Docker image published on OPSWAT Docker Hub
OPSWAT publish all official public docker images on Docker Hub:
opswat/metadefendericapsrv-<os-type>:<version>
The docker images are all bundled with the official release MetaDefender ICAP Server.
More information:
Pull from the OPSWAT Docker Hub repository
docker pull <repository>/metadefendericapsrv-<platform>[:<version>]<repository>- OPSWAT repository address<platform>- can becentos,debian<version>- desired Core version (optional, default islatest)
Example:
Run MetaDefender ICAP Server docker image
docker run -d [--name <container_name>] \ [-e "<env_var>=<value>"] \ [-v <ignition_folder>:<container_ignition_folder>] \ [-v <host_folder>:<container_folder>] \ [-u <user ID>] \ -p <rest_port>:8048 <image_name>[Parameter] Container Name
Argument: --name <container_name>
Description: Your container’s name
Example: --name mdicapsrv01
[Parameter] Init Details (Environmental Variables & Ignition File)
Argument: -v <ignition_folder>:<container_ignition_folder> -e "<env_var>=<value>"
Description:
You must configure MetaDefender ICAP Server(default local admin account, database connection etc.) before running MetaDefender Core docker image. It could be done via either one of following options ( do not use both options, otherwise the environmental variables will be ignored ):
- Using environmental variables (
-e) - Using ignition file (
-v)
Option 1:-e "<env_var>=<value>" - set an environmental variable to configure, each environmental variable need one -e argument
Available environmental variables:
| name | description | note |
|---|---|---|
| MD_USER | username to create the first admin user | |
| MD_PWD | password to create the first admin user | |
| MD_EMAIL | email to create the first admin user | |
| APIKEY | the API key will be assigned to the admin user for license auto deactivation and activation | |
| LICENSE_KEY | an license key for license auto activation | |
| REST_ADDRESS | REST binding address for MetaDefender ICAP Server's Nginx to be allowed | |
| REST_PORT | REST binding port for MetaDefender ICAP Server's Nginx to be allowed | |
| ICAP_ADDRESS | ICAP binding address for MetaDefender ICAP Server's Nginx to be allowed | |
| ICAP_PORT | ICAP binding port for MetaDefender ICAP Server's Nginx to be allowed | |
| ICAPS_PORT | ICAPS binding port for MetaDefender ICAP Server's Nginx to be allowed | |
| IGNITION_JSON | the ignition file settings, only JSON format is accepted | For example: IGNITION_JSON='{"user/name": "admin", "user/password": "admin", "user/email": "admin@local"}' |
| ICAP_CONF_JSON | MetaDefender ICAP Server configuration file settings, only JSON format is accepted | For example: ICAP_CONF_ JSON='{"global/restport": "8009", "logger/loglevel": "info"}' |
| ICAP_DATA_ PATH | a full path to folder (in the container) storing all writable data (engine data, logs, runtime data, etc.). |
|
| DATA_DIR | a full path of MetaDefender ICAP Server working data directory | Where ICAP store:
|
| IMPORT_CONF_FILE | A full path to the file containing the configuration | You need to mount the configuration file to container to use it |
| The
| |
| ICAP_TRUST_CERTS_PATH | A full path to the folder containing the certificate files used to verify MD-Core HTTPS server. | You need to mount the folder containing all certificate files you need to container to use it |
| A full path to the folder containing the certificate and private key files used to enable HTTPS. |
| |
| ICAPS_CERT_PATH | A full path to the folder containing the certificate and private key files used to enable ICAPS. |
|
| TEST_MD_ CORE_CONNECTION | Support options test MetaDefender Core connection when startup container
|
|
The priority for overriding configs is: single environmental variable < JSON environmental variable (IGNITION_JSON, ICAP_CONF_JSON)
For example, the following command will start a container with restport=8009
docker run -it --name mdicapsrv -p 8048:8009 \
-e REST_PORT=8010 \
-e IGNITION_JSON='{"user/name": "admin", "user/password": "admin", "user/email": "admin@local"}' \
-e ICAP_CONF_JSON='{"global/restport": "8009", "logger/loglevel": "info"}' \
-e ICAP_DATA_PATH=/home/icap_data_dir \
opswat/metadefendericapsrv-centos:4.13.0
Option 2:-v <ignition_folder>:<container_ignition_folder> - (optional) mounting the folder containing the ignition file to the container’s folder
<ignition_folder>- ignition folder path containing the ignition file<ignition_folder>/ometascan.conf<container_ignition_folder>container’s folder to be mounted to/opt/ometascan/core_data/opswat(by default)
Example:
Setup the first admin
- user = admin
- password = admin
- email = admin@local
- apikey = e276cc32f85b6bf312e7a47d6fc5d530f42e
Option 1 - using environmental variables
docker run -d --name icapsrv \ -e IGNITION_JSON='{"user/name": "admin", "user/password": "admin", "user/email": "admin@local", "user/apikey": "e276cc32f85b6bf312e7a47d6fc5d530f42e"}' \ -p 8048:8048 opswat/metadefendericapsrv-centos:4.13.0Option 2 - using the ignition file
mkdir /ignition_foldertouch /ignition_folder/mdicapsrv.conf# Create /ignition_folder/mdicapsrv.conf based on# https://docs.opswat.com/mdicap/installation/deployment-automation-supportecho "[user]" >> /ignition_folder/mdicapsrv.confecho "name = admin" >> /ignition_folder/mdicapsrv.confecho "password = admin" >> /ignition_folder/mdicapsrv.confecho "email = admin@local" >> /ignition_folder/mdicapsrv.confecho "apikey = e276cc32f85b6bf312e7a47d6fc5d530f42e" >> /ignition_folder/mdicapsrv.conf docker run -d --name icap \ -v /ignition_folder:/opt/mdicapsrv/icap_data/opswat \ -p 8048:8048 \ opswat/metadefendericapsrv-centos:4.13.0Volumes
| Name | Detail | Default |
|---|---|---|
| OS_CERTS_STORE_PATH | Where OS use for store the certificates Needed when read-only file system or non-root privileges | CentOS
Debian
|
| OS_CERTS_INSTALL_PATH | Where OS read the certificates to install Needed when read-only file system or non-root privileges | CentOS
Debian
|
| SYSTEM_DIR | Temp system path for ICAP Server running | /opt/mdicapsrv/system |
| ICAP_DATA_PATH | A full path to the folder (in the container) storing all writable data (engine data, logs, runtime data, etc.). | /opt/mdicapsrv/icap_data |
| PW_PATH | Store users and groups to which users belong under Linux and UNIX operating system (/etc/group, /etc/passwd) | /mdicapsrv/pw |
