Installation as Container / with Docker
Container Basics
Cadenza can be run in a container.This method of execution has a number of advantages compared with other installation methods:
-
A container is immutable, and all configuration must be injected externally. This means that executing the container is absolutely reproducible with a given configuration
-
Containers are versioned, meaning that you can easily upgrade to newer versions without the need to change files in an existing installation
-
Containers are bundling all necessary dependencies for the execution of Cadenza. This means that you can change your execution platform without the need to install other dependencies.
While the term "container" is very generic, there are very exact specifications that you have to follow to be able to let your application run using one of the container runtimes which are able to run OCI-compliant containers.
Container Images
Cadenza and all accompanying tools are provided as OCI (Open Container Initiative) compliant container images.The following images are available for running Cadenza:
| Image Repository | Description |
|---|---|
|
Cadenza container image |
|
Report Generator image based on standalone Chromium, used for PDF export functionality |
|
Cadenza database migration tool for initializing and migrating the database schemas required for running Cadenza |
|
Cadenza documentation bundled together with a webserver |
SBOM and Vulnerability Scanning
For Container images created by Disy we provide a SBOM (Software Bill Of Materials). Based on the SBOM they are actively being scanned for known vulnerabilities using the tool grype. Known vulnerabilities that do not affect the security of the images are covered by OpenVEX documents (github.com/openvex) and published together with the installation artifacts.
Signed Images
Container images created by Disy are being signed with Cosign (github.com/sigstore/cosign) in order to ensure integrity of our images along the supply chain. Images can be verified with the Cosign command line tool with the following command:
> cosign verify --key cosign.pub \
registry-ext.disy.net/cadenza/cadenza-web:10.5.100-release > /dev/null 2>&1 \
&& echo "OK - signature valid" || echo "WARNING - signature is invalid"
OK - signature valid
Cosign does not identify container images that should be signed by a tag but uses the digest instead. This means that the signature of an image with a moving tag like 10.5-release will change over time because the tag is attached to another image once a new version is being released.
|
Public Cosign key Disy: cosign.pub
SHA256 hash of the key: 5cbd5622260d1679717a118ee0baee31f98ed0d01d1672e9ed4355d1e2b6b9e4
Image Versions and Tags
Each image is available with two types of tags:
-
Fixed version tags — point to a specific patch release and never change.
-
Moving tags — always point to the latest patch release of a major version. Moving tags are updated with every patch release and are used in the provided compose examples for easy getting started.
| For production deployments, always replace moving tags with fixed version tags to ensure reproducible deployments and prevent unintended Cadenza updates when images are re-pulled. |
Cadenza and Database Migration Tool
Fixed version tags use the scheme 10.5.x-release, where x is the patch version (e.g., 10.5.100-release).
The moving tag per major version uses the scheme 10.5-release.
The database-migration-tool image uses the same versioning scheme and tags as cadenza-web.
|
Report Generator Image Versioning
Fixed version tags use the scheme cad-10.5-chromium-145 (e.g., cad-10.5-chromium-145).
The moving tag per major version uses the scheme cad-10.5.
The reportgenerator tag must explicitly match your Cadenza version.For instructions on how to retrieve the correct image version from the cadenza-web image metadata, see Exporting PDF Reports.
|
Documentation Image Versioning
The cadenza-docs image uses the following tagging scheme: 10.5-release.The documentation for a released version is only updated when an error has been found or if a feature has been added/changed and there are no changes in the image tag for this.If you are hosting the documentation yourself you are encouraged to update the image used in your installation on a regular basis.
Container Registry
Cadenza container images are provided on https://registry-ext.disy.net, which is a Harbor Registry.
| You will need credentials (username/password) to be able to pull Cadenza container images from the disy Registry. Please get in touch with your account representative or contact kontakt@disy.net to receive these credentials. |
| For on-premises deployments where high availability of images in your own registry is required, we can provide technical accounts upon request. These accounts allow you to replicate the Cadenza images into your own container registry. |