mailto:support@permit.io).
Expand Down
10 changes: 5 additions & 5 deletions docs/concepts/pdp/nexus-pdp-deployment.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ description: "Run Permit Nexus PDP with Docker or Kubernetes, meet its storage,
sidebar_position: 5
---

Run Permit Nexus PDP (`permitio/pdp-v3`), a self-hosted policy decision point (PDP), with Docker or on Kubernetes, and verify that it answers permission checks. This page lists the storage, memory, port, probe, and shutdown requirements, gives a runnable command and a pod spec, and covers the Nexus PDP logs and security properties an operator needs. For what Nexus PDP is, see [Permit Nexus PDP](/concepts/pdp/nexus-pdp).
Run Permit Nexus PDP (`permitio/nexus-pdp`), a self-hosted policy decision point (PDP), with Docker or on Kubernetes, and verify that it answers permission checks. This page lists the storage, memory, port, probe, and shutdown requirements, gives a runnable command and a pod spec, and covers the Nexus PDP logs and security properties an operator needs. For what Nexus PDP is, see [Permit Nexus PDP](/concepts/pdp/nexus-pdp).

## Prerequisites

Expand All @@ -19,7 +19,7 @@ Nexus PDP has operational requirements that the container PDP (the Edge PDP imag

| Requirement | Setting | What happens if you skip it |
| --- | --- | --- |
| Image | `permitio/pdp-v3`, pinned to a specific tag | An unpinned image can pull a release with renamed configuration variables. See [Nexus PDP configuration reference](/concepts/pdp/nexus-pdp-configuration). |
| Image | `permitio/nexus-pdp`, pinned to a specific tag | An unpinned image can pull a release with renamed configuration variables. See [Nexus PDP configuration reference](/concepts/pdp/nexus-pdp-configuration). |
| One container per environment | Set `PDP_API_KEY` to the API key of one Permit environment | Nexus PDP has no multi-environment mode. The API key binds the container to exactly one environment. |
| Persistent storage | Mount a persistent volume at `/var/lib/edge-pdp`, which holds the embedded database and the event store at default paths | On ephemeral storage, every restart runs a full cold start with a snapshot transfer of your whole data set. |
| Memory | 4 GiB to start | At default storage-engine settings, a container with a few hundred MiB is killed for running out of memory (OOM) at startup. See [Nexus PDP resource footprint](/concepts/pdp/nexus-pdp-how-it-works#resource-footprint). |
Expand All @@ -32,15 +32,15 @@ Nexus PDP has operational requirements that the container PDP (the Edge PDP imag

## Run Nexus PDP with Docker

Replace `<tag>` with a specific `permitio/pdp-v3` release tag, and set `PERMIT_API_KEY` in your shell to the API key of the environment this container serves. The command maps the authorization API to host port `7766`, keeps the health port on `7001`, and stores the embedded database in the named volume `nexus-data`:
Replace `<tag>` with a specific `permitio/nexus-pdp` release tag, and set `PERMIT_API_KEY` in your shell to the API key of the environment this container serves. The command maps the authorization API to host port `7766`, keeps the health port on `7001`, and stores the embedded database in the named volume `nexus-data`:

```bash
docker run -d --name nexus-pdp \
-p 7766:7000 -p 7001:7001 \
-e PDP_API_KEY="$PERMIT_API_KEY" \
-v nexus-data:/var/lib/edge-pdp \
--memory 4g \
permitio/pdp-v3:<tag>
permitio/nexus-pdp:<tag>
```

## Kubernetes pod settings for Nexus PDP
Expand All @@ -53,7 +53,7 @@ securityContext:
fsGroup: 10001
containers:
- name: nexus-pdp
image: permitio/pdp-v3:<tag>
image: permitio/nexus-pdp:<tag>
ports:
- containerPort: 7000 # authorization API
- containerPort: 7001 # health
Expand Down
4 changes: 2 additions & 2 deletions docs/concepts/pdp/nexus-pdp-feature-parity.mdx
Original file line number Diff line number Diff line change
@@ -1,11 +1,11 @@
---
title: Nexus PDP feature parity
sidebar_label: Feature Parity
description: "Compare the endpoints and capabilities of the container PDP (permitio/pdp-v2) and Permit Nexus PDP (permitio/pdp-v3) before you choose one."
description: "Compare the endpoints and capabilities of the container PDP (permitio/pdp-v2) and Permit Nexus PDP (permitio/nexus-pdp) before you choose one."
sidebar_position: 4
---

Use this page to check whether Permit Nexus PDP, a self-hosted policy decision point (PDP), supports the endpoints and capabilities your application uses before you choose Nexus PDP or move to it. The page compares Nexus PDP (`permitio/pdp-v3`) with the [container PDP](/concepts/pdp/overview#run-an-edge-pdp-with-docker), the Edge PDP image `permitio/pdp-v2`.
Use this page to check whether Permit Nexus PDP, a self-hosted policy decision point (PDP), supports the endpoints and capabilities your application uses before you choose Nexus PDP or move to it. The page compares Nexus PDP (`permitio/nexus-pdp`) with the [container PDP](/concepts/pdp/overview#run-an-edge-pdp-with-docker), the Edge PDP image `permitio/pdp-v2`.

:::info Nexus PDP support changes between releases
This comparison describes Nexus PDP as of September 2026, during early access. The set of supported capabilities changes between releases, so check this page before you upgrade.
Expand Down
4 changes: 2 additions & 2 deletions docs/concepts/pdp/nexus-pdp-how-it-works.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ A Nexus PDP that restarts with a backlog of changes becomes ready and serves req

Nexus PDP delivers a change to the PDP in fewer steps than the container PDP:

| | Container PDP (`pdp-v2`) | Nexus PDP (`pdp-v3`) |
| | Container PDP (`pdp-v2`) | Nexus PDP (`nexus-pdp`) |
| --- | --- | --- |
| Change notification | WebSocket notification | Push delivery on a durable subscription for each PDP |
| Data fetch | A second request to the Permit API | None. The message contains the change. |
Expand Down Expand Up @@ -117,7 +117,7 @@ Permit has not published measured throughput for Nexus PDP. The [Cloud PDP bench

Nexus PDP stores authorization data in a different place than the container PDP, which changes how you size the container.

| | Container PDP (`pdp-v2`) | Nexus PDP (`pdp-v3`) |
| | Container PDP (`pdp-v2`) | Nexus PDP (`nexus-pdp`) |
| --- | --- | --- |
| Authorization data | In OPA's in-memory document | On disk, in an embedded database |
| Memory as data grows | Grows with your data set | Limited by a cache size you configure |
Expand Down
2 changes: 1 addition & 1 deletion docs/concepts/pdp/nexus-pdp.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ import ProductOverviewLink from "@site/src/components/ProductOverviewLink";

Permit Nexus PDP is a self-hosted policy decision point (PDP) that keeps your environment's policy and authorization data in an embedded on-disk database. This page is for architects and platform engineers who decide whether to run Nexus PDP instead of, or next to, the container PDP.

Nexus PDP ships as the `permitio/pdp-v3` container image. You run one Nexus PDP container per Permit environment in your own network. Nexus PDP answers each authorization query from its local copy of the data, so no hop in the decision path leaves the container.
Nexus PDP ships as the `permitio/nexus-pdp` container image. You run one Nexus PDP container per Permit environment in your own network. Nexus PDP answers each authorization query from its local copy of the data, so no hop in the decision path leaves the container.

:::note Early access and relationship to the container PDP
Nexus PDP is an additional deployment option. It does not replace the container PDP (`permitio/pdp-v2`), which remains supported and is the PDP to use for the capabilities listed as unsupported in [Nexus PDP feature parity](/concepts/pdp/nexus-pdp-feature-parity).
Expand Down
2 changes: 1 addition & 1 deletion docs/concepts/pdp/overview.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ Permit offers three PDP types. All three answer the same permission checks for t
| --- | --- | --- |
| **Managed Cloud PDP** | Hosted by Permit at `https://cloudpdp.api.permit.io` | Fast onboarding and production role-based access control (RBAC) or relationship-based access control (ReBAC) without running infrastructure |
| **Edge PDP** (container PDP, `permitio/pdp-v2`) | Your VPC, Kubernetes cluster, or VMs, as a sidecar, a centralized service, or a cluster | Attribute-based access control (ABAC), custom data sources, read-your-own-writes, PDP-level callbacks and health checks, or low latency inside your own network |
| **Permit Nexus PDP** (`permitio/pdp-v3`) | Your network, one container per Permit environment | Large data sets, relationship-heavy ReBAC, and decisions that never depend on reaching Permit |
| **Permit Nexus PDP** (`permitio/nexus-pdp`) | Your network, one container per Permit environment | Large data sets, relationship-heavy ReBAC, and decisions that never depend on reaching Permit |

Most teams start with the managed Cloud PDP, then add Edge PDPs for latency-sensitive workloads or for capabilities the Cloud PDP does not support.

Expand Down
Loading