Custom Docker Images

Overview
The main Keeper Connection Manager packages include default Docker entry points, allowing deployments of Keeper Connection Manager to be automated with Docker, even if your deployment is customized with your own branding, third-party authentication extensions, or organization-specific settings.
A simple Dockerfile can be created which accomplishes the following tasks:
1.Copy a .repo file into /etc/yum.repos.d/ so the Docker image build has access to the Keeper Connection Manager packages.
2.Install any required packages for your use case.
3.Remove the .repo file so your image doesn't contain your repository credentials.
4.Apply any desired configuration (such as through a guacamole.properties.docker file).
5.Configure the environment as required for installing the Keeper Connection Manager packages used by the image (such as adding the tomcat user to any necessary groups or deploying guacamole.war).
6.Start one of the provided Docker entrypoints.
The Keeper Connection Manager packages currently include three Docker entrypoints ready for use within custom images. Which entrypoint(s) you use will depend on whether you are creating separate images for Apache Guacamole and guacd vs. an all-in-one image which contains both:
Filename
Description
​opt/keeper/share/guacamole/entrypoint-combined.sh​
Docker entrypoint which starts both the Guacamole web application and the guacd daemon. This entrypoint is part of the kcm package and additionally requires gettext to be installed.
​/opt/keeper/share/guacamole/entrypoint-guacamole.sh​
Docker entrypoint which starts only the Guacamole web application. A separate container will be needed for guacd. This entrypoint is part of the kcm package and additionally requires gettext to be installed.
​/opt/keeper/share/guacd/entrypoint-guacd.sh​
Docker entrypoint which starts only the guacd daemon. A separate container will be needed for the Guacamole web application. This entrypoint is part of the kcm package
Configuring Guacamole using guacamole.properties.docker
The entrypoint-combined.sh and entrypoint-guacamole.sh entrypoints will both check for the existence of an optional /etc/guacamole/guacamole.properties.docker file. If this file exists, it will be automatically filtered such that environment variables are substituted within the contents of the file. The filtered contents of this file will be written to /etc/guacamole/guacamole.properties, overwriting the original file, but omitting any properties which remain unset after filtering.
The filtering applied to guacamole.properties.docker leverages the envsubst utility provided by the gettext package. The gettext package must be installed within any Docker container intended to leverage guacamole.properties.docker.
For example, if an /etc/guacamole/guacamole.properties file exists within a Guacamole-only or combined image containing the following:
1
mysql-hostname: $DATABASE_HOSTNAME
2
mysql-database: guacamole_db
3
mysql-username: $DATABASE_USERNAME
4
mysql-password: $DATABASE_PASSWORD
5
​
6
ldap-hostname: $LDAP_HOSTNAME
7
ldap-port: $LDAP_PORT
Copied!
The main guacamole.properties will be generated using this as a template, substituting the values of the DATABASE_HOSTNAME, DATABASE_USERNAME, DATABASE_PASSWORD, LDAP_HOSTNAME, and LDAP_PORT environment variables. If only the DATABASE variables are set, then properties which depend on other values will automatically be omitted:
1
mysql-hostname: localhost
2
mysql-database: guacamole_db
3
mysql-username: guacamole_user
4
mysql-password: some_password
Copied!
guacamole.properties.docker can thus be used to provide a completely custom set of configuration options. Your image need only support the options you specifically need.
Creating an all-in-one image using the combined entrypoint
An all-in-one Docker image for Guacamole contains both the Guacamole web application and guacd. An image which contains both Guacamole and guacd will require at least the following packages:
kcm-guacamole
kcm-guacd
tomcat
If using LDAP and/or one of the supported databases for authentication, the relevant packages for those authentication methods will also be installed:
kcm-guacamole-auth-duo
kcm-guacamole-auth-json
kcm-guacamole-auth-ldap
kcm-guacamole-auth-mysql
kcm-guacamole-auth-postgresql
kcm-guacamole-auth-sqlserver
kcm-guacamole-auth-totp
You must also install at least one package providing protocol support. The packages required depend only on the protocols you intend to support, which may well be all protocols supported by Guacamole:
kcm-libguac-client-rdp
kcm-libguac-client-ssh
kcm-libguac-client-telnet
kcm-libguac-client-vnc
If providing support for telnet, you will also need to configure your image to use the EPEL repository by installing the epel-release package. This package will need to be installed before the kcm-libguac-client-telnet package, as its dependencies will not be able to be satisfied without EPEL:
epel-release
If you will be using guacamole.properties.docker to provide configuration options that leverage environment variables, the gettext package is required
gettext
A combined Dockerfile which provides support for absolutely all protocols, uses MySQL for authentication, and leverages guacamole.properties.docker would look like the following:
1
# Build off CentOS 7
2
FROM centos:centos7
3
​
4
# Add the Keeper Connection Manager Enterprise repository
5
COPY kcm.repo /etc/yum.repos.d/
6
​
7
# Install Guacamole, Tomcat, and guacd
8
RUN    yum install -y epel-release               \
9
    && yum install -y                            \
10
        gettext                                  \
11
        kcm                      \
12
        kcm-guacamole-auth-jdbc-mysql      \
13
        kcm-guacd                          \
14
        kcm-libguac-client-rdp             \
15
        kcm-libguac-client-ssh             \
16
        kcm-libguac-client-telnet          \
17
        kcm-libguac-client-vnc             \
18
        tomcat                                   \
19
    && yum clean all                             \
20
    && rm /etc/yum.repos.d/kcm.repo
21
​
22
# Add Tomcat service user to the "guacamole" group
23
RUN usermod -aG guacamole tomcat
24
​
25
# Deploy the Guacamole web application under Tomcat
26
RUN ln -s /opt/keeper/share/guacamole/guacamole.war /var/lib/tomcat/webapps/ROOT.war
27
​
28
# Add template guacamole.properties which will be populated with environment
29
# variables during startup by the entrypoint script
30
COPY guacamole.properties.docker /etc/guacamole/
31
​
32
# Tomcat will be accessed via port 8080
33
EXPOSE 8080
34
​
35
# Use combined Tomcat+guacd entrypoint
36
ENTRYPOINT [ "/opt/keeper/share/guacamole/entrypoint-combined.sh" ]
Copied!
Creating a separate Guacamole image (without guacd)
A Docker image contains only the Guacamole web application will require at least the following packages:
kcm-guacamole
tomcat
If using LDAP and/or one of the supported databases for authentication, the relevant packages for those authentication methods will also be installed:
kcm-guacamole-auth-saml
kcm-guacamole-auth-openid
kcm-guacamole-auth-duo
kcm-guacamole-auth-json
kcm-guacamole-auth-ldap
kcm-guacamole-auth-mysql
kcm-guacamole-auth-postgresql
kcm-guacamole-auth-sqlserver
kcm-guacamole-auth-totp
If you will be using guacamole.properties.docker to provide configuration options that leverage environment variables, the gettext package is required
gettext
A Dockerfile which contains only the web application, uses MySQL for authentication, and which leverages guacamole.properties.docker would look like the following:
1
# Build off CentOS 7
2
FROM centos:centos7
3
​
4
# Add the Keeper Connection Manager repository
5
COPY kcm.repo /etc/yum.repos.d/
6
​
7
# Install Guacamole and Tomcat
8
RUN    yum install -y                            \
9
        gettext                                  \
10
        kcm                                      \
11
        kcm-guacamole-auth-jdbc-mysql            \
12
        tomcat                                   \
13
    && yum clean all                             \
14
    && rm /etc/yum.repos.d/kcm.repo
15
​
16
# Add Tomcat service user to the "guacamole" group
17
RUN usermod -aG guacamole tomcat
18
​
19
# Deploy the Guacamole web application under Tomcat
20
RUN ln -s /opt/keeper/share/guacamole/guacamole.war /var/lib/tomcat/webapps/ROOT.war
21
​
22
# Add template guacamole.properties which will be populated with environment
23
# variables during startup by the entrypoint script
24
COPY guacamole.properties.docker /etc/guacamole/
25
​
26
# Tomcat will be accessed via port 8080
27
EXPOSE 8080
28
​
29
# Use Guacamole entrypoint
30
ENTRYPOINT [ "/opt/keeper/share/guacamole/entrypoint-guacamole.sh" ]
Copied!
Creating a separate guacd image (without Guacamole)
A Docker image which contains only guacd will require at least the kcm-guacd package:
kcm-guacd
You must also install at least one package providing protocol support. The packages required depend only on the protocols you intend to support, which may well be all protocols supported by Guacamole:
kcm-libguac-client-rdp
kcm-libguac-client-ssh
kcm-libguac-client-telnet
kcm-libguac-client-vnc
If providing support for telnet, you will also need to configure your image to use the EPEL repository by installing the epel-release package. This package will need to be installed before the kcm-libguac-client-telnet package, as its dependencies will not be able to be satisfied without EPEL:
epel-release
A Dockerfile which contains only guacd and provides support for absolutely all protocols would look like the following:
1
# Build off CentOS 7
2
FROM centos:centos7
3
​
4
# Add the Keeper Connection Manager repository
5
COPY kcm.repo /etc/yum.repos.d/
6
​
7
# Install guacd and protocol support
8
RUN    yum install -y epel-release               \
9
    && yum install -y                            \
10
        kcm-guacd                          \
11
        kcm-libguac-client-rdp             \
12
        kcm-libguac-client-ssh             \
13
        kcm-libguac-client-telnet          \
14
        kcm-libguac-client-vnc             \
15
    && yum clean all                             \
16
    && rm /etc/yum.repos.d/kcm.repo
17
​
18
# guacd will be accessed via port 4822
19
EXPOSE 4822
20
​
21
# Use guacd entrypoint
22
ENTRYPOINT [ "/opt/keeper/share/guacd/entrypoint-guacd.sh" ]
Copied!
Custom Extensions
Troubleshooting
Last modified 2mo ago
Export as PDF
Copy link
Contents
Overview
Configuring Guacamole using guacamole.properties.docker
Creating an all-in-one image using the combined entrypoint
Creating a separate Guacamole image (without guacd)
Creating a separate guacd image (without Guacamole)