See Running on Docker at the dcm4che Archive 5 Wiki.
Below explained environment variables can be set as per one's application to override the default values if need be.
An example of how one can set an env variable in docker run command is shown below :
-e ARCHIVE_DEVICE_NAME=my-dcm4chee-arc
Device name to lookup in LDAP for UI configuration (optional, default is dcm4chee-arc).
Space separated list of URL(s) of Archive RESTful services deployed in other Archive docker container(s). E.g.: http://test-ng:8080/dcm4chee-arc
This environment variable is used to set the initial and maximal Java heap size,
the size of the allocated class metadata space that will trigger a garbage collection the first time it is exceeded and
the maximum amount of native memory that can be allocated for class metadata (optional, default is
"-Xms64m -Xmx512m -XX:MetaspaceSize=96M -XX:MaxMetaspaceSize=256m").
This environment variable is used to set the JAVA_OPTS during archive startup (optional, default is
"$JBOSS_JAVA_SIZING -Djava.net.preferIPv4Stack=true -Djboss.modules.system.pkgs=org.jboss.byteman -Djava.awt.headless=true").
Specifies subdirectories of - typically host mounted - /opt/wildfly/standalone/ which files and subdirectories get
updated by newer versions from corresponding subdirectories of /docker-entrypoint.d/ provided by the image on each
container start. (optional, default is configuration deployments).
If file /opt/wildfly/standalone/configuration/VERSION does not contain $WILDFLY_CONFIGURATION_VERSION,
XML configuration files in /opt/wildfly/standalone/configuration will be replaced by versions from
/docker-entrypoint.d/configuration provided by the image on first container start, even if the modification time of
existing files is newer than the files from the docker image, backing up existing files as XY.xml~.
File /opt/wildfly/standalone/configuration/VERSION will be created/updated to contain $WILDFLY_CONFIGURATION_VERSION
to ensure that the configuration files does not get overwritten on next container start, as long
WILDFLY_CONFIGURATION_VERSION is not set to a different value.
By default, it is set to $ARCHIVE_ARC_VERSION, which ensures that the configuration files are replaced if the
archive version provided by the image changes.
Specifies a subset of subdirectories of /opt/wildfly/standalone/ specified by WILDFLY_STANDALONE,
which files shall not be overwritten by newer versions from corresponding subdirectories of
/docker-entrypoint.d/ provided by the image on each container start.
Indicates to delay the start of the Archive UI until specified TCP ports become accessible. Format: <host>:<port> ..., e.g.: ldap:389 db:5432.
Start cron daemon to execute scheduled commands (optional, default is false).
Delete /opt/wildfly/standalone/log/server.log* files older than specified number of days automatically (optional, default is 7).
HTTP port of the Archive UI (optional, default is 8080).
HTTPS port of Archive UI (optional, default is 8443).
HTTP port of Wildfly Administration Console (optional, default is 9990).
HTTPS port of Wildfly Administration Console (optional, default is 9993).
Protect Wildfly Adminstration Console with Keycloak (optional, default is true).
By default there is no admin user created so you won't be able to login to the Wildfly Administration Console.
User to authenticate to the Wildfly Administration Console.
(At archive versions secured by Keycloak and WILDFLY_ADMIN_OIDC=true, any user with assigned role ADMINISTRATOR
is authorized to access the Wildfly Administration Console.)
WILDFLY_ADMIN_USER_FILE (Ignored by Archive UI version secured by Keycloak and WILDFLY_ADMIN_OIDC=true)
User to authenticate to the Wildfly Administration Console via file input (alternative to WILDFLY_ADMIN_USER).
WILDFLY_ADMIN_PASSWORD (Ignored by Archive UI version secured by Keycloak and WILDFLY_ADMIN_OIDC=true)
User's password to use to authenticate to the Wildfly Administration Console.
WILDFLY_ADMIN_PASSWORD_FILE (Ignored by Archive UI version secured by Keycloak and WILDFLY_ADMIN_OIDC=true)
User's password to use to authenticate to the Wildfly Administration Console via file input (alternative to WILDFLY_ADMIN_PASSWORD).
User role required to access the Archive UI (optional, default is user).
User role to identify super users, which have unrestricted access to all UI functions of the Archive, bypassing the
verification of user permissions (optional, default is root).
Path to keystore file with private key and certificate for HTTPS (optional, default is
/opt/wildfly/standalone/configuration/keystore/key.p12, with sample key + certificate:
Owner: CN=dcm4che, O=dcm4che.org, C=AT
Issuer: OU=Gazelle, CN=IHE Europe CA, O=IHE Europe, C=FR
Serial number: 4b3
Valid from: Fri Sep 30 11:24:50 CEST 2022 until: Thu Sep 30 11:24:50 CEST 2032
Certificate fingerprints:
SHA1: B4:F5:09:33:B8:56:F0:D5:65:E9:3E:3D:02:1B:9D:00:F8:F8:F4:BA
SHA256: BD:60:1C:19:D4:ED:87:18:B3:EC:F6:53:52:91:00:C8:A2:70:21:0F:04:87:E6:B7:ED:15:23:A7:97:D8:28:AC
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 1024-bit RSA key (weak)
provided by the docker image only for testing purpose).
Password used to protect the integrity of the keystore specified by KEYSTORE (optional, default is secret).
Password used to protect the integrity of the keystore specified by KEYSTORE via file input
(alternative to KEYSTORE_PASSWORD).
Password used to protect the private key in the keystore specified by KEYSTORE
(optional, default is value of KEYSTORE_PASSWORD).
Password used to protect the private key in the keystore specified by KEYSTORE via file input
(alternative to KEY_PASSWORD).
Type (JKS or PKCS12) of the keystore specified by KEYSTORE (optional, default is PKCS12).
Path to keystore file with trusted certificates for TLS (optional, default is the default Java truststore
/usr/local/openjdk-11/lib/security/cacerts). s.o. EXTRA_CACERTS.
Password used to protect the integrity of the keystore specified by TRUSTSTORE (optional, default is changeit).
Password used to protect the integrity of the keystore specified by TRUSTSTORE via file input
(alternative to TRUSTSTORE_PASSWORD).
Type (JKS or PKCS12) of the keystore specified by TRUSTSTORE (optional, default is JKS).
Path to keystore file with CA certificates imported to default Java truststore (optional, default is
/opt/wildfly/standalone/configuration/keystore/cacerts.p12, with sample CA certificate:
Owner: OU=Gazelle, CN=IHE Europe CA, O=IHE Europe, C=FR
Issuer: OU=Gazelle, CN=IHE Europe CA, O=IHE Europe, C=FR
Serial number: 1
Valid from: Tue Nov 27 11:21:33 CET 2018 until: Mon Nov 27 11:21:33 CET 2028
Certificate fingerprints:
SHA1: 95:B3:01:BD:8B:97:46:D3:17:C4:E6:96:42:C9:84:FC:17:8D:E9:6F
SHA256: 21:EB:CA:86:4A:08:E9:A2:D2:1F:6E:84:37:8D:60:BB:14:92:4D:1B:B0:DD:B0:DC:75:03:0C:2E:F3:B2:6E:DD
Signature algorithm name: SHA512withRSA
Subject Public Key Algorithm: 2048-bit RSA key
provided by the docker image only for testing purpose).
Password used to protect the integrity of the keystore specified by EXTRA_CACERTS (optional, default is secret).
Password used to protect the integrity of the keystore specified by EXTRA_CACERTS via file input
(alternative to EXTRA_CACERTS_PASSWORD).
Comma separated list of enabled TLS protocols (SSLv2, SSLv3, TLSv1, TLSv1.1, TLSv1.2, TLSv1.3)
(optional, default is TLSv1.2).
The filter to apply to specify the enabled cipher suites for TLSv1.2 and below. See
javadoc
for possible values. (optional, default is DEFAULT).
Backend Endpoint URL of the Keycloak server for direct communication between the archive application and Keycloak for
authenticating client requests.
Default value is https://keycloak:8443.
Frontend Endpoint URL of the Keycloak server used by the browser based Archive UI to access Keycloak. If there is a
reverse proxy in front of Keycloak, the URL has to reflect hostname and port of the reverse proxy.
Default value is ${AUTH_SERVER_URL}.
Name of the realm configured in Keycloak for securing the UI and RESTful services of the archive,
and the Wildfly Administration Console and Management API (optional, default is dcm4che).
Defining the SSL/HTTPS requirements for interacting with the Keycloak server:
none- HTTPS is not required for any client IP addressexternal- private IP addresses can access without HTTPSall- HTTPS is required for all IP addresses
(optional, default is external).
If the Keycloak server requires HTTPS and this config option is set to true the Keycloak server’s certificate is
validated via the truststore, but host name validation is not done (optional, default value set is true).
If the Keycloak server requires HTTPS and this config option is set to true the Keycloak server’s certificate is
is not validated via the truststore (optional, default value set is false).
Keycloak client ID for securing the UI of the archive (optional, default is dcm4chee-arc-ui).
Keycloak client ID for securing the Wildfly Administration Console
(optional, default is wildfly-console).
Keycloak client ID for securing the Wildfly Management API.
(optional, default is wildfly-management).
Controls if Wildfly Undertow servlet container should set headers to disable caching for secured pages
(optional, default is false).
Logstash/GELF Logger configuration:
Hostname/IP-Address of the Logstash host. Required for emitting system logs to Logstash.
Name of the Facility (optional, default is wildfly).
Log-Level threshold (optional, default is WARN).
Indicates if the Stack-Trace shall be sent in the StackTrace field (optional, default is true).
Indicates if Stack-Trace filtering shall be performed (optional, default is true).