Skip to content

System Requirements

When launched from a cloud marketplace, Philter is pre-configured and contains all required dependencies. It stores its data with SQLite, on the virtual machine's disk.

Philter requires the following:

  • 2 vCPU (e.g., m5.large instance type on AWS)
  • 8 GB of RAM
  • Java 25
  • Storage: nothing to install for SQLite, the default, which keeps Philter's data in a file for a single instance; or MongoDB, which several instances can share (see Database for the version to use)
  • Valkey (optional; if not configured, Philter uses an in-memory cache that is not shared across instances and is lost on restart)

Philter also requires an encryption key to be configured via the PHILTER_ENCRYPTION_KEY environment variable; see Settings. On a fresh install it requires PHILTER_BOOTSTRAP_API_KEY, which it needs until the admin user has had an API key; see API Access. Metrics are exposed for Prometheus and require no additional dependency.

Memory

A local PhEye model is held in native memory, outside the JVM heap, once a policy that names it is first used. The default policy's model, ph-eye-pii-en-small, brought Philter's container to about 1.5 GB in total when loaded and in use. When choosing a container memory limit, leave room for that beside the heap: the Docker image's heap setting below takes 75% of the limit for the heap alone.

PDF redaction renders each page it redacts to an image in memory, so memory use grows with how many PDFs are redacted at once. At the default limits, allow about 500 MB of heap for each PDF in PDF_MAX_CONCURRENT (2 by default), on top of what Philter otherwise uses. The Docker image gives the JVM 75% of the container's memory for its heap (-XX:MaxRAMPercentage=75); when running the jar directly, set -Xmx or -XX:MaxRAMPercentage, since the JVM otherwise takes only a quarter.

Philter refuses PDFs that exceed its PDF limits before rendering them, but a PDF built to exhaust memory can still find a case the limits do not cover. Run Philter with a container memory limit and a restart policy, so such a document stops one instance rather than the host, and send PDFs from untrusted sources asynchronously, where they are redacted one at a time.

Supported Operating Systems

Philter is designed to run on Linux-based systems. It has been tested and is known to work on Ubuntu, CentOS, and Amazon Linux. Other Linux distributions may also work but are not officially supported.