How long does standing up a CA take — a quarter, a project team, a vendor engagement? With goca the honest number is about fifteen minutes, and at the end of it you have more than a login page: a running system, an admin account that is actually yours, a real CA hierarchy with a test certificate issued, and a verified audit chain. The claims of the last seven frames stop being claims here. This section walks that quarter hour frame by frame; the site's quickstart pages carry the full command lists.
Two routes ship today. Docker Compose is the fast one and the only supported way to run the local bundle — prerequisites are Docker with Compose v2, about 1 GB of disk, and nothing else; no external services, no internet after the image build:
cd goca # the evaluation bundle from the download you received docker compose up --build
That starts goca-db (PostgreSQL 16) and goca — the entire CA in one process — with a short-lived third container applying the schema first. When the log shows starting role api-admin (management plane) on :8081, the system is up and the console is at https://127.0.0.1:8085. On Windows, the same bundle runs unchanged under Docker Desktop — the Windows quickstart covers it. The second route, for a longer-lived lab, is the Linux standalone binary: one binary you build yourself plus a PostgreSQL you provide; the Linux quickstart has that path.
And the worry that keeps people from typing that command — "a CA means an evening of workload identities, attestation, and mTLS before anything works" — does not apply here. That machinery exists, but its enforcement is opt-in and off by default: the shipped bundle's defaults run with none of it configured, and the TLS the console needs is issued by goca itself, usually within a second of the database coming up. Only two things are mandatory even on a laptop: the admin enrolls an offline authenticator code at first sign-in (frame 10 — it takes a minute), and a master secret must exist — the compose file pre-sets a development value, so there is nothing to type yet, and frame 12 explains why that value must not outlive your evaluation.
Now I can pick an install route and bring up goca from nothing — without touching the production security machinery first.