Configuration

Datachain Core is made available as a docker container, enabling simple single-server deployments, right up to highly available multi-server architectures.

This section presents the images of the DataChain © solution, along with the associated information for each image (particularly in terms of disk access).

Applications can be configured via docker *.env files or environment variables. This section presents the essential settings for the various modules of the solution.

About environment variables

The new images (currently console and marketplace) have no environment variables defined for sensitive variables.

ANY configuration variable value can be placed in a docker secret (for example for passwords) by using the original variable name and applying the following rules:

  • All alphanumeric characters are in UPPERCASE

  • Replace each _ (underscore) with 2 underscores

  • Replace each - (hyphen) with 3 underscores

  • Replace each . (dot) with 1 underscore

  • Append _FILE to the end of the variable name

Example:

com.adb.dc.data-source.env_value=monsecret is transformed into:

  • A secret file containing the value "monsecret", for example in /var/run/secret/env_value_file

  • An environment variable COM_ADB_DC_DATA___SOURCE_ENV__VALUE_FILE=/var/run/secret/env_value_file

Application certificates

Some images expose a /java_cert_import volume, in which to place the certificates that will be used by Datachain, for example for HTTPS connectors.

Certificates are in PEM format, and must have the extension ".cert", e.g. "adobis-rootca.cert".

  • The .cert extension is mandatory: only files with this extension are imported, regardless of their content.

  • The content can be encoded as PEM (text, Base64-encoded, delimited by -----BEGIN CERTIFICATE----- / -----END CERTIFICATE-----) or as DER (binary, the raw bytes of the ASN.1 structure): both are accepted, as the keytool tool used for the update detects the encoding automatically.

  • The file must contain a single certificate. Complete keystores (PKCS12, JKS) or files containing several certificates are not supported.

Running without privileges (OpenShift)

The application images of Datachain Core, Console, Marketplace and Dc-Maestro run without root privileges, and are designed to work on OpenShift with the default security policy (restricted SCC):

  • The application runs as an unprivileged user (dc, maestro or nginx) whose primary group is the root group (gid 0). The image files are writable by this group. The Datachain Java images (backend, spark, console, marketplace) start as root for their process supervisor, then launch the application as dc; with an imposed uid, they run entirely under that uid.

  • OpenShift imposes a random uid when the container starts. This uid always belongs to the root group (gid 0): the application therefore keeps access to its files and volumes.

  • Listening ports are above 1024: 8080 for the Datachain web application (monitoring on 9080), for the Maestro API and for the Maestro interface.

  • Volumes (host directories, persistent volumes) must be writable by the root group (gid 0), or by the image uid if it is kept (38330 for dc and maestro, 101 for nginx).

The user of each image is given in the "Image description" table of each module.

In this section

Dernière mise à jour le 2 novembre 2026 à 15:16