Edit the manifest yaml file using an editor of your choice, and update the following settings to match your container deployment environment.
Common settings to be configured for any container
| Setting | Description | Example |
|---|---|---|
image_name | Enter the filename of the container image to deploy. The name must match with docker Container image filename from the default directory or the absolute path. Copy the bundle to the working directory. Currently, only tar.gz format is supported.Default recommended image directories: - Linux: /opt/omnissa/dux/images- macOS: Intel /usr/local/var/opt/omnissa/dux/images/- macOS: ARM /opt/homebrew/var/opt/omnissa/dux/images/- Windows: <dux install dir>/images. | image_name: 23.12.14-2023.12.12-95068395.tar.gz |
ssh_login_credentials | If all hosts share the same auth credentials, enter the authentication credentials. If you want to use a different set of credentials for a host, use host_info instead. Ensure to create a ssh key and copy the key to the remote VMs. For more information, see https://linuxhint.com/generate-ssh-keys-on-linux/. If all hosts use a different SSH port other than 22, uncomment the ssh_port setting and enter the port number. If not provided, the default value of 22 is used. ssh_key_path - Enter the path of ssh key. For example, /home/admin/id_rsa.ssh_port - Enter the ssh port. The default port if 22. | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
ssh_host_key_check | Use this setting to verify the identity of the remote host.1 = enabled (default; prompts on first connect).0 = disabled. Disabling reduces protection against man-in-the-middle attacks. | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
container_logging | Configure log rotation and retention for the container. max_size: Defines the maximum size of a single log file. When the file reaches this size, it is rotated. Supported units are K (kilobytes), M (megabytes), and G (gigabytes). The default is "10M". max_num_files: Specifies the maximum number of log files to retain. When the limit is reached, older files are removed. The default is "5". | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
global_base_dir | Global working/base directory under which dux creates deployment directories for all hosts. Default is SSH user’s $HOME.Use host_base_dir when the hosts have different working directories based on permission requirements for each host. | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
hosts | List of hosts/IP address where the Content Gateway container is deployed. | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
host_info | To enable per-host authentication, uncomment and configure the settings under host_info. If both ssh_key_path and ssh_password are provided, ssh_key_path takes precedence.For security reasons, storing passwords in the manifest file is not recommended. Password support is provided only as an optional fallback. Values can also be provided using environment variables. If all hosts share the same SSH credentials, use the global ssh_login_credentials.If both host_info and ssh_login_credentials are configured, the credentials under host_info take precedence for that host.If a host uses an SSH port other than 22, uncomment ssh_port and set the appropriate port number.If ssh_port is not specified, the default value 22 is used. | See Sample manifest for CG, Sample manifest for Tunnel container, Sample manifest for SEG |
host_base_dir | Per-host override for the working directory (base dir) instead of global_base_dir. | /home/admin/dux |
host_entries | Add entries to the container's host file to manually map FQDNs to IPs. | Not applicable for EIC and SEG. |
subnet_range | CIDR subnet range used for “Unique IP per device connection” (supported from Tunnel container 24.10+). Should be set per host only for basic or backend roles. | subnet_range: 192.168.8.0/23 |
uem | Enter the UEM profile information such as username to authenticate with Workspace ONE UEM API Server, UEM url, GUID,and so on. url: The Workspace ONE UEM API server URL. The destination URL must contain the protocol and hostname or IP address.For UEM settings based on container type, see Editing the manifest for CG, Editing the manifest for Tunnel container. Note: Settings in this section are not applicable for EIC. | url: example.ssdevrd.com |
permissions | Controls whether specific command categories require sudo when dux runs them (docker, file operations, system, network). Default behavior is no_sudo: false (sudo required) for security. See Permissions configuration table for detailed list. | |
ca_cert_files | Comma-separated list of additional CA certificate filenames (or absolute paths) to add to the container certificate store. These certificates are essential for enabling secure communication between the Content Gateway container and external systems. Default cert directories: Linux - /opt/omnissa/dux/certs macOS Intel - /usr/local/var/opt/omnissa/dux/certs/macOS ARM - /opt/homebrew/var/opt/omnissa/dux/certs/Windows - <dux install dir>/certs/ | cert1.crt, cert2.crt or /home/admin/proxy.crt |
Permissions configuration
The permissions section in manifest controls whether dux operations require sudo privileges. Configure this section to align security requirements with your environment's access controls.
| Field | Description | no_sudo: true | no_sudo: false (Default) |
|---|---|---|---|
| Docker Commands | Controls sudo requirement for Docker operations (running, stopping, inspecting, and fetching logs from containers) | Commands execute without sudo. User must have appropriate permissions to run Docker commands. | Commands execute with sudo for security purposes. |
| File Operations | Controls sudo requirements for file operations (creating directories, copying files, removing files, and changing ownership) | Operations execute without sudo. User must have appropriate file system permissions. | Operations execute with sudo for security purposes. |
| System Commands | Controls sudo requirement for system-level commands (managing services via systemctl, modifying system limits via ulimit, and configuring system settings via sysctl) | Commands execute without sudo. User must have appropriate permissions to execute system commands. | Commands execute with sudo for security purposes. |
| Network Configuration | Controls sudo requirements for network operations (configuring IP routes, managing firewall rules via iptables, and modifying network interfaces) | Commands execute without sudo. User must have appropriate permissions to perform network operations. | Commands execute with sudo for security purposes. |
Additional settings to be configured for specific container(s)
In addition to the common settings, ensure to configure the following settings based on the container you are deploying.
| Container | Description |
|---|---|
| Tunnel | Editing the manifest for Tunnel container |
| PAC Reader | Editing the manifest for PAC Reader |
| Content Gateway | Editing the manifest for Content Gateway |
| SEG | Editing the manifest for Secure Email Gateway |
| EIC | Editing the manifest for EIC |
Best practices for editing the manifest file
-
Backup the original file before making any changes.
-
For editing the manifest file, use text/code editors with YAML support.
-
Ensure that the file is formatted correctly. Keep indentation consistent throughout the file and use spaces for indentation.
-
Always use
key: valueformat.
Example
Correct:image_name: cg_image.tar.gz
Incorrect:image_name:cg_image.tar.gz -
Ensure to save the file with
.ymlextension. -
Use double quotes for values containing special characters.
Example:url: "https://example-uem-api.com" -
Validate the YAML file using YAML validators or command-line tools.
このページは役に立ちましたか?