Docker configuration reference

This reference lists the images, hostnames, environment variables, ports, and volumes you can configure for the Wowza Streaming Engine™ (WSE) and WSE Manager Docker images. To deploy the images, see Deploy Wowza Streaming Engine with Docker.

With Docker Compose, set these options in docker-compose.yaml. With standalone containers, pass them as docker run options.

Wowza Streaming Engine


Environment variables

Set environment variables under the environment key in the Compose file, or with the --env flag in the docker run command.

Variable Description
WSE_LICENSE_KEY Required. The WSE license key from your welcome email. If the key is missing or invalid, the container exits on startup.
ADMIN_USER Required on first start. An admin username. Added to the [install-dir]/conf/admin.password file. If the user already exists in admin.password, for example in a persisted conf volume, the container doesn't change it.
ADMIN_PASSWORD Required on first start. An admin password. Added to the [install-dir]/conf/admin.password file. WSE hashes the password before storing it, using PBKDF2 by default. To provide a password hash instead, set ADMIN_PASSWORD_ENCRYPTED to true.
ADMIN_PASSWORD_ENCRYPTED Set to true when ADMIN_PASSWORD is a password hash. WSE stores the hash as-is. Default: false.

Note: Docker Compose treats $ as the start of a variable, so escape each $ in the hash as $$:

environment:
    - ADMIN_PASSWORD_ENCRYPTED=true
    - ADMIN_PASSWORD=$$pbkdf2-sha512$$210000$$[salt]$$[hash]

With docker run, put the value in single quotes instead of escaping it: --env ADMIN_PASSWORD='$pbkdf2-sha512$210000$[salt]$[hash]'

ADMIN_PASSWORD_ENCODING The encoding scheme WSE uses to store the admin password:
  • pbkdf2 (default)
  • bcrypt: Existing hashes only. Requires ADMIN_PASSWORD_ENCRYPTED set to true.
  • md5
  • sha256
  • cleartext

If you provide a hash and don't set this variable, WSE detects the encoding scheme from the hash. Hashes that start with $2a$, $2b$, or $2y$ are treated as bcrypt, and all others as pbkdf2.

To use md5 or sha256, you must also update the <RestInterface> element of Server.xml. Set <AuthenticationMethod> to digest and <PasswordEncodingScheme> to the same encoding scheme.

IPWHITELIST IP addresses allowed to access the WSE REST API. Sets the <RestInterface>/<IPWhiteList> value in Server.xml.
TRANSCODER Available in the Trial image only. Enables or disables the WSE transcoder in all applications:
  • disabled: Single-bitrate streaming
  • enabled: Adaptive-bitrate streaming

If you don't set this variable, the application configuration isn't changed.

REST_API_DOCUMENTATION Enables or disables the REST API documentation server on port 8089:
  • enabled: Turns on the documentation server.
  • disabled: Turns off the documentation server. (Default)
LOG_LEVEL Log verbosity: DEBUG, INFO, WARN (default, recommended), or ERROR. WARN limits log output so WSE service messages and errors stand out.
LOG_FORMAT Set to JSON to write console (stdout) logs in JSON format, for example to send them to a log aggregator. Each entry includes the container hostname.
CLEAN_[DIRECTORY] Set to true to delete the contents of a WSE directory when the container starts. WSE then restores the image's default files for that directory. Use one of the following variables:
  • CLEAN_CONF
  • CLEAN_CONTENT
  • CLEAN_TRANSCODER
  • CLEAN_LIB
  • CLEAN_LIB_NATIVE

Warning: If the directory is mounted as a volume, the files are deleted from the host.

Ports

Map container ports to the host machine in host:container format. Use the ports key in the Compose file, or the --publish flag in a docker run command. WSE uses the default ports listed in the table below. Publish only the ports your workflows use, and make sure they aren't already in use on the host.

Port Protocol Used for
80 TCP HLS, MPEG-DASH, and RTMPT streaming
443 TCP SSL/TLS streaming (RTMPS, HTTPS, and WebRTC). See SSL/TLS.
554 TCP RTSP
1935 TCP RTMP, RTMPE, RTMPT, RTSP-interleaved, and WOWZ streaming
8086 TCP HTTP providers for server information, such as connectioncounts, serverinfo, and medialist. The deployment examples don't publish this port.
8087 TCP WSE REST API. WSE Manager connects to WSE on this port.
8089 TCP REST API documentation server. Used only when REST_API_DOCUMENTATION is enabled.
6970-6999 UDP WebRTC media. The Trial image configures WebRTC to use this port range.
10000 UDP SRT

Volumes

A volume binds a directory on the host to a directory in the container, in [host_path]:[container_path] format. Volumes persist applications, configuration, content, transcoder settings, and logs between container runs. They aren't required, but we recommend them for logs so log files don't fill the container's primary disk. Uncomment the entries in the volumes array of the Compose file as needed, or add them with the --volume flag in the docker run command. The Compose file doesn't include an entry for the logs directory, so add one if you want to persist logs.

You can mount the following WSE directories:

Container path Contents
/usr/local/WowzaStreamingEngine/applications Application directories
/usr/local/WowzaStreamingEngine/conf Server, VHost, and application configuration files, including admin.password and Server.license
/usr/local/WowzaStreamingEngine/content Video-on-demand and media files
/usr/local/WowzaStreamingEngine/transcoder Transcoder templates and settings
/usr/local/WowzaStreamingEngine/logs WSE log files
/usr/local/WowzaStreamingEngine/dvr nDVR recordings
/usr/local/WowzaStreamingEngine/keys Stream encryption key files
/usr/local/WowzaStreamingEngine/mediacache Media Cache files

If a mounted conf, content, transcoder, lib, or lib-native directory is empty when the container starts, WSE copies the image's default files into it.

Add files to a WSE directory

To add files to a WSE directory without replacing its contents, mount a host directory at the same container path with .addon added to the directory name. When the container starts, WSE copies the files from the .addon directory into the matching WSE directory. For example, to add custom module JAR files to the lib directory:

volumes:
    - ./mylibs:/usr/local/WowzaStreamingEngine/lib.addon

For the lib directory, WSE first removes older versions of each JAR file when the file name includes a semantic version, such as mymodule-1.0.3.jar.

SSL/TLS

The Trial image includes an SSL certificate for wse-trial.wowza.com, which resolves to 127.0.0.1. The Trial image downloads the latest copy of the certificate each time the container starts. For Base, Slim, and VIF, configure your own certificate to stream over SSL/TLS.

WSE Manager


Environment variables

Variable Description
WSE_HOST The WSE server address that the WSE Manager sign-in page fills in by default, for example http://wse.docker:8087. Users can still connect to another server from the sign-in page.
LOG_LEVEL Log verbosity: DEBUG, INFO, WARN (default, recommended), or ERROR.
LOG_FORMAT Set to JSON to write console (stdout) logs in JSON format. Each entry includes the container hostname.
REST_API_DOCUMENTATION Set to enabled to download the REST API documentation when the container starts and serve it at /RESTAPIDocumentation/, for example http://localhost:8088/RESTAPIDocumentation/.
VERSIONED_PATH Set to any value to also serve WSE Manager at a path that matches the image version, for example http://localhost:8088/4.12.0/.
JKS_FILE The container path to a Java KeyStore (JKS) file that WSE Manager uses to serve HTTPS on port 8443, for example /usr/local/tomcat/conf/tls.jks. Use with JKS_PASSWORD. To add the file to the container, see Volumes.
JKS_PASSWORD Password for the JKS file set in JKS_FILE.
JKS_TRIAL Set to true to serve WSE Manager over HTTPS on port 8443 using the Wowza-provided certificate for wse-trial.wowza.com. WSE Manager downloads the certificate when the container starts and ignores JKS_FILE and JKS_PASSWORD. Because the certificate is only valid for wse-trial.wowza.com, access WSE Manager at https://wse-trial.wowza.com:8443.

Ports

The WSE Manager container listens on the ports listed in the following table. To reach WSE Manager from outside the container, publish each port you need to a port on the host. For example, 8088:8080 exposes WSE Manager on port 8088 of the host, so you can sign in at http://localhost:8088.

Container port Protocol Used for
8080 TCP WSE Manager over HTTP. The deployment examples publish it on host port 8088 (8088:8080).
8443 TCP WSE Manager over HTTPS. Available only when you configure a Java KeyStore (JKS) file with the JKS_FILE and JKS_PASSWORD environment variables, or set JKS_TRIAL to true.

Volumes

To add Tomcat configuration files to WSE Manager, such as a JKS file or a custom server.xml, mount a host directory at /usr/local/tomcat/conf.addon. When the container starts, WSE Manager copies the files into /usr/local/tomcat/conf. For example:

volumes:
    - ./wse.addon/manager/conf:/usr/local/tomcat/conf.addon
environment:
    - JKS_FILE=/usr/local/tomcat/conf/tls.jks
    - JKS_PASSWORD=[keystore-password]