Docker image published on OPSWAT Docker Hub

ACCEPT_EULA

Set the ACCEPT_EULA variable to any value to confirm your acceptance of the End-User Licensing Agreement

Default value is false. Must set true this ENV to start container.

MD_USER

Username to create the first admin user

MD_PWD

Password to create the first admin user

MD_EMAIL

Email to create the first admin user

APIKEY

The API key will be assigned to the admin user for license auto deactivation and activation

LICENSE_KEY

An license key for license auto activation

REST_ADDRESS

REST binding address for MetaDefender ICAP Server's Nginx to be allowed

REST_PORT

REST binding port for MetaDefender ICAP Server's Nginx to be allowed

ICAP_ADDRESS

ICAP binding address for MetaDefender ICAP Server's Nginx to be allowed

ICAP_PORT

ICAP binding port for MetaDefender ICAP Server's Nginx to be allowed

ICAPS_PORT

ICAPS binding port for MetaDefender ICAP Server's Nginx to be allowed

ICAP_CONF_JSON

MetaDefender ICAP Server configuration file settings, only JSON format is accepted

For example: ICAP_CONF_ JSON='{"global/restport": "8009", "logger/loglevel": "info"}'

ICAP_DATA_ PATH

a full path to folder (in the container) storing all writable data (engine data, logs, runtime data, etc.).

• Default is /opt/mdicapsrv/icap_data

• Make sure to mount a volume to this folder to run with the policy

DATA_DIR

a full path of MetaDefender ICAP Server working data directory

Where ICAP store:

• LDAP Cert

• Custom Block Page File Path

IMPORT_CONF_FILE

A full path to the file containing the configuration

You need to mount the configuration file to container to use it

ICAP_TRUST_CERTS_PATH

A full path to the folder containing the certificate files used to verify MD-Core HTTPS server.

You need to mount the folder containing all certificate files you need to container to use it

HTTPS_CERT_PATH

A full path to the folder containing the certificate and private key files used to enable HTTPS.

These files must have the same filename meanwhile their extensions must be .crt and .key

After being added, the filename without extension will be the name of the certificate in MetaDefender ICAP Server

ICAPS_CERT_PATH

A full path to the folder containing the certificate and private key files used to enable ICAPS.

These files must have the same filename meanwhile their extensions must be .crt and .key

After being added, the filename without extension will be the name of the certificate in MetaDefender ICAP Server

NGINX_CERT_PATH

A full path to the folder containing the certificate and private key files used to enable NGINX Secured Communication.

Supported since MD ICAP Server v5.1.0

TEST_MD_CORE_CONNECTION

Support options test MD Core connection when startup container

• Retry 3 times after the first test failed, 10s delay each time

• Exit container when all tests failed

• true to enable

• false to disable

• default is false

AUDIT_DATA_RETENTION

Set time of audit data retention

Default is 168 hours (7 days)

HISTORY_DATA_RETENTION

Set time of history data retention

Default is 168 hours (7 days)

IGNITION_JSON

The ignition file settings, only JSON format is accepted

For example: IGNITION_JSON='{"user/name": "admin", "user/password": "admin", "user/email": "admin@local"}'

• or for enable NGINX integration (supported since MD ICAP Server v5.1.0)

JSON='{"user/name": "admin", "user/password": "admin", "user/email": "admin@local", "nginxsupport/enabled": "true", "nginxsupport/port": "8043", "nginxsupport/ports": "8443"}'

• Or setup PostgreSQL database - (supported since MD ICAP Server v5.2.0)

IGNITION_JSON={"dbserver/private_username": "internal_user", "dbserver/private_password": "internal_user_password"}

IMPORT_CONFIG_FILE_PASS

Password for unzip file import config file. If you use the JSON file, you can let it empty

supported since MD ICAP Server v5.1.0

NGINX_PORT

NGINX Communication port

8043

NGINXS_PORT

NGINX Communication SSL/TLS

8443

IMPORT_CONF_FILE_TARGET

• List of import target for IMPORT_CONF_FILE.

  • all : Import all target

  • schema : Configuration for Security rules

  • servers : Configuration for Server profiles

  • global : Configuration for Global setting

  • history : Configuration for ICAP history

  • auditlog : Configuration for Config history

  • session : Configuration for Security -> Session

  • password-policy : Configuration for Password policy

  • certs : Configuration for Certificates. Notes: Make sure the path in the config file is valid in the container (unsupported this from MD ICAP Server v5.2.0)

  • ssl : Configuration for Security. It is used to enable/disable HTTPS/ICAPS/NGINXS (unsupported this from MD ICAP Server v5.2.0)

  • user-management : Configuration for User management

  • email: Configuration for Email Server

  • nginx: Configuration for NGINX Communication

The all, user-management target will override HTTPS_CERT_PATH, ICAPS_CERT_PATH, NGINX_CERT_PATH, MD_USER, MD_PWD, MD_EMAIL only use it if you know what are you doing. e.g:

IMPORT_CONF_FILE_TARGET='["servers", "schema"]'

HTTPS_SSL_PROTOCOLS

The version of the TLS for HTTPS

Default value is "TLSv1.3" from MD ICAP Server v5.2.0 (previous default is TLS v1.2)

ICAPS_SSL_PROTOCOLS

The version of the TLS for ICAPS

Default value is "TLSv1.3" from MD ICAP Server v5.2.0 (previous default is TLS v1.2)

NGINXS_SSL_PROTOCOLS

The version of the TLS for NGINX Communication

Default value is "TLSv1.3" from MD ICAP Server v5.2.0 (previous default is TLS v1.2)

ENABLE_HEALTHCHECK

The feature support for service MD ICAP Server run on Kubernetes

Default value is “true”

• Supported since MD ICAP Server 5.2.0

ALLOW_CROSS_IP_SESSIONS

Allow requests coming from sources different from the authenticated origin.

Default value is “true”

• Supported since MD ICAP Server 5.2.0

OLMS_HOST_URL

Define the host url of the OPSWAT On Prem Licensing Management Server

Default value is ““

• Supported since MD ICAP Server 5.2.0

OLMS_REST_PORT

Default REST port for the OLMS service

Default value is “8040”

• Supported since MD ICAP Server 5.2.0

OLMS_RULE

Default rule for active license on the On-Prem License Manager Server

Default value is ““

• Used for On-prime license manager

• Supported since MD ICAP Server 5.2.0

OLMS_COMMENT

Set the comment for the On-Prem License Manager Server

Default value is ““

• Supported since MD ICAP Server 5.2.0

ENABLE_NGINX

Enable nginx communication with the variable environment

Default value is “false”

• Supported since MD ICAP Server 5.2.0

DB_MODE

Database mode

Required

DB_TYPE

Database type

Required

DB_HOST

Database host

Required

DB_PORT

Database port

Required

DB_USER

Database user

Required

DB_PWD

Database password

Required

MDICAPSRV_INSTANCE_NAME

Instance name

Optional

OS_CERTS_STORE_PATH

Where OS use for store the certificates

Needed when read-only file system or non-root privileges

CentOS

/etc/pki/ca-trust

Debian

/etc/ssl/certs

OS_CERTS_INSTALL_PATH

Where OS read the certificates to install

Needed when read-only file system or non-root privileges

CentOS

/etc/pki/ca-trust/source/anchors/

Debian

/usr/local/share/ca-certificates/

SYSTEM_DIR

Temp system path for ICAP Server running

/opt/mdicapsrv/system

ICAP_DATA_PATH

A full path to the folder (in the container) storing all writable data (engine data, logs, runtime data, etc.).

/opt/mdicapsrv/icap_data

PW_PATH

Store users and groups to which users belong under Linux and UNIX operating system (/etc/group, /etc/passwd)

/mdicapsrv/pw