This reference lists the images, hostnames, environment variables, ports, and volumes you can configure for the Wowza Streaming Engine™ (WSE) and WSE Manager Docker images. To deploy the images, see Deploy Wowza Streaming Engine with Docker.
With Docker Compose, set these options in docker-compose.yaml. With standalone containers, pass them as docker run options.
Wowza Streaming Engine
Environment variables
Set environment variables under the environment key in the Compose file, or with the --env flag in the docker run command.
| Variable | Description |
WSE_LICENSE_KEY |
Required. The WSE license key from your welcome email. If the key is missing or invalid, the container exits on startup. |
ADMIN_USER |
Required on first start. An admin username. Added to the [install-dir]/conf/admin.password file. If the user already exists in admin.password, for example in a persisted conf volume, the container doesn't change it. |
ADMIN_PASSWORD |
Required on first start. An admin password. Added to the [install-dir]/conf/admin.password file. WSE hashes the password before storing it, using PBKDF2 by default. To provide a password hash instead, set ADMIN_PASSWORD_ENCRYPTED to true. |
ADMIN_PASSWORD_ENCRYPTED |
Set to true when ADMIN_PASSWORD is a password hash. WSE stores the hash as-is. Default: false.
Note: Docker Compose treats environment:
- ADMIN_PASSWORD_ENCRYPTED=true
- ADMIN_PASSWORD=$$pbkdf2-sha512$$210000$$[salt]$$[hash]
With |
ADMIN_PASSWORD_ENCODING |
The encoding scheme WSE uses to store the admin password:
If you provide a hash and don't set this variable, WSE detects the encoding scheme from the hash. Hashes that start with To use |
IPWHITELIST |
IP addresses allowed to access the WSE REST API. Sets the <RestInterface>/<IPWhiteList> value in Server.xml. |
TRANSCODER |
Available in the Trial image only. Enables or disables the WSE transcoder in all applications:
If you don't set this variable, the application configuration isn't changed. |
REST_API_DOCUMENTATION |
Enables or disables the REST API documentation server on port 8089:
|
LOG_LEVEL |
Log verbosity: DEBUG, INFO, WARN (default, recommended), or ERROR. WARN limits log output so WSE service messages and errors stand out. |
LOG_FORMAT |
Set to JSON to write console (stdout) logs in JSON format, for example to send them to a log aggregator. Each entry includes the container hostname. |
CLEAN_[DIRECTORY] |
Set to true to delete the contents of a WSE directory when the container starts. WSE then restores the image's default files for that directory. Use one of the following variables:
Warning: If the directory is mounted as a volume, the files are deleted from the host. |
Ports
Map container ports to the host machine in host:container format. Use the ports key in the Compose file, or the --publish flag in a docker run command. WSE uses the default ports listed in the table below. Publish only the ports your workflows use, and make sure they aren't already in use on the host.
| Port | Protocol | Used for |
80 |
TCP | HLS, MPEG-DASH, and RTMPT streaming |
443 |
TCP | SSL/TLS streaming (RTMPS, HTTPS, and WebRTC). See SSL/TLS. |
554 |
TCP | RTSP |
1935 |
TCP | RTMP, RTMPE, RTMPT, RTSP-interleaved, and WOWZ streaming |
8086 |
TCP | HTTP providers for server information, such as connectioncounts, serverinfo, and medialist. The deployment examples don't publish this port. |
8087 |
TCP | WSE REST API. WSE Manager connects to WSE on this port. |
8089 |
TCP | REST API documentation server. Used only when REST_API_DOCUMENTATION is enabled. |
6970-6999 |
UDP | WebRTC media. The Trial image configures WebRTC to use this port range. |
10000 |
UDP | SRT |
Volumes
A volume binds a directory on the host to a directory in the container, in [host_path]:[container_path] format. Volumes persist applications, configuration, content, transcoder settings, and logs between container runs. They aren't required, but we recommend them for logs so log files don't fill the container's primary disk. Uncomment the entries in the volumes array of the Compose file as needed, or add them with the --volume flag in the docker run command. The Compose file doesn't include an entry for the logs directory, so add one if you want to persist logs.
You can mount the following WSE directories:
| Container path | Contents |
/usr/local/WowzaStreamingEngine/applications |
Application directories |
/usr/local/WowzaStreamingEngine/conf |
Server, VHost, and application configuration files, including admin.password and Server.license |
/usr/local/WowzaStreamingEngine/content |
Video-on-demand and media files |
/usr/local/WowzaStreamingEngine/transcoder |
Transcoder templates and settings |
/usr/local/WowzaStreamingEngine/logs |
WSE log files |
/usr/local/WowzaStreamingEngine/dvr |
nDVR recordings |
/usr/local/WowzaStreamingEngine/keys |
Stream encryption key files |
/usr/local/WowzaStreamingEngine/mediacache |
Media Cache files |
If a mounted conf, content, transcoder, lib, or lib-native directory is empty when the container starts, WSE copies the image's default files into it.
Add files to a WSE directory
To add files to a WSE directory without replacing its contents, mount a host directory at the same container path with .addon added to the directory name. When the container starts, WSE copies the files from the .addon directory into the matching WSE directory. For example, to add custom module JAR files to the lib directory:
volumes:
- ./mylibs:/usr/local/WowzaStreamingEngine/lib.addon
For the lib directory, WSE first removes older versions of each JAR file when the file name includes a semantic version, such as mymodule-1.0.3.jar.
SSL/TLS
The Trial image includes an SSL certificate for wse-trial.wowza.com, which resolves to 127.0.0.1. The Trial image downloads the latest copy of the certificate each time the container starts. For Base, Slim, and VIF, configure your own certificate to stream over SSL/TLS.
WSE Manager
Environment variables
| Variable | Description |
WSE_HOST |
The WSE server address that the WSE Manager sign-in page fills in by default, for example http://wse.docker:8087. Users can still connect to another server from the sign-in page. |
LOG_LEVEL |
Log verbosity: DEBUG, INFO, WARN (default, recommended), or ERROR. |
LOG_FORMAT |
Set to JSON to write console (stdout) logs in JSON format. Each entry includes the container hostname. |
REST_API_DOCUMENTATION |
Set to enabled to download the REST API documentation when the container starts and serve it at /RESTAPIDocumentation/, for example http://localhost:8088/RESTAPIDocumentation/. |
VERSIONED_PATH |
Set to any value to also serve WSE Manager at a path that matches the image version, for example http://localhost:8088/4.12.0/. |
JKS_FILE |
The container path to a Java KeyStore (JKS) file that WSE Manager uses to serve HTTPS on port 8443, for example /usr/local/tomcat/conf/tls.jks. Use with JKS_PASSWORD. To add the file to the container, see Volumes. |
JKS_PASSWORD |
Password for the JKS file set in JKS_FILE. |
JKS_TRIAL |
Set to true to serve WSE Manager over HTTPS on port 8443 using the Wowza-provided certificate for wse-trial.wowza.com. WSE Manager downloads the certificate when the container starts and ignores JKS_FILE and JKS_PASSWORD. Because the certificate is only valid for wse-trial.wowza.com, access WSE Manager at https://wse-trial.wowza.com:8443. |
Ports
The WSE Manager container listens on the ports listed in the following table. To reach WSE Manager from outside the container, publish each port you need to a port on the host. For example, 8088:8080 exposes WSE Manager on port 8088 of the host, so you can sign in at http://localhost:8088.
| Container port | Protocol | Used for |
8080 |
TCP | WSE Manager over HTTP. The deployment examples publish it on host port 8088 (8088:8080). |
8443 |
TCP | WSE Manager over HTTPS. Available only when you configure a Java KeyStore (JKS) file with the JKS_FILE and JKS_PASSWORD environment variables, or set JKS_TRIAL to true. |
Volumes
To add Tomcat configuration files to WSE Manager, such as a JKS file or a custom server.xml, mount a host directory at /usr/local/tomcat/conf.addon. When the container starts, WSE Manager copies the files into /usr/local/tomcat/conf. For example:
volumes:
- ./wse.addon/manager/conf:/usr/local/tomcat/conf.addon
environment:
- JKS_FILE=/usr/local/tomcat/conf/tls.jks
- JKS_PASSWORD=[keystore-password]




