Installing Docker Containers
What is Docker
Docker is a software platform that runs applications, along with their dependencies, in isolated containers. For the OPC Router, this means it runs independently of the operating system and hardware in any environment where Docker is installed, while remaining isolated from the host system.
Docker Installation
To install Docker, follow the instructions in the official Docker documentation for your platform.
To confirm that the installation was successful, run the command docker --version in the command prompt. If you receive a message such as Docker version 20.10.22, build 3a2c30b, Docker is ready for use.
In container environments (e.g., Docker, Kubernetes), licensing with online synchronization is required if the system is operated without a TPM2 module.
By default, the integrated MongoDB can only be accessed from within the container itself. If you want to access MongoDB from outside the container, you must set the environment variable MONGO_BIND to all.
For more information on environment variables for the integrated MongoDB, see the Configurable Environment Variables page.
The OPC Router Docker Images
Choosing the image is the first decision you’ll make. The OPC Router offers two different images:
- The runtime image (opcrouter/runtime) contains the OPC Router application, the web management interface, and an integrated MongoDB in which OPC Router data, such as projects, is stored.
- Like the runtime image, the service image (opcrouter/service) contains the application and web management, but does not include an integrated MongoDB. A MongoDB must be connected separately here for the application to run.
The following examples use the Runtime Image. The page External Database describes how to establish a connection to an external database.
Quick OPC Router Test Installation with Docker
The OPC Router 5 Docker container can be quickly installed for testing purposes within seconds by executing a single command:
docker run -d -e OR_DISABLE_AUTH=true -e OR_I_ACCEPT_EULA=true --name opcrouter5 -p 8080:8080 opcrouter/runtime:latest
By executing this command and setting the environment variable OR_I_ACCEPT_EULA to true, you agree to the End User License Agreement.
This command does not create persistent volumes. Therefore, deleting the container via Docker Desktop will result in the irreversible loss of all data on the container, such as configured projects. The command is therefore not suitable for production use.
Executing the command creates a new container named opcrouter5. Port 8080 is exposed to the outside, so the web management interface should be accessible locally at http://127.0.0.1:8080.
The command docker container rm -f opcrouter5 stops and deletes the container. The container’s automatically created temporary volumes, which contain the project and configuration data, are not automatically deleted by this command.
Verify Installation
Just because the Web Management interface responds doesn’t necessarily mean that the runtime is running inside the container. Therefore, check both—the interface via the mapped port and the runtime via its health endpoint:
curl -i http://localhost:8080/health/runtime/ready
200 means that the runtime is ready. To find out what other status codes mean, see Checking the Installation.
Recommended Runtime Deployment
Instead of the test installation, this section describes a Docker Run command suitable for production use. This command cannot simply be copied and run; it must be customized first.
docker run -d --pull always \
--name opcrouter5 \
-e OR_I_ACCEPT_EULA=true \
-e INITIAL_USERNAME=***** \
-e INITIAL_PASSWORD=***** \
-e TZ=Europe/Berlin \
-v opc-router-data:/data \
-v opc-router-logs:/var/log/opcrouter \
-p 8080:8080 \
-p 49420:49420 \
opcrouter/runtime:latest
This command sets OR_I_ACCEPT_EULA to true. By doing so, you accept the End User License Agreement; the service will not start without this consent. Also, replace the placeholders for INITIAL_USERNAME and INITIAL_PASSWORD with your own values if you want to use a local password login.
Several arguments are used here:
-d: The container is started as a background process--pull always: Ensures that the latest version of the image is downloaded when the command is executed, provided it differs from a version already present locally--name: Sets a unique name for the container-e: Sets an environment variable-v: Sets a persistent volume-p: Exposes an internal port on the host
Of the exposed ports, only 8080 is always required: This is how the web management interface is accessed. The remaining ports are only needed once the corresponding server plug-ins have been configured—49420 is the default port for the OPC UA server. Omit any ports you do not need; the complete list is available under Network Ports.
Regarding the environment variables, note that we are setting an initial local user with a username (INITIAL_USERNAME) and password (INITIAL_PASSWORD) as an example, which we can use to log in to Web Management. Alternatively, pure SSO/external operation without INITIAL_USERNAME and INITIAL_PASSWORD is also possible if, for example, Microsoft Entra ID or pre-provisioned external users are used. Windows authentication is not available for Docker deployments. The time zone is also set. A more detailed explanation and list of all configurable environment variables can be found here:
Configurable Environment Variables
Persistent volumes are created for the two available mount paths so that data on the container—such as the project structure, project backups, log files, etc.—is preserved when we delete the container and create a new one with the same volumes. A more detailed explanation of the available mount paths can be found here:
Automatic Connection to pronubes Management
Using environment variables, the OPC Router can be automatically connected to a pronubes Management tenant when the container starts. This causes the OPC Router to automatically appear in the tenant’s inbox without requiring manual registration.
docker run -d --name opcrouter-pronubes \
-e OR_I_ACCEPT_EULA=true \
-e OR_CONNECT_TO_PRONUBES_MANAGEMENT=true \
-e OR_ENABLE_PRONUBES_REMOTE_MANAGEMENT=true \
-e OR_PRONUBES_TENANT_ADDRESS="example.pronubes.cloud" \
-e OR_PRONUBES_TENANT_PORT=443 \
-e OR_ENABLE_PRONUBES_REMOTE_MANAGEMENT_AUTH_FORWARD=true \
-e OR_EXTERNAL_USER_ADMIN_EMAILS="admin@example.com" \
-e OR_PRONUBES_DISABLE_CERTIFICATE_AUTHORITY=false \
-p 8080:8080 \
opcrouter/runtime:latest
After the container has successfully started, the OPC Router automatically appears in the inbox of the pronubes Management Tenant. Check the status in the pronubes Management interface.
For WebUI access with Auth Forward, appropriate local external users must be available. These can be created via OR_EXTERNAL_USER_ADMIN_EMAILS, OR_EXTERNAL_USER_EDITOR_EMAILS, and OR_EXTERNAL_USER_OBSERVER_EMAILS when the container starts.
A more detailed explanation and list of all pronubes-related environment variables can be found here:
Environment variables for automatic connection to pronubes Management