Running with Docker Compose

While Cadenza can be started as a single container on the command line, it is recommended using Docker Compose. Managing multiple containers — including configuration, dependencies, and lifecycle — is significantly easier with a compose setup.

Prerequisites

Software Requirements

Before running Cadenza with Docker Compose, ensure you have the following installed:

Docker Engine (tested with version 29.x or newer)
Docker Compose (tested with version 5.1.x or newer)

Hardware Requirements

See Server Requirements for hardware requirements.

Setting Up the Working Directory

All files must be placed in a common working directory with the following structure:

<working-directory>/
├── compose.yaml
├── config/
│   └── config-dev.yaml
└── logs/

To set up the directory:

Create a working directory and navigate to it:
```
mkdir cadenza && cd cadenza
```
Create the config and logs subdirectories:
```
mkdir config logs
```
Copy compose.yaml and config/config-dev.yaml from the next section into the respective files using the copy-to-clipboard buttons.

The logs/ directory is mounted into the container at /usr/local/tomcat/logs. It must exist before starting Cadenza — otherwise Docker creates it as root and Cadenza may not have write access.

Compose File and Cadenza Configuration

The provided compose.yaml uses H2 databases for persistence, stored in a Docker volume. It is suitable for local development, testing, and quick evaluation of Cadenza.

compose.yaml

---
services:
  cadenza:
    image: registry-ext.disy.net/cadenza/cadenza-web:10.5-release  # Moving tag - always points to the latest patch release. Replace with a fixed version tag (e.g. 10.5.100-release) in production!
    user: "0"  # Run as root in development mode. Please adapt this for production!
    depends_on:
      migrate:
        condition: service_completed_successfully
        required: false
    environment:
      CADENZA_CONFIG_MODES: single-file,env
      CADENZA_CONFIG_FILE: /config/config.yaml
      CADENZA_EXIT_ON_STARTUP_ERROR: true
      JAVA_OPTS: >-
        -XX:InitialRAMPercentage=10
        -XX:MaxRAMPercentage=80
        -Duser.language=de
        -Duser.country=DE
      TZ: Europe/Berlin
    volumes:
      - cadenza-systemdb:/h2data
      - ./config/config-dev.yaml:/config/config.yaml
      - ./logs/:/usr/local/tomcat/logs
    ports:
      - 8080:8080
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: '2G'
        reservations:
          cpus: '0.5'
          memory: '2G'

  migrate:
    image: registry-ext.disy.net/cadenza/database-migration-tool:10.5-release  # Moving tag - always points to the latest patch release. Replace with a fixed version tag (e.g. 10.5.100-release) in production!
    user: "0"  # Run as root in development mode. Please adapt this for production!
    command: "-cm"
    restart: "no"
    environment:
      CADENZA_CONFIG_MODES: single-file,env
      CADENZA_CONFIG_FILE: /config/config.yaml
      CADENZA_EXIT_ON_STARTUP_ERROR: true
      JAVA_OPTS: >-
        -XX:InitialRAMPercentage=10
        -XX:MaxRAMPercentage=80
        -Duser.language=de
        -Duser.country=DE
      TZ: Europe/Berlin
    volumes:
      - cadenza-systemdb:/h2data
      - ./config/config-dev.yaml:/config/config.yaml
    deploy:
      resources:
        limits:
          cpus: '1'
          memory: '512M'
        reservations:
          cpus: '0.5'
          memory: '512M'
    profiles:
      - migrate

  reportgenerator:
    image: registry-ext.disy.net/cadenza/reportgenerator:cad-10.5  # Moving tag - always points to the latest Report Generator image for this Cadenza version. Replace with a fixed version tag (e.g. cad-10.5-chromium-145) in production!
    environment:
      SE_OPTS: "--host reportgenerator"
    deploy:
      resources:
        limits:
          cpus: '2'
          memory: '2G'
        reservations:
          cpus: '0.5'
          memory: '2G'

volumes:
  cadenza-systemdb:

The image tags in the compose file contain placeholders that must be replaced with the actual versions before use. See Image Versions and Tags for the versioning scheme.

config/config-dev.yaml

---
cadenzaconfig:
  plugins:
    - AccessManager_Embedded
    - WorkbookReport
  settings:
    accessmanager:
      authenticators:
        authenticator:
          - refid: Embedded
            groupMapping:
              - refid: Embedded
                value: ""
        guestsAllowed: "true"
      userPrintNameSuggestion:
        providers:
          - Embedded
    accessmanagerembedded:
      users:
        - loginName: admin
          password: admin
          realName: Achim Administrator
          email: administrator@disy.net
          groups:
            - Administrator
    basicweb:
      management:
        maxConcurrentUsers: "1000"
    core:
      systemDb:
        driverName: org.h2.Driver
        jdbcURL: jdbc:h2:/h2data/systemdb
        user: systemdb
        password: systemdb
        connectionPoolSize: 3
        minimumIdleConnectionCount: 15
      secretHandling:
        processor: pass-through
      licenseKey: AANEQ1AAAAAAAvVJv6ztAAV1cgADW1tCS/0ZFWdn2zcCAAB4cAAAARV1cgACW0Ks8xf4BghU4AIAAHhwAAAAIC8gxaEhS+kwG0E1zARXyrjGQKFsRZ/tbfqTfyJuYLTBdXEAfgACAAAAIDekVggz7mWh/OmM11XKZs9/0Gs9OcG603wZ9JmOVlHBdXEAfgACAAAAIQCiOBB6zaz8kv2kIFKo7XOvnKOl6NMq6dEW6+tNiD4xVnVxAH4AAgAAACAvIMWhIUvpMBtBNcwEV8q4xkChbEWf7W36k38ibmC0wXVxAH4AAgAAACBCaeuyADCCx681qqwhxW93lH7fRLJY/+MN61gsvZ2WYnVxAH4AAgAAACEAoYhhKJpQkoWlVL4jjl8awEIhk+bldreby7hUNWWX1Ax1cQB+AAIAAAAgCBfh1RTxyaL07uzLRmXFTmWCdCeFt3NK028NJQZfabh1cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAgEyRXLE6fPdJw62tnP+84fAHbFPRbS8lVJBxM3PORmWp1cQB+AAIAAAAgMrxwEtS6yPFsMwGmluMxuvOLKG1yEk+C3ZN0xju1iiV1cQB+AAIAAAAgdxiNtgohTJkSJ8mpkUGhmWhsZmr9VWXlyEBmYFof2411cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgNgnv7tQqyTvYXbgd6WGX7BLTexeutITl+RQPM5ECtEB1cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAgJkq0/M8VAvM0YrVyZb1khAT85f8xc7BGvvQn+Ue8Dbp1cQB+AAIAAAAgf7tp4nkdswzOvqBKHK1A3PY4aF79sdRJvfKzfppz3LB1cQB+AAIAAAAgDCwesTHLmgu7+sQ5eqfZDbYBKn8TCz4pEl8JGmWURfV1cQB+AAIAAAAgMC5MWmx96wDWvLcLCxF/5R5W5i6rcI22XDbWTo2DaDZ1cQB+AAIAAAAgDsy/8uFGDjH5567blX89qbfOvVSrcLt+4B3ktPY/e6h1cQB+AAIAAAAgDCwesTHLmgu7+sQ5eqfZDbYBKn8TCz4pEl8JGmWURfV1cQB+AAIAAAAgJkq0/M8VAvM0YrVyZb1khAT85f8xc7BGvvQn+Ue8Dbp1cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAhAKVIujNZlhyRwJhVHQw8daJ3oTYzeA3MlsWecuCo7igxdXEAfgACAAAAIFF8a3VCQbo5DTe7dWLHqjoekMKK5pGGRI66MzuE/yTWdXEAfgACAAAAICYUcCrMIBvBzpOL71EU9A+7yrTmy1MoxYPmKcn0HHGIdXEAfgACAAAAIHYX1soPDnq2wbVxG4cCWMuZZJFa2sTnY8wRYF5g0O5rdXEAfgACAAAAIGy8EHkJ5MhNOac/LATzdGF0/Kqcp+NexdK6kqJu6iQTdXEAfgACAAAAIDYJ7+7UKsk72F24Helhl+wS03sXrrSE5fkUDzORArRAdXEAfgACAAAAICNiC4SLE0zm+Ew4QxfBi5acIE7fomJfTl2YjUSCEA0ddXEAfgACAAAAICZKtPzPFQLzNGK1cmW9ZIQE/OX/MXOwRr70J/lHvA26dXEAfgACAAAAICNiC4SLE0zm+Ew4QxfBi5acIE7fomJfTl2YjUSCEA0ddXEAfgACAAAAIDekVggz7mWh/OmM11XKZs9/0Gs9OcG603wZ9JmOVlHBdXEAfgACAAAAIQCiOBB6zaz8kv2kIFKo7XOvnKOl6NMq6dEW6+tNiD4xVnVxAH4AAgAAACA9ee8xtwT6R41xtpuxUsbkhxj/Ai4fdmt0RXkcKOePlXVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACA4FkOnwwuWPVtGTV6uOHbPoKUua5ti0NBJW7Pnm5SESHVxAH4AAgAAACBRK1nDYjBMNpYeiIwX3DjyD3ErTVYKMoBaQxYLSersAHVxAH4AAgAAACAwLkxabH3rANa8twsLEX/lHlbmLqtwjbZcNtZOjYNoNnVxAH4AAgAAACBjkPt2awTCHgvwaCQ8JbzIGaagFGWcuiE6eaU3RgiNi3VxAH4AAgAAACEAsxjrm4jM7/b8gpXTxNPTGb1yh6Pbqvz24Q1bBr4ogX51cQB+AAIAAAAhAKVIujNZlhyRwJhVHQw8daJ3oTYzeA3MlsWecuCo7igxdXEAfgACAAAAIDK8cBLUusjxbDMBppbjMbrziyhtchJPgt2TdMY7tYoldXEAfgACAAAAIQC2JZEwYU3pH8/0IREWpftUAup8batU4+q/Z4+gtTKweHVxAH4AAgAAACEAsGil4WV6Y626/UNaVM+1i8Y4NSc/R/gs+AS+AxcaQ1J1cQB+AAIAAAAhAKGIYSiaUJKFpVS+I45fGsBCIZPm5Xa3m8u4VDVll9QMdXEAfgACAAAAIQCz2gvlNM+3HpCz5944dLAM5/QCwg2RWj6jESN7Ddi0+XVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACEAoKhOqLVydlYx/iX0FT/hAeVkUv7fXQtxyIVc5fi9Vo91cQB+AAIAAAAgU+lR07Nxi80dHszj1xiktyOSx1HSryxWhB9FPojT8p51cQB+AAIAAAAhAKVIujNZlhyRwJhVHQw8daJ3oTYzeA3MlsWecuCo7igxdXEAfgACAAAAIDgWQ6fDC5Y9W0ZNXq44ds+gpS5rm2LQ0Elbs+eblIRIdXEAfgACAAAAIHR1776S4XzkClt3faRuqfb5HONkg9KCO6w4P7wbqNwxdXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAIAgX4dUU8cmi9O7sy0ZlxU5lgnQnhbdzStNvDSUGX2m4dXEAfgACAAAAIQCkcLe7ih66piY9qJUKmnvcClM4MZXUsdyGMknWKZzBIXVxAH4AAgAAACA4FkOnwwuWPVtGTV6uOHbPoKUua5ti0NBJW7Pnm5SESHVxAH4AAgAAACBsvBB5CeTITTmnPywE83RhdPyqnKfjXsXSupKibuokE3VxAH4AAgAAACEAiMglntSc6GqmfTCMOBw82G4kaUbADIeCwe2k8GU0Xr51cQB+AAIAAAAgNxceyuhlRLJr4eCu14lIeaBGVnMOVl6yf6WwFHoDwDN1cQB+AAIAAAAhALPaC+U0z7cekLPn3jh0sAzn9ALCDZFaPqMRI3sN2LT5dXEAfgACAAAAIQChiGEomlCShaVUviOOXxrAQiGT5uV2t5vLuFQ1ZZfUDHVxAH4AAgAAACBsvBB5CeTITTmnPywE83RhdPyqnKfjXsXSupKibuokE3VxAH4AAgAAACEApUi6M1mWHJHAmFUdDDx1onehNjN4DcyWxZ5y4KjuKDF1cQB+AAIAAAAhAIjIJZ7UnOhqpn0wjDgcPNhuJGlGwAyHgsHtpPBlNF6+dXEAfgACAAAAIGy8EHkJ5MhNOac/LATzdGF0/Kqcp+NexdK6kqJu6iQTdXEAfgACAAAAIQC6Lzy4eqLn99OYeaPi8kRS/wd3GlrlJ/pWB7cG1c/rDHVxAH4AAgAAACBsvBB5CeTITTmnPywE83RhdPyqnKfjXsXSupKibuokE3VxAH4AAgAAACEAsGil4WV6Y626/UNaVM+1i8Y4NSc/R/gs+AS+AxcaQ1J1cQB+AAIAAAAhAKCoTqi1cnZWMf4l9BU/4QHlZFL+310LcciFXOX4vVaPdXEAfgACAAAAIDK8cBLUusjxbDMBppbjMbrziyhtchJPgt2TdMY7tYoldXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAIDekVggz7mWh/OmM11XKZs9/0Gs9OcG603wZ9JmOVlHBdXEAfgACAAAAIQCiOBB6zaz8kv2kIFKo7XOvnKOl6NMq6dEW6+tNiD4xVnVxAH4AAgAAACA9ee8xtwT6R41xtpuxUsbkhxj/Ai4fdmt0RXkcKOePlXVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACA4FkOnwwuWPVtGTV6uOHbPoKUua5ti0NBJW7Pnm5SESHVxAH4AAgAAACBRK1nDYjBMNpYeiIwX3DjyD3ErTVYKMoBaQxYLSersAHVxAH4AAgAAACAjYguEixNM5vhMOEMXwYuWnCBO36JiX05dmI1EghANHXVxAH4AAgAAACBjkPt2awTCHgvwaCQ8JbzIGaagFGWcuiE6eaU3RgiNi3VxAH4AAgAAACEAsxjrm4jM7/b8gpXTxNPTGb1yh6Pbqvz24Q1bBr4ogX51cQB+AAIAAAAhAKVIujNZlhyRwJhVHQw8daJ3oTYzeA3MlsWecuCo7igxdXEAfgACAAAAIDgWQ6fDC5Y9W0ZNXq44ds+gpS5rm2LQ0Elbs+eblIRIdXEAfgACAAAAIHR1776S4XzkClt3faRuqfb5HONkg9KCO6w4P7wbqNwxdXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAIAgX4dUU8cmi9O7sy0ZlxU5lgnQnhbdzStNvDSUGX2m4dXEAfgACAAAAIQCkcLe7ih66piY9qJUKmnvcClM4MZXUsdyGMknWKZzBIXVxAH4AAgAAACA4FkOnwwuWPVtGTV6uOHbPoKUua5ti0NBJW7Pnm5SESHVxAH4AAgAAACEApUi6M1mWHJHAmFUdDDx1onehNjN4DcyWxZ5y4KjuKDF1cQB+AAIAAAAhAKGIYSiaUJKFpVS+I45fGsBCIZPm5Xa3m8u4VDVll9QMdXEAfgACAAAAIQCgqE6otXJ2VjH+JfQVP+EB5WRS/t9dC3HIhVzl+L1Wj3VxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACBT6VHTs3GLzR0ezOPXGKS3I5LHUdKvLFaEH0U+iNPynnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACBsvBB5CeTITTmnPywE83RhdPyqnKfjXsXSupKibuokE3VxAH4AAgAAACEAui88uHqi5/fTmHmj4vJEUv8Hdxpa5Sf6Vge3BtXP6wx1cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAhALBopeFlemOtuv1DWlTPtYvGODUnP0f4LPgEvgMXGkNSdXEAfgACAAAAIQCgqE6otXJ2VjH+JfQVP+EB5WRS/t9dC3HIhVzl+L1Wj3VxAH4AAgAAACAyvHAS1LrI8WwzAaaW4zG684sobXIST4Ldk3TGO7WKJXVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACA3pFYIM+5lofzpjNdVymbPf9BrPTnButN8GfSZjlZRwXVxAH4AAgAAACEAojgQes2s/JL9pCBSqO1zr5yjpejTKunRFuvrTYg+MVZ1cQB+AAIAAAAhALBopeFlemOtuv1DWlTPtYvGODUnP0f4LPgEvgMXGkNSdXEAfgACAAAAIAkPJCHy7FPac21rTf+so6JyveMg3BnGCE6x/esogodQdXEAfgACAAAAIByS41Y9CpWu3Y8gV/kc4kW+pDilO1g62J5FnB41tyKydXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACA3pFYIM+5lofzpjNdVymbPf9BrPTnButN8GfSZjlZRwXVxAH4AAgAAACEAojgQes2s/JL9pCBSqO1zr5yjpejTKunRFuvrTYg+MVZ1cQB+AAIAAAAgdxiNtgohTJkSJ8mpkUGhmWhsZmr9VWXlyEBmYFof2411cQB+AAIAAAAgHJLjVj0Kla7djyBX+RziRb6kOKU7WDrYnkWcHjW3IrJ1cQB+AAIAAAAhALMY65uIzO/2/IKV08TT0xm9coej26r89uENWwa+KIF+dXEAfgACAAAAIDYJ7+7UKsk72F24Helhl+wS03sXrrSE5fkUDzORArRAdXEAfgACAAAAIDekVggz7mWh/OmM11XKZs9/0Gs9OcG603wZ9JmOVlHBdXEAfgACAAAAIQCiOBB6zaz8kv2kIFKo7XOvnKOl6NMq6dEW6+tNiD4xVnVxAH4AAgAAACEAs9oL5TTPtx6Qs+feOHSwDOf0AsINkVo+oxEjew3YtPl1cQB+AAIAAAAgOBZDp8MLlj1bRk1erjh2z6ClLmubYtDQSVuz55uUhEh1cQB+AAIAAAAhAJHIQbg5IRB8gSnP0PRbYoRaUNJfz4tTxGDqx+pufQIDdXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACAwLkxabH3rANa8twsLEX/lHlbmLqtwjbZcNtZOjYNoNnVxAH4AAgAAACA3pFYIM+5lofzpjNdVymbPf9BrPTnButN8GfSZjlZRwXVxAH4AAgAAACEAojgQes2s/JL9pCBSqO1zr5yjpejTKunRFuvrTYg+MVZ1cQB+AAIAAAAhALPaC+U0z7cekLPn3jh0sAzn9ALCDZFaPqMRI3sN2LT5dXEAfgACAAAAICHJkHpO6fQe3mAQChZNhDNTlbUfzPjPgCzmDLm/UuT/dXEAfgACAAAAIAgX4dUU8cmi9O7sy0ZlxU5lgnQnhbdzStNvDSUGX2m4dXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACA3pFYIM+5lofzpjNdVymbPf9BrPTnButN8GfSZjlZRwXVxAH4AAgAAACEAojgQes2s/JL9pCBSqO1zr5yjpejTKunRFuvrTYg+MVZ1cQB+AAIAAAAgIcmQek7p9B7eYBAKFk2EM1OVtR/M+M+ALOYMub9S5P91cQB+AAIAAAAhALYlkTBhTekfz/QhERal+1QC6nxtq1Tj6r9nj6C1MrB4dXEAfgACAAAAIHR1776S4XzkClt3faRuqfb5HONkg9KCO6w4P7wbqNwxdXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACA2Ce/u1CrJO9hduB3pYZfsEtN7F660hOX5FA8zkQK0QHVxAH4AAgAAACEAhK3HTb9yEFldoEQgEK3aiHXhAJXIse0YZxiuy2PLrE51cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgf7tp4nkdswzOvqBKHK1A3PY4aF79sdRJvfKzfppz3LB1cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFWdXEAfgACAAAAIAgX4dUU8cmi9O7sy0ZlxU5lgnQnhbdzStNvDSUGX2m4dXEAfgACAAAAIDK8cBLUusjxbDMBppbjMbrziyhtchJPgt2TdMY7tYoldXEAfgACAAAAIQCz2gvlNM+3HpCz5944dLAM5/QCwg2RWj6jESN7Ddi0+XVxAH4AAgAAACEAsxjrm4jM7/b8gpXTxNPTGb1yh6Pbqvz24Q1bBr4ogX51cQB+AAIAAAAhAJbbIeHu9KMk1LGX9giX4qAvHF6ufR7rJHEY8B2R1oWvdXEAfgACAAAAIAeeXvpW7ISWXaDyUTil2Qt2FWwHsdsWNi3DFuRKeQZOdXEAfgACAAAAIAxZL4vJGh2pOmz0n3sSN5fMIdDk+IggBi4rfPmZNa62dXEAfgACAAAAIH+7aeJ5HbMMzr6gShytQNz2OGhe/bHUSb3ys36ac9ywdXEAfgACAAAAIQCErcdNv3IQWV2gRCAQrdqIdeEAlcix7RhnGK7LY8usTnVxAH4AAgAAACAOzL/y4UYOMfnnrtuVfz2pt869VKtwu37gHeS09j97qHVxAH4AAgAAACEAhK3HTb9yEFldoEQgEK3aiHXhAJXIse0YZxiuy2PLrE51cQB+AAIAAAAgf7tp4nkdswzOvqBKHK1A3PY4aF79sdRJvfKzfppz3LB1cQB+AAIAAAAgDFkvi8kaHak6bPSfexI3l8wh0OT4iCAGLit8+Zk1rrZ1cQB+AAIAAAAgB55e+lbshJZdoPJROKXZC3YVbAex2xY2LcMW5Ep5Bk51cQB+AAIAAAAhAJbbIeHu9KMk1LGX9giX4qAvHF6ufR7rJHEY8B2R1oWvdXEAfgACAAAAIDAuTFpsfesA1ry3CwsRf+UeVuYuq3CNtlw21k6Ng2g2dXEAfgACAAAAIDYJ7+7UKsk72F24Helhl+wS03sXrrSE5fkUDzORArRAdXEAfgACAAAAIDekVggz7mWh/OmM11XKZs9/0Gs9OcG603wZ9JmOVlHBdXEAfgACAAAAIQCiOBB6zaz8kv2kIFKo7XOvnKOl6NMq6dEW6+tNiD4xVnVxAH4AAgAAACA9ee8xtwT6R41xtpuxUsbkhxj/Ai4fdmt0RXkcKOePlXVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACA4FkOnwwuWPVtGTV6uOHbPoKUua5ti0NBJW7Pnm5SESHVxAH4AAgAAACBRK1nDYjBMNpYeiIwX3DjyD3ErTVYKMoBaQxYLSersAHVxAH4AAgAAACA2Ce/u1CrJO9hduB3pYZfsEtN7F660hOX5FA8zkQK0QHVxAH4AAgAAACBjkPt2awTCHgvwaCQ8JbzIGaagFGWcuiE6eaU3RgiNi3VxAH4AAgAAACEAsxjrm4jM7/b8gpXTxNPTGb1yh6Pbqvz24Q1bBr4ogX51cQB+AAIAAAAhAK7cUEyKkUtD+dOX/aREuNnDM9iaLO3ZYapXZTX9PJnvdXEAfgACAAAAIQCZzyLVDDP68oGexdSL6hisWnTzQuuXLJWHEHHes3tFx3VxAH4AAgAAACAmFHAqzCAbwc6Ti+9RFPQPu8q05stTKMWD5inJ9BxxiHVxAH4AAgAAACEAsGil4WV6Y626/UNaVM+1i8Y4NSc/R/gs+AS+AxcaQ1J1cQB+AAIAAAAgNxceyuhlRLJr4eCu14lIeaBGVnMOVl6yf6WwFHoDwDN1cQB+AAIAAAAhAKCoTqi1cnZWMf4l9BU/4QHlZFL+310LcciFXOX4vVaPdXEAfgACAAAAIQCz2gvlNM+3HpCz5944dLAM5/QCwg2RWj6jESN7Ddi0+XVxAH4AAgAAACBT6VHTs3GLzR0ezOPXGKS3I5LHUdKvLFaEH0U+iNPynnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACBsvBB5CeTITTmnPywE83RhdPyqnKfjXsXSupKibuokE3VxAH4AAgAAACEAui88uHqi5/fTmHmj4vJEUv8Hdxpa5Sf6Vge3BtXP6wx1cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAhALBopeFlemOtuv1DWlTPtYvGODUnP0f4LPgEvgMXGkNSdXEAfgACAAAAIQCgqE6otXJ2VjH+JfQVP+EB5WRS/t9dC3HIhVzl+L1Wj3VxAH4AAgAAACAyvHAS1LrI8WwzAaaW4zG684sobXIST4Ldk3TGO7WKJXVxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACA3pFYIM+5lofzpjNdVymbPf9BrPTnButN8GfSZjlZRwXVxAH4AAgAAACEAojgQes2s/JL9pCBSqO1zr5yjpejTKunRFuvrTYg+MVZ1cQB+AAIAAAAgPXnvMbcE+keNcbabsVLG5IcY/wIuH3ZrdEV5HCjnj5V1cQB+AAIAAAAgKHiIxefe3jk4QxlNrySGarj1kz0Yo4ghjYb1cJUWJHd1cQB+AAIAAAAgCBfh1RTxyaL07uzLRmXFTmWCdCeFt3NK028NJQZfabh1cQB+AAIAAAAhALBopeFlemOtuv1DWlTPtYvGODUnP0f4LPgEvgMXGkNSdXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACEAltsh4e70oyTUsZf2CJfioC8cXq59HuskcRjwHZHWha91cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFWdXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAICuAan5z+eADDeEFfqn1Tbk4RpfzvGuHpy4DB6UANA2UdXEAfgACAAAAIHR1776S4XzkClt3faRuqfb5HONkg9KCO6w4P7wbqNwxdXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACAmSrT8zxUC8zRitXJlvWSEBPzl/zFzsEa+9Cf5R7wNunVxAH4AAgAAACA2Ce/u1CrJO9hduB3pYZfsEtN7F660hOX5FA8zkQK0QHVxAH4AAgAAACEAhK3HTb9yEFldoEQgEK3aiHXhAJXIse0YZxiuy2PLrE51cQB+AAIAAAAgMC5MWmx96wDWvLcLCxF/5R5W5i6rcI22XDbWTo2DaDZ1cQB+AAIAAAAgNgnv7tQqyTvYXbgd6WGX7BLTexeutITl+RQPM5ECtEB1cQB+AAIAAAAgDsy/8uFGDjH5567blX89qbfOvVSrcLt+4B3ktPY/e6h1cQB+AAIAAAAgNgnv7tQqyTvYXbgd6WGX7BLTexeutITl+RQPM5ECtEB1cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFWdXEAfgACAAAAIByS41Y9CpWu3Y8gV/kc4kW+pDilO1g62J5FnB41tyKydXEAfgACAAAAIQCgqE6otXJ2VjH+JfQVP+EB5WRS/t9dC3HIhVzl+L1Wj3VxAH4AAgAAACEAoYhhKJpQkoWlVL4jjl8awEIhk+bldreby7hUNWWX1Ax1cQB+AAIAAAAhALMY65uIzO/2/IKV08TT0xm9coej26r89uENWwa+KIF+dXEAfgACAAAAIQCIyCWe1JzoaqZ9MIw4HDzYbiRpRsAMh4LB7aTwZTRevnVxAH4AAgAAACEApUi6M1mWHJHAmFUdDDx1onehNjN4DcyWxZ5y4KjuKDF1cQB+AAIAAAAgFYxc1kPsYG4eG8nlC5IiE0uH61j6BbuvXJaeHHzb3Lx1cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFWdXEAfgACAAAAID157zG3BPpHjXG2m7FSxuSHGP8CLh92a3RFeRwo54+VdXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAIDgWQ6fDC5Y9W0ZNXq44ds+gpS5rm2LQ0Elbs+eblIRIdXEAfgACAAAAIFErWcNiMEw2lh6IjBfcOPIPcStNVgoygFpDFgtJ6uwAdXEAfgACAAAAICZKtPzPFQLzNGK1cmW9ZIQE/OX/MXOwRr70J/lHvA26dXEAfgACAAAAIGOQ+3ZrBMIeC/BoJDwlvMgZpqAUZZy6ITp5pTdGCI2LdXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACEApUi6M1mWHJHAmFUdDDx1onehNjN4DcyWxZ5y4KjuKDF1cQB+AAIAAAAgOBZDp8MLlj1bRk1erjh2z6ClLmubYtDQSVuz55uUhEh1cQB+AAIAAAAgdHXvvpLhfOQKW3d9pG6p9vkc42SD0oI7rDg/vBuo3DF1cQB+AAIAAAAgNxceyuhlRLJr4eCu14lIeaBGVnMOVl6yf6WwFHoDwDN1cQB+AAIAAAAgCBfh1RTxyaL07uzLRmXFTmWCdCeFt3NK028NJQZfabh1cQB+AAIAAAAhAKRwt7uKHrqmJj2olQqae9wKUzgxldSx3IYySdYpnMEhdXEAfgACAAAAIDgWQ6fDC5Y9W0ZNXq44ds+gpS5rm2LQ0Elbs+eblIRIdXEAfgACAAAAID18bd6fPbWRd7bB7gtToamvUZu7EuDAN1PXreAuDYMWdXEAfgACAAAAIDcXHsroZUSya+HgrteJSHmgRlZzDlZesn+lsBR6A8AzdXEAfgACAAAAIGF0QFhtG+ske7VCiVVpUeUf0nnE8BEdfYhubeeT2LpwdXEAfgACAAAAIQClSLozWZYckcCYVR0MPHWid6E2M3gNzJbFnnLgqO4oMXVxAH4AAgAAACEAoYhhKJpQkoWlVL4jjl8awEIhk+bldreby7hUNWWX1Ax1cQB+AAIAAAAgCBfh1RTxyaL07uzLRmXFTmWCdCeFt3NK028NJQZfabh1cQB+AAIAAAAgKHiIxefe3jk4QxlNrySGarj1kz0Yo4ghjYb1cJUWJHd1cQB+AAIAAAAgMrxwEtS6yPFsMwGmluMxuvOLKG1yEk+C3ZN0xju1iiV1cQB+AAIAAAAhAKCoTqi1cnZWMf4l9BU/4QHlZFL+310LcciFXOX4vVaPdXEAfgACAAAAIQCgqE6otXJ2VjH+JfQVP+EB5WRS/t9dC3HIhVzl+L1Wj3VxAH4AAgAAACA3Fx7K6GVEsmvh4K7XiUh5oEZWcw5WXrJ/pbAUegPAM3VxAH4AAgAAACAIF+HVFPHJovTu7MtGZcVOZYJ0J4W3c0rTbw0lBl9puHVxAH4AAgAAACEAsGil4WV6Y626/UNaVM+1i8Y4NSc/R/gs+AS+AxcaQ1J1cQB+AAIAAAAgU+lR07Nxi80dHszj1xiktyOSx1HSryxWhB9FPojT8p51cQB+AAIAAAAgJkq0/M8VAvM0YrVyZb1khAT85f8xc7BGvvQn+Ue8Dbp1cQB+AAIAAAAgI2ILhIsTTOb4TDhDF8GLlpwgTt+iYl9OXZiNRIIQDR11cQB+AAIAAAAgbLwQeQnkyE05pz8sBPN0YXT8qpyn417F0rqSom7qJBN1cQB+AAIAAAAhALovPLh6ouf305h5o+LyRFL/B3caWuUn+lYHtwbVz+sMdXEAfgACAAAAIGy8EHkJ5MhNOac/LATzdGF0/Kqcp+NexdK6kqJu6iQTdXEAfgACAAAAIQCwaKXhZXpjrbr9Q1pUz7WLxjg1Jz9H+Cz4BL4DFxpDUnVxAH4AAgAAACEAoKhOqLVydlYx/iX0FT/hAeVkUv7fXQtxyIVc5fi9Vo91cQB+AAIAAAAgMrxwEtS6yPFsMwGmluMxuvOLKG1yEk+C3ZN0xju1iiV1cQB+AAIAAAAgNxceyuhlRLJr4eCu14lIeaBGVnMOVl6yf6WwFHoDwDN1cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFWdXEAfgACAAAAIAgX4dUU8cmi9O7sy0ZlxU5lgnQnhbdzStNvDSUGX2m4dXEAfgACAAAAIDK8cBLUusjxbDMBppbjMbrziyhtchJPgt2TdMY7tYoldXEAfgACAAAAICh4iMXn3t45OEMZTa8khmq49ZM9GKOIIY2G9XCVFiR3dXEAfgACAAAAIQCzGOubiMzv9vyCldPE09MZvXKHo9uq/PbhDVsGviiBfnVxAH4AAgAAACEAui88uHqi5/fTmHmj4vJEUv8Hdxpa5Sf6Vge3BtXP6wx1cQB+AAIAAAAgJkq0/M8VAvM0YrVyZb1khAT85f8xc7BGvvQn+Ue8Dbp1cQB+AAIAAAAgN6RWCDPuZaH86YzXVcpmz3/Qaz05wbrTfBn0mY5WUcF1cQB+AAIAAAAhAKI4EHrNrPyS/aQgUqjtc6+co6Xo0yrp0Rbr602IPjFW
    databaserepository:
      repositorySchemas:
        - schemaId: DBRepo
          printName: Repository Datenbank
          jdbcURL: jdbc:h2:/h2data/repodb
          user: repodb
          password: repodb
          connectionPoolSize: 3
    jobs:
      heartbeat: PT5S
      execution:
        workerThreadPoolSize: 3
    referencingconfiguration:
      maximumExtents:
        - authority: EPSG:4326
          boundingBox:
            xMin: -180.0
            yMin: -89.9999
            xMax: 180.0
            yMax: 89.9999
        - authority: EPSG:3857
          boundingBox:
            xMin: -2.003750834E7
            yMin: -2.003750834E7
            xMax: 2.003750834E7
            yMax: 2.003750834E7
        - authority: EPSG:25831
          boundingBox:
            xMin: -67189.18
            yMin: 3556208.73
            xMax: 581490.96
            yMax: 9220698.06
        - authority: EPSG:25832
          boundingBox:
            xMin: -161912.96
            yMin: 3561928.3
            xMax: 999999.0
            yMax: 9220698.06
        - authority: EPSG:25833
          boundingBox:
            xMin: -67189.18
            yMin: 3556208.73
            xMax: 621965.35
            yMax: 9225986.93
    workbookreport:
      remoteWebDriverUrl: http://reportgenerator:4444
      threadCount: 1
      cadenzaUrl: http://cadenza:8080/cadenza

Key aspects of this configuration:

H2 Database Storage: The H2 system database is stored in a Docker volume (cadenza-systemdb) and mounted at /h2data in the container.
Configuration File: A local config-dev.yaml file is mounted into the container at /config/config.yaml.
Database Migration Service: The migrate service initializes and migrates the database schemas before Cadenza starts. It uses a Docker Compose profile and only runs when explicitly activated. See Using the Database Migration Tool for details.
Report Generator Service: A separate reportgenerator service is included for PDF export functionality.
Resource Limits: CPU and memory limits are defined to prevent resource exhaustion.
Port Mapping: Cadenza is accessible on port 8080.

Adapting for Production

The provided compose file uses moving image tags (e.g., 10.5-release, cad-10.5) that are updated with every patch release. For production deployments, replace all moving tags with fixed version tags to ensure reproducible deployments and prevent unintended Cadenza updates when images are re-pulled.

services:
  cadenza:
    image: registry-ext.disy.net/cadenza/cadenza-web:10.5.100-release
  migrate:
    image: registry-ext.disy.net/cadenza/database-migration-tool:10.5.100-release
  reportgenerator:
    image: registry-ext.disy.net/cadenza/reportgenerator:cad-10.5-chromium-145

For production deployments, at least the following aspects of the compose setup must be adapted:

Database: Replace the H2 database with a dedicated PostgreSQL or Oracle database. Configure the connection in config.yaml. See Creating Database Schemas for database setup instructions.

cadenzaconfig:
  settings:
    core:
      systemDb:
        driverName: org.postgresql.Driver
        jdbcURL: jdbc:postgresql://<host>:<port>/<database>
        user: <systemdb_user>
        password: <systemdb_password>
        connectionPoolSize: 10
    databaserepository:
      repositorySchemas:
        - schemaId: <schema_id>
          printName: <display_name>
          jdbcURL: jdbc:postgresql://<host>:<port>/<database>
          user: <databaserepository_user>
          password: <databaserepository_password>
          connectionPoolSize: 10

Once the H2 database is no longer used, remove the h2data volume mount from both the cadenza and migrate services and the volume definition at the bottom of the compose file:

services:
  cadenza:
    volumes:
      # - cadenza-systemdb:/h2data  # remove when using an external database
  migrate:
    volumes:
      # - cadenza-systemdb:/h2data  # remove when using an external database

volumes:
  # cadenza-systemdb:  # remove when using an external database

Configuration: Replace config-dev.yaml with a production configuration. In particular, set basicweb.publicCadenzaUrl to the actual public URL of your Cadenza instance. In addition - if using the report generator component - the key workbookreport.cadenzaUrl must be set to the same value. The context path - if used - must be included (e.g. https://myorg.example.com/cadenza).
```
cadenzaconfig:
  settings:
    basicweb:
      publicCadenzaUrl: https://myorg.example.com/cadenza
    workbookreport:
      cadenzaUrl: https://myorg.example.com/cadenza
```
User (cadenza and migrate services): Remove user: "0" from both the cadenza and migrate services to run the containers as the default non-root user (cadenza, UID 1001). Ensure mounted directories have appropriate permissions. See the Volume Permissions and File Access section for details.
```
services:
  cadenza:
    # user: "0"  # removed - uses image default (cadenza, UID 1001)
  migrate:
    # user: "0"  # removed - uses image default (cadenza, UID 1001)
```
Ports: Restrict port binding to specific network interfaces if Cadenza should not be accessible from all interfaces. See the Network Interface Binding section for details.
```
ports:
  - "10.10.0.1:8080:8080"  # Adapt IP to your Docker host
```
Reverse Proxy: For production deployments, placing a reverse proxy (e.g., Apache, nginx, or HAProxy) in front of Cadenza is recommended. The reverse proxy can either run as an additional service in the compose file or be operated independently outside of Docker Compose. See Reverse Proxy and Load Balancer Requirements for requirements and configuration guidance.
```
services:
  haproxy:
    image: haproxy
    ports:
      - "443:443"
    volumes:
      - ./haproxy.cfg:/usr/local/etc/haproxy/haproxy.cfg
```

Database Migration

Before starting Cadenza for the first time or after upgrading, the database schemas must be initialized or migrated using the database-migration-tool. The Cadenza Docker Compose setup wraps this tool out-of-the-box via the migrate service, which is activated using the --profile migrate flag as described in the sections below.

The database schemas must be checked and updated with each new Cadenza version. A backup before running the migration is strongly recommended.

For detailed information on the Database Migration Tool and its options, see Using the Database Migration Tool.

Starting and Stopping Cadenza

First Start

On first startup, you must run the database migration to initialize the database schema:

docker compose --profile migrate up -d

This starts all services including the migrate service, which initializes the database schema before Cadenza starts. Once all services are running, Cadenza is accessible at http://localhost:8080.

Subsequent Starts

After the initial setup, start Cadenza without the migration profile:

docker compose up -d

The -d flag runs containers in detached mode (in the background).

Stopping Services

docker compose down

The down command stops and removes containers, but preserves volumes. Your data in Docker volumes (like the H2 database) remains intact.

Restarting Services

docker compose restart

To restart a specific service:

docker compose restart cadenza

Viewing Logs

To view logs from all services:

docker compose logs

To follow logs in real-time (like tail -f):

docker compose logs -f

To view logs for a specific service:

docker compose logs cadenza
docker compose logs reportgenerator

Checking Service Status

To check the status of all services:

docker compose ps

This shows which services are running, their status, and mapped ports.

To check service health:

docker compose ps --format json | jq '.[].Health'

Updating Cadenza

To update Cadenza to a newer version:

Edit your compose file to use the new image tag (10.5.120-release in this example):

services:
  cadenza:
    image: registry-ext.disy.net/cadenza/cadenza-web:10.5.120-release  # Updated version

Pull the new images:
```
docker compose pull
```

Stop current containers and restart with migration:

docker compose down
docker compose --profile migrate up -d

Once the migration has completed successfully, subsequent starts no longer require the migration profile:
```
docker compose up -d
```

Always use --profile migrate when updating Cadenza versions to ensure database schema migrations are applied.

Before updating, ensure you have backups of your data volumes and configuration files. In production environments using PostgreSQL, create a database backup before running the migration. Consider testing the new version in a non-production environment first.

Advanced Topics

Security Considerations

When deploying Cadenza in production, consider the following security best practices:

Container User Configuration

The cadenza/cadenza-web image runs by default with the cadenza user (UID 1001, GID 1001). The development compose example in this documentation overrides this with user: "0" (root) for simplicity.

For production deployments, you should use the default non-root user or explicitly configure it:

services:
  cadenza:
    user: "1001:1001"  # Explicitly set to cadenza user (or omit for default)

Alternatively, omit the user: directive entirely to use the image’s default user:

services:
  cadenza:
    # user directive omitted - uses image default (1001:1001)
    image: registry-ext.disy.net/cadenza/cadenza-web:10.5.x-release

When using a non-root user, ensure that mounted volumes have appropriate permissions. See the "Volume Permissions and File Access" section below.

Network Interface Binding

By default, exposed ports are bound to 0.0.0.0 (all interfaces), allowing access from any network interface. For production, restrict access to specific interfaces:

ports:
  - "10.10.0.1:8080:8080"  # Adapt IP to your Docker host

Additional Security Options

You can add security options to your compose file:

services:
  cadenza:
    security_opt:
      - no-new-privileges:true  # Prevent privilege escalation
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE  # Only if binding to ports < 1024

Best Practices

Never run containers in privileged mode in production
Use Docker secrets for sensitive configuration data
Keep container images up to date with security patches
Use specific version tags, not latest
Regularly review and update your security configuration

For more information, refer to the Docker Security Documentation.

Volume Permissions and File Access

When mounting host directories into Cadenza containers, you must ensure proper file permissions for the container user to access these files.

Understanding User IDs

By default, the cadenza/cadenza-web container image runs as the cadenza user with:

User ID (UID): 1001
Group ID (GID): 1001

When a container accesses mounted volumes, it uses these numeric IDs to check permissions on the host filesystem.

Option 1: Adjust Host Directory Permissions

Change the ownership of host directories to match the container user:

# For configuration directory
chown -R 1001:1001 <working-directory>/config

# For log directory
chown -R 1001:1001 <working-directory>/logs

This is the recommended approach for dedicated Cadenza directories.

Option 2: Adjust Container User

If your host directories are owned by a different user, adjust the container user to match:

services:
  cadenza:
    user: "1500:1500"  # Match your host user's UID:GID

To find your host user’s UID and GID:

id -u  # Shows UID
id -g  # Shows GID

Common Permission Issues

If Cadenza cannot start or access files, check the container logs:

docker compose logs cadenza

Look for permission denied errors, then verify:

The ownership of mounted directories on the host
The user: setting in your compose file matches the directory ownership
The container process has read/write access to required directories