Running Stormshield KMaaS in Docker mode

Requirements

Execution UID/GUID

The Stormshield KMaaS runs with the node user (UID/GID 1000) in the container. To ensure that your application runs correctly and securely, be sure to specify the execution UID/GID correctly. Below is an example of a command:

docker run -u 1000:1000 stormshield/kmaas:<version>

File access

You must allow containers to access your configuration files (i.e., keks.json, config.json, OPA files, certificate files and private keys).

For config.json and keks.json files, Stormshield makes the following recommendations:
- If you have several instances of the Stormshield KMaaS, expose a single file to the various containers of the application, as they must be identical on all instances,
- Mount them read-only, as they will never be modified by the Stormshield KMaaS.
  Below is an example of a command with a read-only folder containing configuration files:
  docker run -v -u 1000:1000 /my-kmaas-config-folder:/etc/stormshield/cse:ro stormshield/kmaas:<version>

Sensitive files (i.e., keks.json, private keys) must be managed by secure mechanisms provided by your orchestrator. Refer to the documentation of your orchestrator.

Network traffic redirection

The service listens on the port defined in the config.json file (3000 by default) in the container. Below is an example of a command that forwards host port 443 to port 3000:

docker run -p 443:3000 my-image

Refer to your orchestrator's documentation to set up port forwarding in a production environment.

Access to environment variables

Containers must have access to the environment variables mentioned in this administration guide. Below is the command for declaring an environment variable:

docker run -e MY_VARIABLE=my-variable-value stormshield/kmaas:<version>

Refer to your orchestrator's documentation to set the environment variables in a production environment.