| Chapter 3. Installing Guacamole with Docker | ||
|---|---|---|
| Prev | Part I. User's Guide | Next |
Table of Contents
- Running the guacd Docker image
- Running guacd for use by the Guacamole Docker image
- Running guacd for use by services outside Docker
- The Guacamole Docker image
- Configuring Guacamole when using Docker
- Connecting Guacamole to guacd
- MySQL authentication
- PostgreSQL authentication
- LDAP authentication
- Header Authentication
- Custom extensions and
GUACAMOLE_HOME - Verifying the Guacamole install
- # docker run -help will print all the options that we can use to manipulate a container. Setting Up an Apache Container. One of the amazing things about the Docker ecosystem is that there are tens of standard containers that you can easily download and use.
- Name your container (avoids generic id) docker run -name myneo4j neo4j-p. Specify container ports to expose. Docker run -p7687:7687 neo4j.
Docker implements a high-level API to provide lightweight containers that run processes in isolation. The Docker software as a service offering consists of three components: Software: The Docker daemon, called dockerd, is a persistent process that manages Docker containers and handles container objects. The daemon listens for. This repository contains Dockerfile of apache-airflow for Docker's automated build published to the public Docker Hub Registry. Based on Python (3.7-slim-buster) official Image python:3.7-slim-buster and uses the official Postgres as backend and Redis as queue.
Guacamole can be deployed using Docker, removing the need to build guacamole-server from source or configure the web application manually. The Guacamole project provides officially-supported Docker images for both Guacamole and guacd which are kept up-to-date with each release.
A typical Docker deployment of Guacamole will involve three separate containers, linked together at creation time:
guacamole/guacdProvides the guacd daemon, built from the released guacamole-server source with support for VNC, RDP, SSH, telnet, and Kubernetes.
guacamole/guacamoleProvides the Guacamole web application running within Tomcat 8 with support for WebSocket. The configuration necessary to connect to guacd, MySQL, PostgreSQL, LDAP, etc. will be generated automatically when the image starts based on Docker links or environment variables.
mysql or postgresqlProvides the database that Guacamole will use for authentication and storage of connection configuration data.
This separation is important, as it facilitates upgrades and maintains proper separation of concerns. With the database separate from Guacamole and guacd, those containers can be freely destroyed and recreated at will. The only container which must persist data through upgrades is the database.
The guacd Docker image is built from the released guacamole-server source with support for VNC, RDP, SSH, telnet, and Kubernetes. Common pitfalls like installing the required dependencies, installing fonts for SSH, telnet, or Kubernetes, and ensuring the FreeRDP plugins are installed to the correct location are all taken care of. It will simply just work.
Running guacd for use by the Guacamole Docker image
When running the guacd image with the intent of linking to a Guacamole container, no ports need be exposed on the network. Access to these ports will be handled automatically by Docker during linking, and the Guacamole image will properly detect and configure the connection to guacd.
When run in this manner, guacd will be listening on its default port 4822, but this port will only be available to Docker containers that have been explicitly linked to some-guacd
The log level of guacd can be controlled with the GUACD_LOG_LEVEL environment variable. The default value is info
If you are not going to use the Guacamole image, you can still leverage the guacd image for ease of installation and maintenance. By exposing the guacd port, 4822, services external to Docker will be able to access guacd.
Important
Take great care when doing this - guacd is a passive proxy and does not perform any kind of authentication.
If you do not properly isolate guacd from untrusted parts of your network, malicious users may be able to use guacd as a jumping point to other systems.
guacd will now be listening on port 4822, and Docker will expose this port on the same server hosting Docker. Other services, such as an instance of Tomcat running outside of Docker, will be able to connect to guacd directly.
The Guacamole Docker image is built on top of a standard Tomcat 8 image and takes care of all configuration automatically. The configuration information required for guacd and the various authentication mechanisms are specified with environment variables or Docker links given when the container is created.
Docker Run Apache
Important
If using PostgreSQL or MySQL for authentication, you will need to initialize the database manually. Guacamole will not automatically create its own tables, but SQL scripts are provided to do this.
Once the Guacamole image is running, Guacamole will be accessible at http://, where HOSTNAME:8080/guacamole/HOSTNAME is the hostname or address of the machine hosting Docker.
When running Guacamole using Docker, the traditional approach to configuring Guacamole by editing guacamole.properties is less convenient. When using Docker, you may wish to make use of the enable-environment-properties configuration property, which allows you to specify values for arbitrary Guacamole configuration properties using environment variables. This is covered in Chapter 5, Configuring Guacamole.
The Guacamole Docker image needs to be able to connect to guacd to establish remote desktop connections, just like any other Guacamole deployment. The connection information needed by Guacamole will be provided either via a Docker link or through environment variables.
If you will be using Docker to provide guacd, and you wish to use a Docker link to connect the Guacamole image to guacd, the connection details are implied by the Docker link:
If you are not using Docker to provide guacd, you will need to provide the network connection information yourself using additional environment variables:
| Variable | Description |
|---|---|
GUACD_HOSTNAME | The hostname of the guacd instance to use to establish remote desktop connections. This is required if you are not using Docker to provide guacd. |
GUACD_PORT | The port that Guacamole should use when connecting to guacd. This environment variable is optional. If not provided, the standard guacd port of 4822 will be used. |
The GUACD_HOSTNAME and, if necessary, GUACD_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
A connection to guacd is not the only thing required for Guacamole to work; some authentication mechanism needs to be configured, as well. MySQL, PostgreSQL, and LDAP are supported for this, and are described in more detail in the sections below. If the required configuration options for at least one authentication mechanism are not provided, the Guacamole image will not be able to start up, and you will see an error.
To use Guacamole with the MySQL authentication backend, you will need either a Docker container running the mysql image, or network access to a working installation of MySQL. The connection to MySQL can be specified using either environment variables or a Docker link.
If your database is not already initialized with the Guacamole schema, you will need to do so prior to using Guacamole. A convenience script for generating the necessary SQL to do this is included in the Guacamole image.
To generate a SQL script which can be used to initialize a fresh MySQL database as documented in Chapter 6, Database authentication:
Alternatively, you can use the SQL scripts included with the database authentication.
Once this script is generated, you must:
Create a database for Guacamole within MySQL, such as
guacamole_db.Create a user for Guacamole within MySQL with access to this database, such as
guacamole_userRun the script on the newly-created database.
The process for doing this via the mysql utility included with MySQL is documented in Chapter 6, Database authentication.
If your MySQL database is provided by another Docker container, and you wish to use a Docker link to connect the Guacamole image to your database, the connection details are implied by the Docker link itself:
If you are not using Docker to provide your MySQL database, you will need to provide the network connection information yourself using additional environment variables:
| Variable | Description |
|---|---|
MYSQL_HOSTNAME | The hostname of the database to use for Guacamole authentication. This is required if you are not using Docker to provide your MySQL database. |
MYSQL_PORT | The port that Guacamole should use when connecting to MySQL. This environment variable is optional. If not provided, the standard MySQL port of 3306 will be used. |
The MYSQL_HOSTNAME and, if necessary, MYSQL_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required any more than a Docker link is required for MySQL. The connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
Using MySQL for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will connect to MySQL:
| Variable | Description |
|---|---|
MYSQL_DATABASE | The name of the database to use for Guacamole authentication. |
MYSQL_USER | The user that Guacamole will use to connect to MySQL. |
MYSQL_PASSWORD | The password that Guacamole will provide when connecting to MySQL as |
If any required environment variables are omitted, you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to override Guacamole's default behavior with respect to concurrent connection use by one or more users. Concurrent use of connections and connection groups can be limited to an overall maximum and/or a per-user maximum:
| Variable | Description |
|---|---|
MYSQL_ABSOLUTE_MAX_CONNECTIONS | The absolute maximum number of concurrent connections to allow at any time, regardless of the Guacamole connection or user involved. If set to '0', this will be unlimited. Because this limit applies across all Guacamole connections, it cannot be overridden if set. By default, the absolute total number of concurrent connections is unlimited ('0'). |
MYSQL_DEFAULT_MAX_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, overall concurrent use of connections is unlimited ('0'). |
MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, overall concurrent use of connection groups is unlimited ('0'). |
MYSQL_DEFAULT_MAX_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, per-user concurrent use of connections is unlimited ('0'). Install docker community edition free. |
MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, per-user concurrent use of connection groups is limited to one ('1'), to prevent a balancing connection group from being completely exhausted by one user alone. |
To use Guacamole with the PostgreSQL authentication backend, you will need either a Docker container running the postgres image, or network access to a working installation of PostgreSQL. The connection to PostgreSQL can be specified using either environment variables or a Docker link.
If your database is not already initialized with the Guacamole schema, you will need to do so prior to using Guacamole. A convenience script for generating the necessary SQL to do this is included in the Guacamole image.
To generate a SQL script which can be used to initialize a fresh PostgreSQL database as documented in Chapter 6, Database authentication:
Alternatively, you can use the SQL scripts included with the database authentication.
Once this script is generated, you must:
Create a database for Guacamole within PostgreSQL, such as
guacamole_db.Run the script on the newly-created database.
Create a user for Guacamole within PostgreSQL with access to the tables and sequences of this database, such as
guacamole_user
The process for doing this via the psql and createdb utilities included with PostgreSQL is documented in Chapter 6, Database authentication.
If your PostgreSQL database is provided by another Docker container, and you wish to use a Docker link to connect the Guacamole image to your database, the connection details are implied by the Docker link itself:
If you are not using Docker to provide your PostgreSQL database, you will need to provide the network connection information yourself using additional environment variables: Docker-machine ip mac os.
| Variable | Description |
|---|---|
POSTGRES_HOSTNAME | The hostname of the database to use for Guacamole authentication. This is required if you are not using Docker to provide your PostgreSQL database. |
POSTGRES_PORT | The port that Guacamole should use when connecting to PostgreSQL. This environment variable is optional. If not provided, the standard PostgreSQL port of 5432 will be used. |
The POSTGRES_HOSTNAME and, if necessary, POSTGRES_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required any more than a Docker link is required for PostgreSQL. The connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
High sierra installer app download. Using PostgreSQL for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will connect to PostgreSQL:
| Variable | Description |
|---|---|
POSTGRES_DATABASE | The name of the database to use for Guacamole authentication. |
POSTGRES_USER | The user that Guacamole will use to connect to PostgreSQL. |
POSTGRES_PASSWORD | The password that Guacamole will provide when connecting to PostgreSQL as |
If any required environment variables are omitted, you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to override Guacamole's default behavior with respect to concurrent connection use by one or more users. Concurrent use of connections and connection groups can be limited to an overall maximum and/or a per-user maximum:
| Variable | Description |
|---|---|
POSTGRES_ABSOLUTE_MAX_CONNECTIONS | The absolute maximum number of concurrent connections to allow at any time, regardless of the Guacamole connection or user involved. If set to '0', this will be unlimited. Because this limit applies across all Guacamole connections, it cannot be overridden if set. By default, the absolute total number of concurrent connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, overall concurrent use of connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, overall concurrent use of connection groups is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, per-user concurrent use of connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, per-user concurrent use of connection groups is limited to one ('1'), to prevent a balancing connection group from being completely exhausted by one user alone. |
Optional environment variables may also be used to override Guacamole's default behavior with respect to timeouts at the database and network level:
| Variable | Description |
|---|---|
POSTGRES_DEFAULT_STATEMENT_TIMEOUT | The number of seconds the driver will wait for a response from the database, before aborting the query. A value of 0 (the default) means the timeout is disabled. |
POSTGRES_SOCKET_TIMEOUT | The number of seconds to wait for socket read operations. If reading from the server takes longer than this value, the connection will be closed. This can be used to handle network problems such as a dropped connection to the database. Similar to |
To use Guacamole with the LDAP authentication backend, you will need network access to an LDAP directory. Unlike MySQL and PostgreSQL, the Guacamole Docker image does not support Docker links for LDAP; the connection information must be specified using environment variables:
| Variable | Description |
|---|---|
LDAP_HOSTNAME | The hostname or IP address of your LDAP server. |
LDAP_PORT | The port your LDAP server listens on. By default, this will be 389 for unencrypted LDAP or LDAP using STARTTLS, and 636 for LDAP over SSL (LDAPS). |
LDAP_ENCRYPTION_METHOD | The encryption mechanism that Guacamole should use when communicating with your LDAP server. Legal values are 'none' for unencrypted LDAP, 'ssl' for LDAP over SSL/TLS (commonly known as LDAPS), or 'starttls' for STARTTLS. If omitted, encryption will not be used. |
Only the LDAP_HOSTNAME variable is required, but you may also need to specify LDAP_PORT or LDAP_ENCRYPTION_METHOD if your LDAP directory uses encryption or listens on a non-standard port:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required. Similar to LDAP, the connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
Using LDAP for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will query your LDAP directory:
| Variable | Description |
|---|---|
LDAP_USER_BASE_DN | The base of the DN for all Guacamole users. All Guacamole users that will be authenticating against LDAP must be descendents of this base DN. |
As with the other authentication mechanisms, if any required environment variables are omitted (including those required for connecting to the LDAP directory over the network), you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to configure the details of your LDAP directory hierarchy, or to enable more flexible searching for user accounts:
| Variable | Description |
|---|---|
LDAP_GROUP_BASE_DN | The base of the DN for all groups that may be referenced within Guacamole configurations using the standard seeAlso attribute. All groups which will be used to control access to Guacamole configurations must be descendents of this base DN. If this variable is omitted, the seeAlso attribute will have no effect on Guacamole configurations. |
LDAP_SEARCH_BIND_DN | The DN (Distinguished Name) of the user to bind as when authenticating users that are attempting to log in. If specified, Guacamole will query the LDAP directory to determine the DN of each user that logs in. If omitted, each user's DN will be derived directly using the base DN specified with |
LDAP_SEARCH_BIND_PASSWORD | The password to provide to the LDAP server when binding as |
LDAP_USERNAME_ATTRIBUTE | The attribute or attributes which contain the username within all Guacamole user objects in the LDAP directory. Usually, and by default, this will simply be 'uid'. If your LDAP directory contains users whose usernames are dictated by different attributes, multiple attributes can be specified here, separated by commas, but beware: doing so requires that a search DN be provided with |
LDAP_CONFIG_BASE_DN | The base of the DN for all Guacamole configurations. If omitted, the configurations of Guacamole connections will simply not be queried from the LDAP directory, and you will need to store them elsewhere, such as within a MySQL or PostgreSQL database. |
As documented in Chapter 7, LDAP authentication, Guacamole does support combining LDAP with a MySQL or PostgreSQL database, and this can be configured with the Guacamole Docker image, as well. Each of these authentication mechanisms is independently configurable using their respective environment variables, and by providing the required environment variables for multiple systems, Guacamole will automatically be configured to use each when the Docker image starts.
The header authentication extension can be used to authenticate Guacamole through a trusted third-party server, where the authenticated user's username is passed back to Guacamole via a specific HTTP header. The following are valid Docker variables for enabling and configuring header authentication:
| Variable | Description |
|---|---|
HEADER_ENABLED | Enables authentication via the header extension, which causes the extension to be loaded when Guacamole starts. By default this is false and the header extension will not be loaded. |
HTTP_AUTH_HEADER | Optional environment variable that, if set, configures the name of the HTTP header that will be used used to authenticate the user to Guacamole. If this is not specified the default value of REMOTE_USER will be used. |
If you have your own or third-party extensions for Guacamole which are not supported by the Guacamole Docker image, but are compatible with the version of Guacamole within the image, you can still use them by providing a custom base configuration using the GUACAMOLE_HOME environment variable:
| Variable | Description |
|---|---|
GUACAMOLE_HOME | The absolute path to the directory within the Docker container to use as a template for the image's automatically-generated |
You will still need to follow the steps required to create the contents of GUACAMOLE_HOME specific to your extension (placing the extension itself within GUACAMOLE_HOME/extensions/guacamole.properties, etc.), but the rest of Guacamole's configuration will be handled automatically, overlaid on top of a copy of the GUACAMOLE_HOME you provide.
Because the Docker image's GUACAMOLE_HOME environment variable must point to a directory within the container, you will need to expose your custom GUACAMOLE_HOME to the container using the -v option of docker run. The container directory chosen can then be referenced in the GUACAMOLE_HOME environment variable, and the image will handle the rest automatically:
Once the Guacamole image is running, Guacamole should be accessible at http://, where HOSTNAME:8080/guacamole/HOSTNAME is the hostname or address of the machine hosting Docker, and you should a login screen. If using MySQL or PostgreSQL, the database initialization scripts will have created a default administrative user called 'guacadmin' with the password 'guacadmin'. You should log in and change your password immediately. If using LDAP, you should be able to log in as any valid user within your LDAP directory.
If you cannot access Guacamole, or you do not see a login screen, check Docker's logs using the docker logs command to determine if something is wrong. Configuration parameters may have been given incorrectly, or the database may be improperly initialized:
| Prev | Up | Next |
| Chapter 2. Installing Guacamole natively | Home | Chapter 4. Proxying Guacamole |
For local development and testing, you can run Pulsar in standalonemode on your own machine within a Docker container.
If you have not installed Docker, download the Community editionand follow the instructions for your OS.
Start Pulsar in Docker
For MacOS, Linux, and Windows:
When run in this manner, guacd will be listening on its default port 4822, but this port will only be available to Docker containers that have been explicitly linked to some-guacd
The log level of guacd can be controlled with the GUACD_LOG_LEVEL environment variable. The default value is info
If you are not going to use the Guacamole image, you can still leverage the guacd image for ease of installation and maintenance. By exposing the guacd port, 4822, services external to Docker will be able to access guacd.
Important
Take great care when doing this - guacd is a passive proxy and does not perform any kind of authentication.
If you do not properly isolate guacd from untrusted parts of your network, malicious users may be able to use guacd as a jumping point to other systems.
guacd will now be listening on port 4822, and Docker will expose this port on the same server hosting Docker. Other services, such as an instance of Tomcat running outside of Docker, will be able to connect to guacd directly.
The Guacamole Docker image is built on top of a standard Tomcat 8 image and takes care of all configuration automatically. The configuration information required for guacd and the various authentication mechanisms are specified with environment variables or Docker links given when the container is created.
Docker Run Apache
Important
If using PostgreSQL or MySQL for authentication, you will need to initialize the database manually. Guacamole will not automatically create its own tables, but SQL scripts are provided to do this.
Once the Guacamole image is running, Guacamole will be accessible at http://, where HOSTNAME:8080/guacamole/HOSTNAME is the hostname or address of the machine hosting Docker.
When running Guacamole using Docker, the traditional approach to configuring Guacamole by editing guacamole.properties is less convenient. When using Docker, you may wish to make use of the enable-environment-properties configuration property, which allows you to specify values for arbitrary Guacamole configuration properties using environment variables. This is covered in Chapter 5, Configuring Guacamole.
The Guacamole Docker image needs to be able to connect to guacd to establish remote desktop connections, just like any other Guacamole deployment. The connection information needed by Guacamole will be provided either via a Docker link or through environment variables.
If you will be using Docker to provide guacd, and you wish to use a Docker link to connect the Guacamole image to guacd, the connection details are implied by the Docker link:
If you are not using Docker to provide guacd, you will need to provide the network connection information yourself using additional environment variables:
| Variable | Description |
|---|---|
GUACD_HOSTNAME | The hostname of the guacd instance to use to establish remote desktop connections. This is required if you are not using Docker to provide guacd. |
GUACD_PORT | The port that Guacamole should use when connecting to guacd. This environment variable is optional. If not provided, the standard guacd port of 4822 will be used. |
The GUACD_HOSTNAME and, if necessary, GUACD_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
A connection to guacd is not the only thing required for Guacamole to work; some authentication mechanism needs to be configured, as well. MySQL, PostgreSQL, and LDAP are supported for this, and are described in more detail in the sections below. If the required configuration options for at least one authentication mechanism are not provided, the Guacamole image will not be able to start up, and you will see an error.
To use Guacamole with the MySQL authentication backend, you will need either a Docker container running the mysql image, or network access to a working installation of MySQL. The connection to MySQL can be specified using either environment variables or a Docker link.
If your database is not already initialized with the Guacamole schema, you will need to do so prior to using Guacamole. A convenience script for generating the necessary SQL to do this is included in the Guacamole image.
To generate a SQL script which can be used to initialize a fresh MySQL database as documented in Chapter 6, Database authentication:
Alternatively, you can use the SQL scripts included with the database authentication.
Once this script is generated, you must:
Create a database for Guacamole within MySQL, such as
guacamole_db.Create a user for Guacamole within MySQL with access to this database, such as
guacamole_userRun the script on the newly-created database.
The process for doing this via the mysql utility included with MySQL is documented in Chapter 6, Database authentication.
If your MySQL database is provided by another Docker container, and you wish to use a Docker link to connect the Guacamole image to your database, the connection details are implied by the Docker link itself:
If you are not using Docker to provide your MySQL database, you will need to provide the network connection information yourself using additional environment variables:
| Variable | Description |
|---|---|
MYSQL_HOSTNAME | The hostname of the database to use for Guacamole authentication. This is required if you are not using Docker to provide your MySQL database. |
MYSQL_PORT | The port that Guacamole should use when connecting to MySQL. This environment variable is optional. If not provided, the standard MySQL port of 3306 will be used. |
The MYSQL_HOSTNAME and, if necessary, MYSQL_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required any more than a Docker link is required for MySQL. The connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
Using MySQL for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will connect to MySQL:
| Variable | Description |
|---|---|
MYSQL_DATABASE | The name of the database to use for Guacamole authentication. |
MYSQL_USER | The user that Guacamole will use to connect to MySQL. |
MYSQL_PASSWORD | The password that Guacamole will provide when connecting to MySQL as |
If any required environment variables are omitted, you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to override Guacamole's default behavior with respect to concurrent connection use by one or more users. Concurrent use of connections and connection groups can be limited to an overall maximum and/or a per-user maximum:
| Variable | Description |
|---|---|
MYSQL_ABSOLUTE_MAX_CONNECTIONS | The absolute maximum number of concurrent connections to allow at any time, regardless of the Guacamole connection or user involved. If set to '0', this will be unlimited. Because this limit applies across all Guacamole connections, it cannot be overridden if set. By default, the absolute total number of concurrent connections is unlimited ('0'). |
MYSQL_DEFAULT_MAX_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, overall concurrent use of connections is unlimited ('0'). |
MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, overall concurrent use of connection groups is unlimited ('0'). |
MYSQL_DEFAULT_MAX_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, per-user concurrent use of connections is unlimited ('0'). Install docker community edition free. |
MYSQL_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, per-user concurrent use of connection groups is limited to one ('1'), to prevent a balancing connection group from being completely exhausted by one user alone. |
To use Guacamole with the PostgreSQL authentication backend, you will need either a Docker container running the postgres image, or network access to a working installation of PostgreSQL. The connection to PostgreSQL can be specified using either environment variables or a Docker link.
If your database is not already initialized with the Guacamole schema, you will need to do so prior to using Guacamole. A convenience script for generating the necessary SQL to do this is included in the Guacamole image.
To generate a SQL script which can be used to initialize a fresh PostgreSQL database as documented in Chapter 6, Database authentication:
Alternatively, you can use the SQL scripts included with the database authentication.
Once this script is generated, you must:
Create a database for Guacamole within PostgreSQL, such as
guacamole_db.Run the script on the newly-created database.
Create a user for Guacamole within PostgreSQL with access to the tables and sequences of this database, such as
guacamole_user
The process for doing this via the psql and createdb utilities included with PostgreSQL is documented in Chapter 6, Database authentication.
If your PostgreSQL database is provided by another Docker container, and you wish to use a Docker link to connect the Guacamole image to your database, the connection details are implied by the Docker link itself:
If you are not using Docker to provide your PostgreSQL database, you will need to provide the network connection information yourself using additional environment variables: Docker-machine ip mac os.
| Variable | Description |
|---|---|
POSTGRES_HOSTNAME | The hostname of the database to use for Guacamole authentication. This is required if you are not using Docker to provide your PostgreSQL database. |
POSTGRES_PORT | The port that Guacamole should use when connecting to PostgreSQL. This environment variable is optional. If not provided, the standard PostgreSQL port of 5432 will be used. |
The POSTGRES_HOSTNAME and, if necessary, POSTGRES_PORT environment variables can thus be used in place of a Docker link if using a Docker link is impossible or undesirable:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required any more than a Docker link is required for PostgreSQL. The connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
High sierra installer app download. Using PostgreSQL for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will connect to PostgreSQL:
| Variable | Description |
|---|---|
POSTGRES_DATABASE | The name of the database to use for Guacamole authentication. |
POSTGRES_USER | The user that Guacamole will use to connect to PostgreSQL. |
POSTGRES_PASSWORD | The password that Guacamole will provide when connecting to PostgreSQL as |
If any required environment variables are omitted, you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to override Guacamole's default behavior with respect to concurrent connection use by one or more users. Concurrent use of connections and connection groups can be limited to an overall maximum and/or a per-user maximum:
| Variable | Description |
|---|---|
POSTGRES_ABSOLUTE_MAX_CONNECTIONS | The absolute maximum number of concurrent connections to allow at any time, regardless of the Guacamole connection or user involved. If set to '0', this will be unlimited. Because this limit applies across all Guacamole connections, it cannot be overridden if set. By default, the absolute total number of concurrent connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, overall concurrent use of connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS | The maximum number of concurrent connections to allow to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, overall concurrent use of connection groups is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection. If set to '0', this will be unlimited. This can be overridden on a per-connection basis when editing a connection. By default, per-user concurrent use of connections is unlimited ('0'). |
POSTGRES_DEFAULT_MAX_GROUP_CONNECTIONS_PER_USER | The maximum number of concurrent connections to allow a single user to maintain to any one Guacamole connection group. If set to '0', this will be unlimited. This can be overridden on a per-group basis when editing a connection group. By default, per-user concurrent use of connection groups is limited to one ('1'), to prevent a balancing connection group from being completely exhausted by one user alone. |
Optional environment variables may also be used to override Guacamole's default behavior with respect to timeouts at the database and network level:
| Variable | Description |
|---|---|
POSTGRES_DEFAULT_STATEMENT_TIMEOUT | The number of seconds the driver will wait for a response from the database, before aborting the query. A value of 0 (the default) means the timeout is disabled. |
POSTGRES_SOCKET_TIMEOUT | The number of seconds to wait for socket read operations. If reading from the server takes longer than this value, the connection will be closed. This can be used to handle network problems such as a dropped connection to the database. Similar to |
To use Guacamole with the LDAP authentication backend, you will need network access to an LDAP directory. Unlike MySQL and PostgreSQL, the Guacamole Docker image does not support Docker links for LDAP; the connection information must be specified using environment variables:
| Variable | Description |
|---|---|
LDAP_HOSTNAME | The hostname or IP address of your LDAP server. |
LDAP_PORT | The port your LDAP server listens on. By default, this will be 389 for unencrypted LDAP or LDAP using STARTTLS, and 636 for LDAP over SSL (LDAPS). |
LDAP_ENCRYPTION_METHOD | The encryption mechanism that Guacamole should use when communicating with your LDAP server. Legal values are 'none' for unencrypted LDAP, 'ssl' for LDAP over SSL/TLS (commonly known as LDAPS), or 'starttls' for STARTTLS. If omitted, encryption will not be used. |
Only the LDAP_HOSTNAME variable is required, but you may also need to specify LDAP_PORT or LDAP_ENCRYPTION_METHOD if your LDAP directory uses encryption or listens on a non-standard port:
Note that a Docker link to guacd (the --link some-guacd:guacd option above) is not required. Similar to LDAP, the connection information for guacd can be specified using environment variables, as described in the section called 'Connecting Guacamole to guacd'.
Using LDAP for authentication requires additional configuration parameters specified via environment variables. These variables collectively describe how Guacamole will query your LDAP directory:
| Variable | Description |
|---|---|
LDAP_USER_BASE_DN | The base of the DN for all Guacamole users. All Guacamole users that will be authenticating against LDAP must be descendents of this base DN. |
As with the other authentication mechanisms, if any required environment variables are omitted (including those required for connecting to the LDAP directory over the network), you will receive an error message in the logs, and the image will stop. You will then need to recreate the container with the proper variables specified.
Additional optional environment variables may be used to configure the details of your LDAP directory hierarchy, or to enable more flexible searching for user accounts:
| Variable | Description |
|---|---|
LDAP_GROUP_BASE_DN | The base of the DN for all groups that may be referenced within Guacamole configurations using the standard seeAlso attribute. All groups which will be used to control access to Guacamole configurations must be descendents of this base DN. If this variable is omitted, the seeAlso attribute will have no effect on Guacamole configurations. |
LDAP_SEARCH_BIND_DN | The DN (Distinguished Name) of the user to bind as when authenticating users that are attempting to log in. If specified, Guacamole will query the LDAP directory to determine the DN of each user that logs in. If omitted, each user's DN will be derived directly using the base DN specified with |
LDAP_SEARCH_BIND_PASSWORD | The password to provide to the LDAP server when binding as |
LDAP_USERNAME_ATTRIBUTE | The attribute or attributes which contain the username within all Guacamole user objects in the LDAP directory. Usually, and by default, this will simply be 'uid'. If your LDAP directory contains users whose usernames are dictated by different attributes, multiple attributes can be specified here, separated by commas, but beware: doing so requires that a search DN be provided with |
LDAP_CONFIG_BASE_DN | The base of the DN for all Guacamole configurations. If omitted, the configurations of Guacamole connections will simply not be queried from the LDAP directory, and you will need to store them elsewhere, such as within a MySQL or PostgreSQL database. |
As documented in Chapter 7, LDAP authentication, Guacamole does support combining LDAP with a MySQL or PostgreSQL database, and this can be configured with the Guacamole Docker image, as well. Each of these authentication mechanisms is independently configurable using their respective environment variables, and by providing the required environment variables for multiple systems, Guacamole will automatically be configured to use each when the Docker image starts.
The header authentication extension can be used to authenticate Guacamole through a trusted third-party server, where the authenticated user's username is passed back to Guacamole via a specific HTTP header. The following are valid Docker variables for enabling and configuring header authentication:
| Variable | Description |
|---|---|
HEADER_ENABLED | Enables authentication via the header extension, which causes the extension to be loaded when Guacamole starts. By default this is false and the header extension will not be loaded. |
HTTP_AUTH_HEADER | Optional environment variable that, if set, configures the name of the HTTP header that will be used used to authenticate the user to Guacamole. If this is not specified the default value of REMOTE_USER will be used. |
If you have your own or third-party extensions for Guacamole which are not supported by the Guacamole Docker image, but are compatible with the version of Guacamole within the image, you can still use them by providing a custom base configuration using the GUACAMOLE_HOME environment variable:
| Variable | Description |
|---|---|
GUACAMOLE_HOME | The absolute path to the directory within the Docker container to use as a template for the image's automatically-generated |
You will still need to follow the steps required to create the contents of GUACAMOLE_HOME specific to your extension (placing the extension itself within GUACAMOLE_HOME/extensions/guacamole.properties, etc.), but the rest of Guacamole's configuration will be handled automatically, overlaid on top of a copy of the GUACAMOLE_HOME you provide.
Because the Docker image's GUACAMOLE_HOME environment variable must point to a directory within the container, you will need to expose your custom GUACAMOLE_HOME to the container using the -v option of docker run. The container directory chosen can then be referenced in the GUACAMOLE_HOME environment variable, and the image will handle the rest automatically:
Once the Guacamole image is running, Guacamole should be accessible at http://, where HOSTNAME:8080/guacamole/HOSTNAME is the hostname or address of the machine hosting Docker, and you should a login screen. If using MySQL or PostgreSQL, the database initialization scripts will have created a default administrative user called 'guacadmin' with the password 'guacadmin'. You should log in and change your password immediately. If using LDAP, you should be able to log in as any valid user within your LDAP directory.
If you cannot access Guacamole, or you do not see a login screen, check Docker's logs using the docker logs command to determine if something is wrong. Configuration parameters may have been given incorrectly, or the database may be improperly initialized:
| Prev | Up | Next |
| Chapter 2. Installing Guacamole natively | Home | Chapter 4. Proxying Guacamole |
For local development and testing, you can run Pulsar in standalonemode on your own machine within a Docker container.
If you have not installed Docker, download the Community editionand follow the instructions for your OS.
Start Pulsar in Docker
For MacOS, Linux, and Windows:
A few things to note about this command:
- The data, metadata, and configuration are persisted on Docker volumes in order to not start 'fresh' everytime the container is restarted. For details on the volumes you can use
docker volume inspect - For Docker on Windows make sure to configure it to use Linux containers
If you start Pulsar successfully, you will see INFO-level log messages like this:
Tip
When you start a local standalone cluster, a public/defaultnamespace is created automatically. The namespace is used for development purposes. All Pulsar topics are managed within namespaces.For more information, see Topics.
Use Pulsar in Docker
Pulsar offers client libraries for Java, Go, Pythonand C++. If you're running a local standalone cluster, you canuse one of these root URLs to interact with your cluster:
pulsar://localhost:6650http://localhost:8080
The following example will guide you get started with Pulsar quickly by using the Pythonclient API.
Install the Pulsar Python client library directly from PyPI:
Consume a message
Create a consumer and subscribe to the topic:
Produce a message
Now start a producer to send some test messages:
Get the topic statistics
In Pulsar, you can use REST, Java, or command-line tools to control every aspect of the system.For details on APIs, refer to Admin API Overview.
Apache Airflow Docker Run
In the simplest example, you can use curl to probe the stats for a particular topic:
Docker Run Php Apache
The output is something like this:
