influxdb Documentation

Scalable datastore for metrics, events, and real-time analytics

31,689 stars Rust Rust 1 file · ~30,339 tokens #database#go#influxdb#metrics#monitoring#react#rust#time-series
RAW Doc

Docker & Self-Hosted Deployment Verified OCI

Deploy influxdb on any server, homelab, or cloud container platform.

1-Click Terminal Command
bash (docker run) 
docker run -d --name influxdb --restart always influxdata/influxdb:latest

1. Project Overview & Quickstart (influxdata/influxdb)

File: README.md

InfluxDB 3 Core

InfluxDB 3 Core is a database built to collect, process, transform, and store event and time series data. It is ideal for use cases that require real-time ingest and fast query response times to build user interfaces, monitoring, and automation solutions.

Common use cases include:

  • Monitoring sensor data
  • Server monitoring
  • Application performance monitoring
  • Network monitoring
  • Financial market and trading analytics
  • Behavioral analytics

InfluxDB is optimized for scenarios where near real-time data monitoring is essential and queries
need to return quickly to support user experiences such as dashboards and interactive user interfaces.

InfluxDB 3 Core’s feature highlights include:

  • Diskless architecture with object storage support (or local disk with no dependencies)
  • Fast query response times (under 10ms for last-value queries, or 30ms for distinct metadata)
  • Embedded Python VM for plugins and triggers
  • Parquet file persistence
  • Compatibility with InfluxDB 1.x and 2.x write APIs
  • Compatibility with InfluxDB 1.x query API (InfluxQL)
  • SQL query engine with support for FlightSQL and HTTP query API

Storage format: Apache Parquet on object storage (S3, Azure, GCP) or local disk
Query languages: SQL, InfluxQL, Flight SQL
Write format: Line protocol
API: HTTP on port 8181
Built with: Rust, Apache Arrow, DataFusion
Compatible with: InfluxDB 1.x and 2.x write APIs, InfluxDB 1.x query API (InfluxQL)

Other InfluxDB Versions

This repository contains multiple InfluxDB versions on separate branches:

Version Branch Query Languages Documentation
v3 Core (this branch) main SQL, InfluxQL docs.influxdata.com/influxdb3/core/
v2.x main-2.x Flux, InfluxQL docs.influxdata.com/influxdb/v2/
v1.x master-1.x InfluxQL, Flux docs.influxdata.com/influxdb/v1/

Project Status

InfluxDB 3 Core has been generally available since April 2025. See v3.* tags and release notes for the latest version.

Join the InfluxDB3 Discord or the public channels below to share your feedback, feature requests, and bug reports.

Installation

Docker images, Debian packages, RPM packages, and tarballs are available on the InfluxData downloads page.

If you are interested in building from source, see the building from source guide for contributors.

Support

For community support and feedback channels, see Bug reports and feedback.

License

The open source software we build is licensed under the permissive MIT or Apache 2 licenses at the user’s choosing. We’ve long held the view that our open source code should be truly open and our commercial code should be separate and closed.

Interested in joining the team building InfluxDB?

Check out current job openings at www.influxdata.com/careers today!

File: influxdb3_load_generator/analysis/README.md

Load Generator Analysis

This directory contains a lightweight Flask app to compare two runs of the load generator. The app is designed to be run locally and is not intended for production use.

Setup

Make sure you have python and flask installed. You can install flask by running:

bash
pip install flask

Running the app

To run the app, navigate to the analysis directory and run:

bash
python app.py

Then open your browser to http://127.0.0.1:5000/ to view the app.

File: README_processing_engine.md

The InfluxDB 3 Processing engine is an embedded Python VM for running code
inside the database to process and transform data. This document discusses how
the processing engine is built within InfluxDB. For usage instructions, see:
https://docs.influxdata.com/influxdb3/core/

See the 'Discussion' section for more information on why the processing engine
is implemented the way it is.

Implementation

InfluxDB uses the PYO3 crate to build InfluxDB
with an embedded python and the processing engine is enabled by default.

PYO3 will then inspect the system to find a python runtime to build and link
against. The resulting influxdb3 binary will be dynamically linked to the
libpython that PYO3 found during the build. Eg, on a typical Debian or Ubuntu
system, if you install the following, then InfluxDB can be built against the
system's python:

sh
# build dependencies
$ sudo apt-get install build-essential pkg-config libssl-dev clang lld \
    git protobuf-compiler python3 python3-dev python3-pip

# runtime dependencies
$ sudo apt-get install python3 python3-pip python3-venv

# build
$ cargo build

The choice of python can be influenced by setting the PYTHONHOME environment
variable for cargo build or creating a PYO3_CONFIG_FILE file for more
specialized setups (such as 'Official builds', below). For details, see
https://pyo3.rs/main/building-and-distribution.html

In order for InfluxDB to successfully use the python it was built against, the
same libpython version as well as the full runtime environment of the python
install (ie, its standard library) must be available to InfluxDB in a location
that it can find it. Building against the system python can be a reasonable
choice for users who target their builds to a specific release of an OS as
InfluxDB will simply use the installed python from the system.

Official builds

To provide a consistent, robust and maintained python environment for InfluxDB
that is portable across a range of operating systems, InfluxData's official
InfluxDB is built against a pre-built release of
python-build-standalone (a
CPython standalone python distribution). For a given release of InfluxDB,
official builds will use the same version of python for all install methods and
operating systems.

The following operating systems and architectures are currently supported:

  • Linux amd64/arm64 (tar.gz, deb and rpm)
  • Darwin arm64 (tar.gz)
  • Windows amd64 (zip)
  • Docker (Linux amd64/arm64)

Due to constraints with python-build-standalone and statically linking, all
builds are dynamically linked to python-build-standalone's libpython as
well as a few OS-specific libraries. Specifically:

  • Linux (seen with ldd and strings on the binary):
    • python-build-standalone is linked against glibc and is compatible with
      glibc 2.17+
    • influxdb3 is linked against libpython from python-build-standalone as
      well as glibc (official builds target glibc 2.23+)
  • Darwin (seen with otool -L; cross-compiled with osxcross):
    • python-build-standalone is linked against:
      • CoreFoundation.framework/Versions/A/CoreFoundation compatibility
        version 150.0.0
      • libSystem.B.dylib compatibility version 1.0.0
    • influxdb3 is linked against:
      • CoreFoundation.framework/Versions/A/CoreFoundation compatibility
        version 150.0.0
      • IOKit.framework/Versions/A/IOKit compatibility version 1.0.0
      • libiconv.2.dylib compatibility version 7.0.0
      • libobjc.A.dylib compatibility version 1.0.0
      • libSystem.B.dylib compatibility version 1.0.0
      • Security.framework/Versions/A/Security compatibility version 1.0.0
      • SystemConfiguration.framework/Versions/A/SystemConfiguration
        compatibility version 1.0.0
  • Windows (seen with dumpbin /HEADERS ... and dumpbin /DEPENDENTS ...):
    • python-build-standalone claims Windows 8/Windows Server 2012 or newer. Specifically, it has:
      • 14.42 linker version
      • 6.00 operating system version
      • 6.00 subsystem version
    • influxdb3 has:
      • 2.40 linker version
      • 4.00 operating system version
      • 5.02 subsystem version

At a high level, the build process for Official builds consists of:

  1. downloading an appropriate build of python-build-standalone for the
    target OS and architecture from https://github.com/astral-sh/python-build-standalone/releases

  2. unpacking the python-build-standalone build on disk

  3. creating a pyo3 build configuration file to point to the unpacked
    directory and setting the PYO3_CONFIG_FILE environment variable to point
    to it. Eg (on Linux):

    text
    implementation=CPython
version=3.13
shared=true
abi3=false
lib_name=python3.13
lib_dir=/path/to/python-standalone/python/lib
executable=/path/to/python-standalone/python/bin/python3.13
pointer_width=64
build_flags=
suppress_build_script_link_lines=false

    PYO3 will try to auto-detect the location which can work well with a system
    python, but not with an unpacked python-build-standalone. While the
    PYO3_PYTHON environment variable can be used to point to the unpacked
    directory (eg,
    PYO3_PYTHON=/path/to/python-standalone/python/bin/python3), this was not
    sufficient. Defining the build configuration in the PYO3_CONFIG_FILE
    correctly worked for all supported environments with our current build
    process

  4. run PYO3_CONFIG_FILE=/path/to/pyo3_config_file.txt cargo build to build InfluxDB

  5. adjust the library search paths for Linux and Darwin so libpython can
    found (see 'Discussion', below)

  6. create official build artifacts:

  • Linux/Darwin tar.gz contain influxdb3 and python/...
  • Linux deb and rpm contain /usr/bin/influxdb3 and
    /usr/lib/influxdb3/python
  • Windows zip contains influxdb3, *.dll files from python/... and
    python/... (see 'Discussion', below)

Licensing information for python-build-standalone as distributed by official
builds of InfluxDB can found in the python/LICENSE.md.

With the above, influxdb3 can be run in the normal way. Eg, on Linux:

text
/* Detailed source-code truncated for AI context efficiency. */

Disabling package management

The examples above rely on the server to manage the Processing Engine's Python
environment: it creates /.venv (or --virtual-env-location) with
python -m venv, activates it for the server process (setting VIRTUAL_ENV,
PATH, etc.), initializes embedded Python so sys.path includes the venv's
site-packages, and services influxdb3 install package ... by running
python -m pip install ....

With --disable-package-management (or
INFLUXDB3_DISABLE_PACKAGE_MANAGEMENT=true), all of that becomes your
responsibility: the server never creates, activates or otherwise touches a
virtual environment and influxdb3 install package ... is rejected. Create the
venv and export VIRTUAL_ENV before starting the server:

sh
# create the venv with the bundled python and point VIRTUAL_ENV at it
$ /here/python/bin/python3 -m venv /path/to/plugins/.venv
$ export VIRTUAL_ENV=/path/to/plugins/.venv

# start the server; VIRTUAL_ENV must be set in its environment
$ /here/influxdb3 serve --plugin-dir /path/to/plugins --disable-package-management

# install packages externally; no restart needed and 'influxdb3 install package' is rejected
$ /path/to/plugins/.venv/bin/python -m pip install -r /path/to/requirements.txt
...  ...

Notes:

  • Create the venv with the python3 bundled with influxdb3 (as above), not
    the system python, so the venv's Python version matches the embedded
    interpreter.
  • VIRTUAL_ENV must be exported in the server's environment before
    influxdb3 serve starts; --virtual-env-location is not consulted when
    package management is disabled.
  • Packages can be installed into the venv while the server is running; no
    restart is required.

Local development with python-build-standalone

Local development with python-build-standalone currently consists of:

  1. download python-build-standalone and unpack it somewhere

    • get from https://github.com/astral-sh/python-build-standalone/releases
    • based on your host OS, choose one of aarch64-apple-darwin-install_only_stripped.tar.gz, aarch64-unknown-linux-gnu-install_only_stripped.tar.gz, x86_64-pc-windows-msvc-install_only_stripped.tar.gz, x86_64-unknown-linux-gnu-install_only_stripped.tar.gz

  2. create pyo3_config_file.txt to match the unpacked dir and downloaded python version. Eg, if downloaded and unpacked a 3.13.x version to /tmp/python:

    text
    $ cat ./pyo3_config_file.txt
implementation=CPython
version=3.13
shared=true
abi3=false
lib_name=python3.13
lib_dir=/tmp/python/lib
executable=/tmp/python/bin/python3.13
pointer_width=64
build_flags=
suppress_build_script_link_lines=false

  3. build with:

    text
    # note: PYO3_CONFIG_FILE must be an absolute path
$ PYO3_CONFIG_FILE=${PWD}/pyo3_config_file.txt cargo build --features "aws,gcp,azure,jemalloc_replacing_malloc"

  4. Linux/OSX: patch up the binary to find libpython:

    text
    # linux
$ patchelf --set-rpath '$ORIGIN/python/lib' ./target//influxdb3

# osx (be sure to match the libpython version with what you downloaded)
$ install_name_tool -change '/install/lib/libpython3.13.dylib' '@executable_path/python/lib/libpython3.13.dylib' ./target//influxdb3

  5. Linux/OSX: put the python runtime in the expected location (XXX: may be
    possible at run time to see where the libpython we are using is and adjust
    the code to base the location of the runtime on that). Eg, if unpacked to
    /tmp/python:

    text
    $ test -e ./target//python || ln -s /tmp/python ./target//python

  6. run with:

    text
    $ mkdir -p /path/to/plugin/dir

# linux and osx (if can't find libpython or the runtime, check previous steps)
$ ./target//influxdb3 ... --plugin-dir /path/to/plugin/dir

# windows requires moving the binary into the python-build-standalone unpack directory
$ cp ./target//influxdb3 \path\to\python-standalone\python
# run influxdb with
$ \path\to\python-standalone\python\influxdb3.exe ... --plugin-dir \path\to\plugin\dir

Discussion

Why python-build-standalone?

python-build-standalone is designed to be
portable,
maintained
and permissively licensed.
It is purpose-built for embedding and being redistributable and has a good
upstream maintenance story (https://github.com/astral-sh) with lots of users
and a corporate sponsor.

An alternative to using a standalone python distribution is to use the system
python. While this can be a reasonable choice on systems where the python
version and installation locations can be relied upon, it is not a good choice
for official builds since users would have to ensure they had a python
installation that met InfluxDB's requirements and because the myriad of
operating systems, architectures and installed python versions would be a
problem to support.

By choosing python-build-standalone, InfluxDB should deliver a consistent
experience across OSes and architectures for all users as well as providing a
reasonable maintenance story.

Which builds of python-build-standalone are used?

python-build-standalone provides many different builds.
Official InfluxDB builds use the following python-build-standalone
recommended
builds:

  • aarch64-apple-darwin-install_only_stripped.tar.gz
  • aarch64-unknown-linux-gnu-install_only_stripped.tar.gz
  • x86_64-unknown-linux-gnu-install_only_stripped.tar.gz
  • x86_64-pc-windows-msvc-install_only_stripped.tar.gz

How will InfluxData maintain the embedded interpreter?

The https://github.com/astral-sh project performs timely builds of CPython
micro-releases for python-build-standalone based on the release cadence of
upstream Python. InfluxData need only update the build to pull in the new
micro-release for security and maintenance releases. This is done by updating
the PBS_DATE and PBS_VERSION environment variables in
.circleci/config.yaml. See that file and
.circleci/scripts/fetch-python-standalone.bash for details.

astral-sh creates new builds for CPython minor releases as they become
available from upstream Python. Updating the official builds to pull in a new
minor release is straightforward, but processes for verifying builds of
InfluxDB with the new python-build-standalone minor release are
TBD.

References:

How is python-build-standalone licensed?

Release builds of python-build-standalone are
permissively licensed
and contain no copyleft code.

The licensing information from release builds of python-build-standalone are
obtained by extracting the python/PYTHON.json and python/licenses/* files
from the <arch>-debug-full.tar.zst (Linux/Darwin) and
<arch>-pgo-full.tar.zst release tarballs, placing them in the
python/licenses directory of the InfluxDB build and generating a
python/LICENSE.md file with provenance information.

Linux builds are dynamically linked against glibc
(which is permitted by the LGPL without copyleft attachment). InfluxDB does not
statically link against glibc nor does it redistribute libc (et al) in
official builds.

In an ideal world, InfluxDB would build against a version of
python-build-standalone and statically link against it and not have to worry
about dynamic library compatibility. Unfortunately, this is not possible for
many reasons:

  • static python-build-standalone builds for Darwin are not available and doing so may have license implications
  • static python-build-standalone builds for Windows are not stable and considered brittle
  • static python-build-standalone builds for Linux/arm64 (aarch64) are not available
  • static python-build-standalone builds for Linux/amd64 (x86_64) are
    available using MUSL libc, but:
    • because they are static, they cannot load compiled Python extensions
      (aka, 'wheels' that have compiled C, Rust, etc code instead of pure python)
      outside of the Python standard library, greatly diminishing the utility of
      the processing engine. This is a limitation of ELF
    • there are historical performance issues with python and MUSL

It is theoretically possible to statically link glibc, but in practice this
is technically very problematic and statically linking glibc has copyleft
attachment.

What about alpine?

Because MUSL can't be used with python-build-standalone without crippling the
InfluxDB processing engine, MUSL builds that are compatible with Alpine are not
available at this time. Alpine users can choose one of:

  • build InfluxDB locally on Alpine against Alpine's system python
  • run official InfluxDB within a chroot that contains glibc
  • run official InfluxDB with gcompat (untested)

See https://wiki.alpinelinux.org/wiki/Running_glibc_programs for details.

InfluxData may provide Alpine builds at a future date.

GLIBC portability is a problem. How will you address that?

glibc is designed with portability and uses 'compat symbols' to achieve
backward compatibility.
Most 3rd party applications for Linux use the system's glibc in some fashion
and this is possible because of 'compat symbols' and this has worked very well
for many, many years.

In essence, 'compat symbols' let glibc and the linker choose a particular
implementation of the function. All symbols in glibc are versioned and when a
library function changes in an incompatible way, glibc keeps the old
implementation in place (with the old symbol version) while adding the new
implementation with a new symbol version. In this manner, if an application is
compiled and linked against glibc 2.27, it will only ever lookup symbols that
are 2.27 or earlier. When 2.28 comes out, it updates any symbols it needs to
2.28, leaving the rest as they are. When the application linked against 2.27
runs on a system with 2.28, everything is ok since 2.28 will resolve all the
2.27 symbols in the expected way the application needs.

Where portability becomes a problem is when the application is linked against a
newer version of glibc than is on the system. If the aforementioned
application compiled and linked against 2.27 was run on a system with 2.19, it
would fail to run because the symbol versions it is looking up (ie, anything
from 2.20 and later) are not available.

Unfortunately for developers seeking portability, compiling and linking against
the system's glibc means the application will reference the latest available
symbols in that glibc. There is no facility for telling the linker to only
use symbols from a particular glibc version and earlier. It's also difficult
to tell the linker to use an alternate glibc separate from the system's. As a
result, glibc-using software seeking wide Linux portability typically needs
to be compiled on an older system with a glibc with the desired version.

python-build-standalone and rust both support systems with glibc 2.17+,
which is covers distributions going back to 2014 (CentOS/RHEL 7 (EOL), Debian 8
(Jessie; EOL), Ubuntu 14.04 LTS (EOL), Fedora 21, etc.

How does InfluxDB find the correct libpython and the python runtime?

For the best user experience, users should not have to perform any extra setup
to use the InfluxDB processing engine. This is achieved by:

  • Using an appropriate PYO3_CONFIG_FILE file during the build (see 'Official
    builds', above)

  • Build artifacts putting the runtime in an expected location (see 'Official
    builds, above)

  • At runtime, ensuring that Linux and Darwin binaries look for the runtime in
    the expected location. Ideally this would be done with linker arguments at
    builds time, but current (alpha) builds adjust the library search paths like
    so:

    sh
    # linux
$ patchelf --set-rpath '$ORIGIN/python/lib:$ORIGIN/../lib/influxdb3/python/lib' target/.../influxdb3

# osx
$ install_name_tool -change '/install/lib/libpython3.NN.dylib' \
    '@executable_path/python/lib/libpythonNN.dylib' target/.../influxdb3
$ rcodesign sign target/.../influxdb3  # only with osxcross' install_name_tool

    This is required, in part, due to how python-build-standalone is
    built.
    When using osxcross's version of install_name_tool, must also use
    rcodesign from apple-codesign
    to re-sign the binaries (Apple's install_name_tool does this
    automatically). Rust may gain support
    for setting arbitrary rpaths at some point.

  • The Windows zip file for the current (alpha) builds has copies of the
    top-level DLL files from the 'python/' directory alongside influxdb3.
    Windows requires that the dynamically linked DLLs needed by the application
    are either in the same directory as the binary or found somewhere in PATH
    (and open source tooling doesn't seem to support modifying this). For user
    convenience, the *.dll files are shipped alongside the binary on Windows
    to avoid having to setup the PATH. Rust believes this shouldn't be handled
    by rustc. This may be
    addressed in a future release

There is no `pip.exe` on Windows. Why?

Historical python-build-standalone didn't ship pip.exe on Windows. From
upstream:
"The Windows distributions have pip installed however no Scripts/pip.exe,
Scripts/pip3.exe, and Scripts/pipX.Y.exe files are provided because the way
these executables are built isn't portable. (It might be possible to change how
these are built to make them portable.)

To use pip, run python.exe -m pip. (It is generally a best practice to invoke
pip via python -m pip on all platforms so you can be explicit about the
python executable that pip uses.)"

While newer python-build-standalone releases seem to have addressed this, the
recommendation to call with python -m pip still holds true.

What limitations are there?

See https://github.com/influxdata/influxdb/issues?q=is%3Aissue%20state%3Aopen%20label%3Av3

2. Official Technical Reference & Guides (influxdata/docs)

File: README.md

What is this?

This repository contains the image documentation for each of the Docker Official Images. See docker-library/official-images for more information about the program in general.

All Markdown files here are run through tianon's fork of markdownfmt, and verified as formatted correctly via GitHub Actions.

Table of Contents

  1. What is this?
    1. Table of Contents
  2. How do I update an image's docs
  3. How do I add a new image's docs
  4. Files related to an image's docs
    1. folder ``
    2. README.md
    3. content.md
    4. get-help.md
    5. github-repo
    6. license.md
    7. logo.png
    8. maintainer.md
    9. README-short.txt
    10. stack.yml
  5. Files for main Docs repo
    1. update.sh
    2. markdownfmt.sh and ymlfmt.sh
    3. .template-helpers/generate-dockerfile-links-partial.sh
    4. .template-helpers/
  6. Scripts unrelated to templates
    1. generate-repo-stub-readme.sh
    2. push.pl and push.sh
  7. Issues and Contributing

How do I update an image's docs

Edit the content.md for an image; not the README.md as it's auto-generated from the contents of the other files in that repo. To see the changes to the README.md, run ./update.sh myimage from the repo root, but do not add the README.md changes to your pull request. See also markdownfmt.sh point below.

After opening your Pull Request the changes will be checked by an automated markdownfmt.sh before it can be merged. A common issue is incorrect spacing such as with two lines missing an empty line between them (double-spaced).

How do I add a new image's docs

  • Create a folder for my image: mkdir myimage
  • Create a README-short.txt (required, 100 char max)
  • Create a content.md (required)
  • Create a license.md (required)
  • Create a maintainer.md (required)
  • Create a github-repo (required)
  • Add a logo.png (recommended)

Optionally:

  • Run ./markdownfmt.sh -l myimage to list any files that are non-compliant to tianon/markdownfmt.
    Any files in the list will result in a failed build during continuous integration.
    • run ./markdownfmt.sh -d myimage to see a diff of changes required to pass.
  • Run ./update.sh myimage to generate myimage/README.md for manual review of the generated copy.
    Note: do not actually commit the README.md file; it is automatically generated/committed before being uploaded to Docker Hub.

folder ``

This is where all the partial (e.g. content.md) and generated files (e.g. README.md) for a given image reside, (e.g. golang/). It must match the name of the image used in docker-library/official-images.

`README.md`

This file is generated using update.sh. Do not commit or edit this file; it is regenerated periodically by a bot.

`content.md`

This file contains the main content of your image's long description. The basic parts you should have are a "What Is" section and a "How To" section. The following is a basic layout:

markdown
# What is XYZ?

// about what the contained software is

%%LOGO%%

# How to use this image

// descriptions and examples of common use cases for the image
// make use of subsections as necessary

`get-help.md`

This file is an optional override of the default get-help.md. This is the content of the "Where to get help" part of the "Quick reference" at the top of the generated README. We recommend linking to the best places for community support like forums, chat rooms, or mailing lists.

`github-repo`

This file should contain the URL to the GitHub repository for the Dockerfiles that become the images. The file should be in a single line ending in a newline with no extraneous whitespace. Only one GitHub repo per image repository is supported. It is used in generating links. Here is an example for golang:

text
https://github.com/docker-library/golang

`license.md`

This file should contain a link to the license for the main software in the image. Here is an example for golang:

markdown
View [license information](http://golang.org/LICENSE) for the software contained in this image.

`logo.png`

Logo for the contained software. While there are not hard rules on formatting, most existing logos are square or landscape and stay within a few hundred pixels of width. Alternatively, a logo.svg can be used instead, but only one logo file will apply. To use it within content.md, put %%LOGO%% as shown above in the basic content.md layout.

The image is automatically scaled to a 120 pixel square for the top of the Docker Hub page and Hub search results.

`maintainer.md`

This file should contain a link to the maintainers of the Dockerfile.

`README-short.txt`

This is the short description for the Docker Hub, limited to 100 characters in a single line.

Go (golang) is a general purpose, higher-level, imperative programming language.

`stack.yml`

This optional file contains a small, working Compose file for Docker Swarm showing off how to use the image. To use the stack.yml, add %%STACK%% to the content.md and this will embed the YAML along with a link to directly try it in Play with Docker.

The file must work via docker stack deploy since that is how Play with Docker will launch it, but it is helpful for users to try locally if it works for docker-compose as well. Other official images may be referenced within the YAML to demonstrate the functionality of the image, but no images external to the Docker Official Images program may be referenced.

Files for main Docs repo

`update.sh`

This is the main script used to generate the README.md files for each image. The generated file is committed along with the files used to generate it. Accepted arguments are which image(s) you want to update or no arguments to update all of them.

This script assumes bashbrew is in your PATH (for scraping relevant tag information from the library manifest file for each repository).

`markdownfmt.sh` and `ymlfmt.sh`

These two scripts are for verifying the formatting of Markdown (.md) and YAML (.yml) files, respectively. markdownfmt.sh uses the tianon/markdownfmt image and ymlfmt.sh uses the tianon/ymlfmt image.

This script is used by update.sh to create the "Supported tags and respective Dockerfile links" section of each generated README.md from the information in the official-images library/ manifests.

`.template-helpers/`

The scripts and Markdown files in here are used in building an image's README.md file in combination with its individual files.

Scripts unrelated to templates

`generate-repo-stub-readme.sh`

This is used to generate a simple README.md to put in the image's repo. We use this in Git repositories within https://github.com/docker-library to simplify our maintenance, but it is not required for anyone else. The only argument is the name of the image (or repo), like golang and it then outputs the readme to standard out.

`push.pl` and `push.sh`

These are used by us to push the actual content of the READMEs to the Docker Hub as special access is required to modify the Hub description contents. The Dockerfile is used to create a suitable environment for push.pl.

Issues and Contributing

If you would like to make a new Official Image, be sure to follow the guidelines.

Feel free to make a pull request for fixes and improvements to current documentation. For questions or problems on this repo come talk to us via the #docker-library IRC channel on Libera.Chat or open up an issue.

File: adminer/README.md

Quick reference

Quick reference (cont.)

Adminer

What is Adminer?

Adminer (formerly phpMinAdmin) is a full-featured database management tool written in PHP. Conversely to phpMyAdmin, it consist of a single file ready to deploy to the target server. Adminer is available for MySQL, PostgreSQL, SQLite, MS SQL, Oracle, Firebird, SimpleDB, Elasticsearch and MongoDB.

adminer.org

How to use this image

Standalone

console
$ docker run --link some_database:db -p 8080:8080 adminer

Then you can hit http://localhost:8080 or http://host-ip:8080 in your browser.

FastCGI

If you are already running a FastCGI capable web server you might prefer running Adminer via FastCGI:

console
$ docker run --link some_database:db -p 9000:9000 adminer:fastcgi

Then point your web server to port 9000 of the container.

Note: This exposes the FastCGI socket to the Internet. Make sure to add proper firewall rules or use a private Docker network instead to prevent a direct access.

... via [`docker stack deploy`](https://docs.docker.com/engine/reference/commandline/stack_deploy/) or [`docker-compose`](https://github.com/docker/compose)

Example stack.yml for adminer:

yaml
# Use root/example as user/password credentials

version: '3.1'

services:

  adminer:
    image: adminer
    restart: always
    ports:
      - 8080:8080

  db:
    image: mysql:5.6
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: example

Run docker stack deploy -c stack.yml adminer (or docker-compose -f stack.yml up), wait for it to initialize completely, and visit http://swarm-ip:8080, http://localhost:8080, or http://host-ip:8080 (as appropriate).

Loading plugins

This image bundles all official Adminer plugins. You can find the list of plugins on GitHub: https://github.com/vrana/adminer/tree/master/plugins.

To load plugins you can pass a list of filenames in ADMINER_PLUGINS:

console
$ docker run --link some_database:db -p 8080:8080 -e ADMINER_PLUGINS='tables-filter tinymce' adminer

If a plugin requires parameters to work correctly instead of adding the plugin to ADMINER_PLUGINS, you need to add a custom file to the container:

console
$ docker run --link some_database:db -p 8080:8080 -e ADMINER_PLUGINS='login-servers' adminer
Unable to load plugin file "login-servers", because it has required parameters: servers
Create a file "/var/www/html/plugins-enabled/login-servers.php" with the following contents to load the plugin:

<?php
require_once('plugins/login-servers.php');

/** Set supported servers
    * @param array array($domain) or array($domain => $description) or array($category => array())
    * @param string
    */
return new AdminerLoginServers(
    $servers = ???,
    $driver = 'server'
);

To load a custom plugin you can add PHP scripts that return the instance of the plugin object to /var/www/html/plugins-enabled/.

Choosing a design

The image bundles all the designs that are available in the source package of adminer. You can find the list of designs on GitHub: https://github.com/vrana/adminer/tree/master/designs.

To use a bundled design you can pass its name in ADMINER_DESIGN:

console
$ docker run --link some_database:db -p 8080:8080 -e ADMINER_DESIGN='nette' adminer

To use a custom design you can add a file called /var/www/html/adminer.css.

Usage with external server

You can specify the default host with the ADMINER_DEFAULT_SERVER environment variable. This is useful if you are connecting to an external server or a docker container named something other than the default db.

console
docker run -p 8080:8080 -e ADMINER_DEFAULT_SERVER=mysql adminer

Supported Drivers

While Adminer supports a wide range of database drivers this image only supports the following out of the box:

  • MySQL
  • PostgreSQL
  • SQLite
  • SimpleDB
  • Elasticsearch

To add support for the other drivers you will need to install the following PHP extensions on top of this image:

  • pdo_dblib (MS SQL)
  • oci8 (Oracle)
  • interbase (Firebird)
  • mongodb (MongoDB)

License

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's adminer/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: aerospike/README.md

Quick reference

Quick reference (cont.)

Aerospike Database Docker Images

What is Aerospike?

Aerospike is a distributed NoSQL database purposefully designed for high performance web scale applications. Aerospike supports key-value and document data models, and has multiple data types including List, Map, HyperLogLog, GeoJSON, and Blob. Aerospike's patented hybrid memory architecture delivers predictable high performance at scale and high data density per node.

Getting Started

Aerospike Enterprise Edition requires a feature key file to start and to ungate certain features in the database, such as compression. Enterprise customers can use their production or development keys.

Anyone can sign up to get an evaluation feature key file for a full-featured, single-node Aerospike Enterprise Edition.

Aerospike Community Edition supports the same developer APIs as Aerospike Enterprise Edition, and differs in ease of operation and enterprise features. See the product matrix for more.

Running an Aerospike EE node with a feature key file in a mapped directory

console
docker run -d -v DIR:/opt/aerospike/etc/ -e "FEATURE_KEY_FILE=/opt/aerospike/etc/features.conf" --name aerospike -p 3000-3002:3000-3002 aerospike:ee-[version]

Above, DIR is a directory on your machine where you drop your feature key file. Make sure Docker Desktop has file sharing permission to bind mount it into Docker containers.

Running an Aerospike EE node with a feature key file in a mapped directory

console
FEATKEY=$(base64 ~/Desktop/evaluation-features.conf)
docker run -d -e "FEATURES=$FEATKEY" -e "FEATURE_KEY_FILE=env-b64:FEATURES" --name aerospike -p 3000-3002:3000-3002 aerospike:ee-[version]

Running an Aerospike CE node

console
docker run -d --name aerospike -p 3000-3002:3000-3002 aerospike:ce-[version]

Advanced Configuration

The Aerospike Docker image has a default configuration file template that can be populated with individual configuration parameters, as we did before with FEATURE_KEY_FILE. Alternatively, it can be replaced with a custom configuration file.

The following sections describe both advanced options.

Injecting configuration parameters

You can inject parameters into the configuration template using container-side environment variables with the -e flag.

For example, to set the default namespace name to demo:

console
docker run -d --name aerospike -e "NAMESPACE=demo" -p 3000-3002:3000-3002 -v /my/dir:/opt/aerospike/etc/ -e "FEATURE_KEY_FILE=/opt/aerospike/etc/features.conf" aerospike:ee-[version]

Injecting configuration parameters into the configuration template isn't compatible with using a custom configuration file. You can use one or the other.

List of template variables

  • FEATURE_KEY_FILE - the feature_key_file is only required for the EE image. Default: /etc/aerospike/features.conf
  • SERVICE_THREADS - the service_threads. Default: Number of vCPUs
  • LOGFILE - the file param of the logging context. Default: /dev/null, do not log to file, log to stdout
  • SERVICE_ADDRESS - the bind address of the networking.service subcontext. Default: any
  • SERVICE_PORT - the port of the networking.service subcontext. Default: 3000
  • HB_ADDRESS - the networking.heartbeat address for cross cluster mesh. Default: any
  • HB_PORT - the port for networking.heartbeat communications. Default: 3002
  • FABRIC_ADDRESS - the address of the networking.fabric subcontext. Default: any
  • FABRIC_PORT - the port of the networking.fabric subcontext. Default: 3001

The single preconfigured namespace is in-memory with filesystem persistence

  • NAMESPACE - the name of the namespace. Default: test
  • REPL_FACTOR - the namespace replication-factor. Default: 2
  • MEM_GB - the namespace memory-size. Default: 1, the unit is always G (GB)
  • DEFAULT_TTL - the namespace default-ttl. Default: 30d
  • STORAGE_GB - the namespace persistence file size. Default: 4, the unit is always G (GB)
  • NSUP_PERIOD - the namespace nsup-period. Default: 120 , nsup-period in seconds

Using a custom configuration file

You can override the use of the configuration file template by providing your own aerospike.conf, as described in Configuring Aerospike Database.

You should first -v map a local directory, which Docker will bind mount. Next, drop your aerospike.conf file into this directory. Finally, use the --config-file option to tell Aerospike where in the container the configuration file is (the default path is /etc/aerospike/aerospike.conf). Remember that the feature key file is required, so use feature-key-file in your config file to point to a mounted path (such as /opt/aerospike/etc/feature.conf).

For example:

console
docker run -d -v /opt/aerospike/etc/:/opt/aerospike/etc/ --name aerospike-p 3000-3002:3000-3002 aerospike:ee-[version] --config-file /opt/aerospike/etc/aerospike.conf

Persistent Data Directory

With Docker, the files within the container are not persisted past the life of the container. To persist data, you will want to mount a directory from the host to the container's /opt/aerospike/data using the -v option:

For example:

console
docker run -d  -v /opt/aerospike/data:/opt/aerospike/data  -v /opt/aerospike/etc:/opt/aerospike/etc/ --name aerospike -p 3000-3002:3000-3002 -e "FEATURE_KEY_FILE=/opt/aerospike/etc/features.conf" aerospike:ee-[version]

The example above uses the configuration template, where the single defined namespace is in-memory with file-based persistence. Just mounting the predefined /opt/aerospike/data directory enables the data to be persisted on the host.

Alternatively, a custom configuration file is used with the parameter file set to be a file in the mounted /opt/aerospike/data, such as in the following config snippet:

text
namespace test {
    # :
    storage-engine device {
        file /opt/aerospike/data/test.dat
        filesize 4G
        data-in-memory true
    }
}

In this example we also mount the data directory in a similar way, using a custom configuration file.

console
docker run -d -v /opt/aerospike/data:/opt/aerospike/data -v /opt/aerospike/etc/:/opt/aerospike/etc/ --name aerospike -p 3000-3002:3000-3002 aerospike:ee-[version] --config-file /opt/aerospike/etc/aerospike.conf

Block Storage

Docker provides an ability to expose a host's block devices to a running container. The --device option can be used to map a host block device within a container.

Update the storage-engine device section of the namespace in the custom aerospike configuration file.

text
namespace test {
    # :
    storage-engine device {
        device /dev/xvdc
            write-block-size 128k
    }
}

Now to map a host drive /dev/sdc to /dev/xvdc on a container

console
docker run -d --device '/dev/sdc:/dev/xvdc' -v /opt/aerospike/etc/:/opt/aerospike/etc/ --name aerospike -p 3000-3002:3000-3002 aerospike:ee-[version] --config-file /opt/aerospike/etc/aerospike.conf

Persistent Lua Cache

Upon restart, your lua cache will become emptied. To persist the cache, you will want to mount a directory from the host to the container's /opt/aerospike/usr/udf/lua using the -v option:

sh
docker run -d -v /opt/aerospike/lua:/opt/aerospike/usr/udf/lua -v /opt/aerospike/data:/opt/aerospike/data --name aerospike -p 3000-3002:3000-3002 -e "FEATURE_KEY_FILE=/opt/etc/aerospike/features.conf" aerospike:ee-[version]

Clustering

Developers using the Aerospike EE single-node evaluation, and most others using Docker Desktop on their machine for development, will not need to configure the node for clustering. If you're interested in using clustering and have a feature key file without a single node limit, read the following sections.

Configuring the node's access address

In order for the Aerospike node to properly broadcast its address to the cluster and applications, the access-address configuration parameter needs to be set in the configuration file. If it is not set, then the IP address within the container will be used, which is not accessible to other nodes.

text
network {
        service {
            address any                  # Listening IP Address
            port 3000                    # Listening Port
            access-address 192.168.1.100 # IP Address used by cluster nodes and applications
        }

Mesh Clustering

Mesh networking requires setting up links between each node in the cluster. This can be achieved in two ways:

  1. Add a configuration for each node in the cluster, as defined in Network Heartbeat Configuration.
  2. Use asinfo to send the tip command, to make the node aware of another node, as defined in tip command in asinfo.

For more, see How do I get a 2 nodes Aerospike cluster running quickly in Docker without editing a single file?

Image Versions

These images are based on debian:strech-slim.

ee-[version]

These tags are for Aerospike EE images, and will require a feature key file, such as the one you get with the single-node EE evaluation, or one associated with a commercial enterprise license agreement.

ce-[version]

These tags are for Aerospike CE images, and do not require a feature key file to start. As mentioned above, the developer API for both is the same, but the editions differ in operational features.

Reporting Issues

If you have any problems with or questions about this image, please post on the Aerospike discussion forum.

Enterprise customers are welcome to participate in the community forum, but can also report issues through the enterprise support system.

Aerospike EE evaluation users can open an issue in aerospike/aerospike-server-enterprise.docker.

Aerospike CE users can open an issue in aerospike/aerospike-server.docker.

License

Copyright 2019-2021 Aerospike, Inc.

If you are using a feature key file you received as part of your commercial enterprise license, you are operating under the Aerospike Master License Agreement.

If you are using the Aerospike Database EE evaluation feature key file, you are operating under the Aerospike Evaluation License Agreement.

If you are using Aerospike Database CE refer to the license information in the aerospike/aerospike-server repository.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's aerospike/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: almalinux/README.md

Quick reference

Quick reference (cont.)

AlmaLinux OS

AlmaLinux OS is an Open Source and forever-free enterprise Linux distribution, governed and driven by the community, focused on long-term stability and a robust production-grade platform. AlmaLinux OS is 1:1 binary compatible with RHEL® 8 and it was founded by the team behind the well-established CloudLinux OS.

About this image

Platform image

The default (platform) image is a general-purpose image with a full DNF stack and basic tools like find, tar, vi, etc.

The almalinux:latest tag will always point to the latest stable release of the default image. Major releases and minor releases are also tagged with their version (e.g. almalinux:8 or almalinux:8.4).

Minimal image

The minimal image is a stripped-down image that uses the microdnf package manager and contains a very limited package set. It is designed for applications that come with their own dependencies bundled (e.g. NodeJS, Python).

The almalinux:minimal tag always points to the most recent version of the minimal image. Tags for major (e.g. almalinux:8-minimal) and minor (e.g. almalinux:8.4-minimal) releases are also available.

Upgrade policy

All images for supported releases will be updated monthly or as needed for security fixes.

How It's Made

The rootfs tarballs for this image are built using the livemedia-creator tool. The build script and kickstart files are available in the AlmaLinux/docker-images git repository.

License

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's almalinux/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: alpine/README.md

Quick reference

Quick reference (cont.)

What is Alpine Linux?

Alpine Linux is a Linux distribution built around musl libc and BusyBox. The image is only 5 MB in size and has access to a package repository that is much more complete than other BusyBox based images. This makes Alpine Linux a great image base for utilities and even production applications. Read more about Alpine Linux here and you can see how their mantra fits in right at home with Docker images.

How to use this image

Usage

Use like you would any other base image:

dockerfile
FROM alpine:3.14
RUN apk add --no-cache mysql-client
ENTRYPOINT ["mysql"]

This example has a virtual image size of only 36.8MB. Compare that to our good friend Ubuntu:

dockerfile
FROM ubuntu:20.04
RUN apt-get update \
    && apt-get install -y --no-install-recommends mysql-client \
    && rm -rf /var/lib/apt/lists/*
ENTRYPOINT ["mysql"]

This yields us a virtual image size of about 145MB image.

License

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's alpine/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: alt/README.md

Quick reference

Quick reference (cont.)

  • Where to file issues:
    First of all, please, make sure that the developers are not aware of the bug in ALT bugzilla.

For create new bug, please use ALT's bugzilla page (choose Official image as component and include details about image problems in the description) or GitHub.

ALT Linux

This image serves as the official ALT image for the ALT Linux.

ALT Linux Team

ALT Linux Team is an international community numbering over 200 free software developers.

Sisyphus

Sisyphus is a daily updated repository which serves as a basis for all ALT distributions. Sisyphus integrity supported by the ALT Linux Team, the original software packaging technology, and apt-get (apt-rpm) utility allows users to easily update the system and be aware of any news on the free software. This daily updated repository contains the latest software with all its benefits and pitfalls (latent sometimes).

The name Sisyphus comes from the Greek mythology. Uninterrupted efforts on improvement of technologies set in the repository make ALT Linux Team similar to tireless Sisyphus continuously rolling stones up the hill.

About Platform 9

As said above, Sisyphus is a frequently updated repository mainly designed for developers. Stable distributions by ALT are the best solution for those users preferring stability and predictability of the system to its functionality (primarily new and corporate users). Such stable distributions are based on stable Sisyphus repository slices called platforms. Platform 9 (p9) was created in June, 2019, and will be supported till December, 2022.

About this image

The alt:latest tag will always point the latest stable release (which is, at the time of this writing, alt:p9).

How It's Made

This image was created with the help of mkimage and hasher tools.

Mkimage is a tool used to create images with Linux kernel from the set Sisyphus-like repository. Mkimage uses a set of Makefiles and shell hooks.

Hasher is a tool used for safe and repeatable packaging in clean and controllable environment. This is achieved through creation of a minimum build environment in chroot, installation of all necessary packaging dependencies there, and packet assembly in the new environment. Every package requires a new build environment.

License

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's alt/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: amazoncorretto/README.md

Quick reference

Quick reference (cont.)

What is Amazon Corretto?

Corretto is a binary distribution of the Open Java Development Kit (OpenJDK) with long-term support from Amazon. Corretto is certified using the Java Technical Compatibility Kit (TCK) to ensure it meets the Java SE standard and is available on Linux, Windows, and macOS. It includes patches from Amazon that have proven useful in running our own services.

Why should I use Corretto?

Corretto is a reliable binary distribution of OpenJDK with the assurance of long-term support provided at no cost to you. Amazon runs Corretto internally on thousands of production services. Every modification we make to Corretto fixes or mitigates a problem we found running OpenJDK. Amazon also plans to apply urgent fixes (including security) when they are available and ready to use, outside of the regular quarterly cycle.

How is Corretto different from OpenJDK?

Corretto is a distribution of Open JDK with patches included by Amazon that are not yet integrated in the corresponding OpenJDK update projects. We focus on patches that improve performance or stability in OpenJDK, chosen based on Amazon's observations running large services.

What kinds of patches does Amazon intend to include in Corretto?

Patches will include security fixes, performance enhancements (e.g., speeding up frequently used functions), garbage collection scheduling, and preventing out-of-memory situations, as well as improved monitoring, reporting, and thread management.

Is there any cost associated with using Corretto?

Corretto is distributed by Amazon under an Open Source license at no cost to you. It is licensed under the terms of the GNU Public License version 2 with the Class Path Exception (GPLv2 with CPE). Amazon does not charge for its use or distribution.

What is included in Corretto's long-term support?

Amazon will provide security updates for Corretto 8 until at least June 2023. Updates are planned to be released quarterly. Corretto 11, corresponding to OpenJDK 11, will be available during the first half of 2019. Amazon will support Corretto 11 with quarterly updates until at least August 2024.

Can I use Corretto as a drop-in replacement for other JDKs?

Corretto is designed as a drop-in replacement for all Java SE distributions unless you are using features (e.g., Java Flight Recorder) not available in OpenJDK. Once Corretto binaries are installed on a host and correctly invoked to run your Java applications (e.g., using the alternatives command on Linux), existing command-line options, tuning parameters, monitoring, and anything else in place will continue to work as before.

Why does security scanner show that a docker image has a CVE?

If a security scanner reports that an amazoncorretto image includes a CVE, the first recommended action is to pull an updated version of this image.

If no updated image is available, run the appropriate command to update packages for the platform, ie. run "apk -U upgrade" for Alpine or "yum update -y --security" for AmazonLinux in your Dockerfiles or systems to resolve the issue immediately.

If no updated package is available, please treat this as a potential security issue and follow these instructions or email AWS security directly at [email protected].

It is the responsibility of the base docker image supplier to provide timely security updates to images and packages. The amazoncorretto images are automatically rebuilt when a new base image is made available, but we do not make changes to our Dockerfiles to pull in one-off package updates. If a new base image has not yet been made generally available by a base docker image maintainer, please contact that maintainer to request that the issue be addressed.

Note that there are multiple reasons why a CVE may appear to be present in a docker image, as explained in the docker library FAQs.

Image Variants

The amazoncorretto images come in many flavors, each designed for a specific use case.

`amazoncorretto:`

This is the defacto image. If you are unsure about what your needs are, you probably want to use this one. It is designed to be used both as a throw away container (mount your source code and start the container to start your app), as well as the base to build other images off of.

`amazoncorretto:-alpine`

This image is based on the popular Alpine Linux project, available in the alpine official image. Alpine Linux is much smaller than most distribution base images (~5MB), and thus leads to much slimmer images in general.

This variant is useful when final image size being as small as possible is your primary concern. The main caveat to note is that it does use musl libc instead of glibc and friends, so software will often run into issues depending on the depth of their libc requirements/assumptions. See this Hacker News comment thread for more discussion of the issues that might arise and some pro/con comparisons of using Alpine-based images.

To minimize image size, it's uncommon for additional related tools (such as git or bash) to be included in Alpine-based images. Using this image as a base, add the things you need in your own Dockerfile (see the alpine image description for examples of how to install packages if you are unfamiliar).

License

Amazon Corretto is released under the same open source license as OpenJDK, which is licensed under the GNU Public License version 2 with the Class Path Exception (GPLv2 with CPE).

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's amazoncorretto/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: amazonlinux/README.md

Quick reference

Quick reference (cont.)

What is Amazon Linux?

Amazon Linux is provided by Amazon Web Services (AWS). It is designed to provide a stable, secure, and high-performance execution environment for applications running on Amazon EC2. The full distribution includes packages that enable easy integration with AWS, including launch configuration tools and many popular AWS libraries and tools. AWS provides ongoing security and maintenance updates to all instances running Amazon Linux.

The Amazon Linux container image contains a minimal set of packages. To install additional packages, use yum.

AWS provides two versions of Amazon Linux: Amazon Linux 2 and Amazon Linux AMI.

Please note, that Amazon Linux 2022 is currently in the Preview mode and is not recommended for production workloads. Review the Amazon Linux 2022 documentation to learn more.

For information on security updates for Amazon Linux, please refer to Amazon Linux 2 Security Advisories and Amazon Linux AMI Security Advisories. Note that Docker Hub's vulnerability scanning for Amazon Linux is currently based on RPM versions, which does not reflect the state of backported patches for vulnerabilities.

Where can I run Amazon Linux container images?

You can run Amazon Linux container images in any Docker based environment. Examples include, your laptop, in AWS EC2 instances, and ECS clusters.

How is Amazon Linux 2 different from Amazon Linux AMI?

There are three major differences in Amazon Linux 2 from its predecessors:

  1. it is available as a VM image for on-premises development and testing
  2. it includes systemd service and systems manager as opposed to System V init system and also includes new version of compiler and build tools
  3. it gives you the ability to install additional software packages through Extras mechanism without impacting the underlying LTS stability

Is Amazon Linux 2 build an official LTS build?

Yes. Amazon Linux 2 end of support date (End of Life, or EOL) has been extended by two years from 2023-06-30 to 2025-06-30 to provide customers with ample time to migrate to the next version.

What packages are available in the Amazon Linux containers?

Amazon Linux Docker container images contain a subset of the packages in the images for use on EC2 and as VMs in on-premises scenarios. The container images can be configured to use any of the full set of packages in images for EC2 and on-premises use. The Amazon Linux 2 container images comes with Extras included.

What is an Amazon Linux 2 Extra?

Extras is a new mechanism introduced in Amazon Linux 2 to enable the consumption of the newest versions of application software in a fully supported manner on a stable Amazon Linux 2 base. Extras help alleviate the compromise between stability of the OS and freshness of available software. For example, now you can install newer versions of Python being rest assured that the underlying operating system is stable. Examples of Extras include nginx, PostgreSQL, MariaDB, Go, and Rust.

How do Amazon Linux 2 Extras work?

Extras introduces the notion of topics to select software bundles. Each topic contains all the dependencies required for the software to install and function on Amazon Linux 2. For example, Rust is an Extras topic in the curated list provide by Amazon. It provides the toolchain and runtimes for Rust, the systems programming language. This topic includes the cmake build system for Rust, cargo - the rust package manager, and the LLVM based compiler toolchain for Rust. The packages associated with each topic are consumed via the well-known yum installation process.

How are Amazon Linux 2 Extras topics different from the packages available in yum repositories?

yum is a utility for package management of RPM packages. The base image of Amazon Linux 2 (LTS) includes access to repositories that already contain stable versions of popular packages that can be installed with yum. These packages are part of the long term support for Amazon Linux 2.

However, if you need a new software package or a newer version of an existing software package that is not included in the base Amazon Linux 2 image, Extras provide a way to install those packages in a supported manner. Extras is essentially a simplified mechanism to point yum to AWS curated sets of packages for a selected topic.

How do I install a software package from Extras repository in Amazon Linux 2?

Available packages can be listed with the amazon-linux-extras command. Packages can be installed with the amazon-linux-extras install command. Example: amazon-linux-extras install rust1

Will updates be available for Amazon Linux containers?

Similar to the Amazon Linux images for AWS EC2 and on-premises use, Amazon Linux container images will get ongoing updates from Amazon in the form of security updates, bug fix updates, and other enhancements. Security bulletins for Amazon Linux are available at https://alas.aws.amazon.com/

What support is available for Amazon Linux outside AWS?

With the availability of Amazon Linux 2, are there any changes to the existing version of Amazon Linux AMI?

With the availability of Amazon Linux 2, we are announcing that 2018.03 release of Amazon Linux AMI container image will be the last release for the current generation of Amazon Linux. Going forward, AWS will provide newer versions only for Amazon Linux 2.

Will AWS support the current version of Amazon Linux going forward?

Yes; in order to avoid any disruption to your existing applications and to facilitate migration to Amazon Linux 2, AWS will provide regular security updates for Amazon Linux 2018.03 AMI and container image for 2 years after the final LTS build is announced. You can also use all your existing support channels such as AWS Premium Support and Amazon Linux Discussion Forum to continue to submit support requests.

Is Amazon Linux 2 backward compatible with Amazon Linux AMI?

Due to the inclusion of new components in Amazon Linux 2 such as systemd, your applications running on the current version of Amazon Linux may require additional changes to run on Amazon Linux 2.

License

Amazon Linux is available under the GNU General Public License, version 2.0. Individual software packages are available under their own licenses; run rpm -qi [package name] or check /usr/share/doc/[package name]-* and /usr/share/licenses/[package name]-* for details.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's amazonlinux/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: api-firewall/README.md

Quick reference

Quick reference (cont.)

What is API Firewall?

Wallarm API Firewall is an open-source light-weighted proxy designed to protect REST API endpoints in cloud-native environments by hardening based on a strict OpenAPI/Swagger schema validation. Wallarm API Firewall relies on a positive security model allowing calls that match a predefined API specification for requests and responses, while rejecting everything else.

The key features of API Firewall are:

  • Protect REST API endpoints by blocking requests and responses that do not match the OAS/Swagger schema
  • Discover Shadow API endpoints
  • If using OAuth 2.0 protocol-based authentication, validate access tokens
  • Quick and easy deployment and configuration
  • Customization of request and response processing modes, response codes and log format

Use cases

  • Block abnormal requests and responses that do not match the OpenAPI 3.0 specification (if running API Firewall in the blocking mode)
  • Discover Shadow APIs and undocumented endpoints (if running API Firewall in the logging mode)
  • Log abnormal requests and responses that do not match the OpenAPI 3.0 specification (if running API Firewall in the logging mode)

API schema validation and positive security model

When starting API Firewall, you should provide the OpenAPI 3.0 specification of the application to be protected with API Firewall. The started API Firewall will operate as a reverse proxy and validate whether requests and responses match the schema defined in the specification.

The traffic that does not match the schema will be logged using the STDOUT and STDERR Docker services or blocked (depending on the configured API Firewall operation mode). If operating in the logging mode and detecting the traffic on endpoints that are not included in the specification, API Firewall also logs these endpoints as the shadow ones (except for endpoints returning the code 404).

Provided API schema should be described using the OpenAPI 3.0 specification in the YAML or JSON file (.yaml, .yml, .json file extensions).

By allowing you to set the traffic requirements with the OpenAPI 3.0 specification, Wallarm API Firewall relies on a positive security model.

Technical characteristics

API Firewall works as a reverse proxy with a built-in OpenAPI 3.0 request and response validator. The validator is written in Go and optimized for extreme performance and near-zero added latency.

Starting API Firewall

To download, install, and start Wallarm API Firewall on Docker, see the instructions.

Demos

You can try API Firewall by running the demo environment that deploys an example application protected with Wallarm API Firewall. There are two available demo environments:

Performance

When creating API Firewall, we prioritized speed and efficiency to ensure that our customers would have the fastest APIs possible. Our latest tests demonstrate that the average time required for API Firewall to process one request is 1.339 ms:

console
$ ab -c 200 -n 10000 -p ./large.json -T application/json http://127.0.0.1:8282/test/signup

Document Path:          /test/signup
Document Length:        20 bytes

Concurrency Level:      200
Time taken for tests:   0.769 seconds
Complete requests:      10000
Failed requests:        0
Total transferred:      2150000 bytes
Total body sent:        283770000
HTML transferred:       200000 bytes
Requests per second:    13005.81 [#/sec] (mean)
Time per request:       15.378 [ms] (mean)
Time per request:       0.077 [ms] (mean, across all concurrent requests)
Transfer rate:          2730.71 [Kbytes/sec] received
                        360415.95 kb/s sent
                        363146.67 kb/s total

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:        0    5   1.6      5      12
Processing:     2   10   5.4      9      59
Waiting:        2    8   5.2      7      56
Total:          3   15   5.7     14      68

Percentage of the requests served within a certain time (ms)
  50%     14
  66%     15
  75%     16
  80%     17
  90%     18
  95%     23
  98%     36
  99%     44
 100%     68 (longest request)

These performance results are not the only ones we have got during API Firewall testing. Other results along with the methods used to improve API Firewall performance are described in this Wallarm's blog article.

License

View license information for the software contained in this image.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's api-firewall/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

File: arangodb/README.md

Quick reference

Quick reference (cont.)

What is ArangoDB?

ArangoDB is a multi-model, open-source database with flexible data models for documents, graphs, and key-values. Build high performance applications using a convenient SQL-like query language or JavaScript extensions. Use ACID transactions if you require them. Scale horizontally and vertically with a few mouse clicks.

ArangoDB runs everywhere: On-prem, in the cloud and also on ArangoDB's Cloud Service Oasis.

The supported data models can be mixed in queries and allow ArangoDB to be the aggregation point for your data.

arangodb.com

Key Features in ArangoDB

Multi-Model Documents, graphs and key-value pairs — model your data as you see fit for your application.

Joins Conveniently join what belongs together for flexible ad-hoc querying, less data redundancy.

Transactions Easy application development keeping your data consistent and safe. No hassle in your client.

Joins and Transactions are key features for flexible, secure data designs, widely used in RDBMSs that you won't want to miss in NoSQL products. You decide how and when to use Joins and strong consistency guarantees, keeping all the power for scaling and performance as choice.

Furthermore, ArangoDB offers a microservice framework called Foxx to build your own Rest API with a few lines of code.

ArangoDB Documentation

How to use this image

Start an ArangoDB instance

In order to start an ArangoDB instance, run:

console
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 -d --name arangodb-instance arangodb

Will create and launch the arangodb docker instance as background process. The Identifier of the process is printed. By default ArangoDB listen on port 8529 for request and the image includes EXPOSE 8529. If you link an application container it is automatically available in the linked container. See the following examples.

In order to get the IP arango listens on, run:

console
unix> docker inspect --format '{{ .NetworkSettings.IPAddress }}' arangodb-instance

Using the instance

In order to use the running instance from an application, link the container:

console
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 --name my-app --link arangodb-instance:db-link arangodb

This will use the instance with the name arangodb-instance and link it into the application container. The application container will contain environment variables

text
DB_LINK_PORT_8529_TCP=tcp://172.17.0.17:8529
DB_LINK_PORT_8529_TCP_ADDR=172.17.0.17
DB_LINK_PORT_8529_TCP_PORT=8529
DB_LINK_PORT_8529_TCP_PROTO=tcp
DB_LINK_NAME=/naughty_ardinghelli/db-link

These can be used to access the database.

Exposing the port to the outside world

If you want to expose the port to the outside world, run:

console
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 -p 8529:8529 -d arangodb

ArangoDB listen on port 8529 for request and the image includes EXPOSE 8529. The -p 8529:8529 exposes this port on the host.

Choosing an authentication method

The ArangoDB image provides several authentication methods which can be specified via environment variables (-e) when using docker run

  1. ARANGO_RANDOM_ROOT_PASSWORD=1

    Generate a random root password when starting. The password will be printed to stdout (may be inspected later using docker logs)

  2. ARANGO_NO_AUTH=1

    Disable authentication. Useful for testing.

    WARNING Doing so in production will expose all your data. Make sure that ArangoDB is not directly accessible from the internet!

  3. ARANGO_ROOT_PASSWORD=somepassword

    Specify your own root password.

Note: this way of specifying logins only applies to single server installations. With clusters you have to provision the users via the root user with empty password once the system is up.

Command line options

You can pass arguments to the ArangoDB server by appending them to the end of the Docker command:

console
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 arangodb --help

The entrypoint script starts the arangod binary by default and forwards your arguments.

You may also start other binaries, such as the ArangoShell:

console
unix> docker run -it arangodb arangosh --server.database myDB ...

Note that you need to set up networking for containers if arangod runs in one container and you want to access it with arangosh running in another container. It is easier to execute it in the same container instead. Use docker ps to find out the container ID / name of a running container:

console
unix> docker ps
CONTAINER ID   IMAGE     COMMAND                 CREATED      STATUS      PORTS                   NAMES
1234567890ab   arangodb  "/entrypoint.sh aran…"  2 hours ago  Up 2 hours  0.0.0.0:8529->8529/tcp  jolly_joker

Then use docker exec and the ID / name to run something inside of the existing container:

console
unix> docker exec -it jolly_joker arangosh

See more information about Configuration

Limiting resource utilization

arangod checks the following environment variables, which can be used to restrict how much memory and how many CPU cores it should use:

  • ARANGODB_OVERRIDE_DETECTED_TOTAL_MEMORY (introduced in v3.6.3)

    This variable can be used to override the automatic detection of the total amount of RAM present on the system. One can specify a decimal number (in bytes). Furthermore, if G or g is appended, the value is multiplied by 2^30. If M or m is appended, the value is multiplied by 2^20. If K or k is appended, the value is multiplied by 2^10. That is, 64G means 64 gigabytes.

    The total amount of RAM detected is logged as an INFO message at server start. If the variable is set, the overridden value is shown. Various default sizes are calculated based on this value (e.g. RocksDB buffer cache size).

    Setting this option can in particular be useful in two cases:

    1. If arangod is running in a container and its cgroup has a RAM limitation, then one should specify this limitation in this environment variable, since it is currently not automatically detected.
    2. If arangod is running alongside other services on the same machine and thus sharing the RAM with them, one should limit the amount of memory using this environment variable.

  • ARANGODB_OVERRIDE_DETECTED_NUMBER_OF_CORES (introduced in v3.7.1)

    This variable can be used to override the automatic detection of the number of CPU cores present on the system.

    The number of CPU cores detected is logged as an INFO message at server start. If the variable is set, the overridden value is shown. Various default values for threading are calculated based on this value.

    Setting this option is useful if arangod is running in a container or alongside other services on the same machine and shall not use all available CPUs.

Persistent Data

ArangoDB supports two different storage engines from version 3.2 to 3.6. You can choose them while instantiating the container with the environment variable ARANGO_STORAGE_ENGINE. With mmfiles you choose the classic storage engine (not available in 3.7 and later), rocksdb will choose the storage engine based on RocksDB. The default choice is rocksdb from version 3.4 on.

ArangoDB uses the volume /var/lib/arangodb3 as database directory to store the collection data and the volume /var/lib/arangodb3-apps as apps directory to store any extensions. These directories are marked as docker volumes.

See docker inspect --format "{{ .Config.Volumes}}" arangodb for all volumes.

A good explanation about persistence and docker container can be found here: Docker In-depth: Volumes, Why Docker Data Containers are Good

Using host directories

You can map the container's volumes to a directory on the host, so that the data is kept between runs of the container. This path /tmp/arangodb is in general not the correct place to store you persistent files - it is just an example!

console
unix> mkdir /tmp/arangodb
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 -p 8529:8529 -d \
          -v /tmp/arangodb:/var/lib/arangodb3 \
          arangodb

This will use the /tmp/arangodb directory of the host as database directory for ArangoDB inside the container.

Using a data container

Alternatively you can create a container holding the data.

console
unix> docker create --name arangodb-persist arangodb true

And use this data container in your ArangoDB container.

console
unix> docker run -e ARANGO_RANDOM_ROOT_PASSWORD=1 --volumes-from arangodb-persist -p 8529:8529 arangodb

If want to save a few bytes you can alternatively use busybox or alpine for creating the volume only containers. Please note that you need to provide the used volumes in this case. For example

console
unix> docker run -d --name arangodb-persist -v /var/lib/arangodb3 busybox true

Using as a base image

If you are using the image as a base image please make sure to wrap any CMD in the exec form. Otherwise the default entrypoint will not do its bootstrapping work.

When deriving the image, you can control the instantiation via putting files into /docker-entrypoint-initdb.d/.

  • *.sh - files ending with .sh will be run as a bash shellscript.
  • *.js - files will be executed with arangosh. You can specify additional arangosh arguments via the ARANGOSH_ARGS environment variable.
  • dumps/ - in this directory you can place subdirectories containing database dumps generated using arangodump. They can be restored using arangorestore.

License

ArangoDB itself is licensed under the Apache License, but it contains software of third parties under their respective licenses.

As with all Docker images, these likely also contain other software which may be under other licenses (such as Bash, etc from the base distribution, along with any direct or indirect dependencies of the primary software being contained).

Some additional license information which was able to be auto-detected might be found in the repo-info repository's arangodb/ directory.

As for any pre-built image usage, it is the image user's responsibility to ensure that any use of this image complies with any relevant licenses for all software contained within.

Explore Related Technologies & Topics

View All 9,111+ Repositories →

Discover similar high-velocity repositories, agent skills, and OpenAPI specifications across the ecosystem.

#database Browse database catalog → #go Browse go catalog → #influxdb Browse influxdb catalog → #metrics Browse metrics catalog → #monitoring Browse monitoring catalog → #react Browse react catalog → ⚡ MCP Servers Model Context Protocol → 🧠 Agent Skills Prompt & rule files → 🔌 OpenAPI Specs REST & Swagger schemas →