pingintelligence
description: "DEPRECATION NOTICE: As of July 2024, the PingIntelligence Docker Image is deprecated. No new image versions will be published. Existing versions will be available as indicated in the Docker Image Support Policy."
component: devops
page_id: devops::docker-images/pingintelligence/README
canonical_url: https://developer.pingidentity.com/devops/docker-images/pingintelligence/README.html
section_ids:
devops-ping-identity-devops-docker-image: Ping Identity DevOps Docker Image - pingintelligence-ase
devops-related-docker-images: Related Docker Images
devops-environment-variables: Environment Variables
devops-running-a-pingintelligence-container: Running a PingIntelligence container
devops-docker-container-hook-scripts: Docker Container Hook Scripts
---
# Ping Identity DevOps Docker Image - `pingintelligence`
## Ping Identity DevOps Docker Image - `pingintelligence-ase`
**DEPRECATION NOTICE**: As of July 2024, the PingIntelligence Docker Image is deprecated. No new image versions will be published. Existing versions will be available as indicated in the [Docker Image Support Policy](https://devops.pingidentity.com/docker-images/imageSupport/).
This docker image includes the Ping Identity PingIntelligence API Security Enforcer product binaries and associated hook scripts to create and run PingIntelligence ASE instances.
### Related Docker Images
* `pingidentity/pingbase` - Parent Image
> This image inherits inherits, and can use, Environment Variables from [pingidentity/pingbase](https://devops.pingidentity.com/docker-images/pingbase/)
* `pingidentity/pingcommon` - Common Ping files (i.e. hook scripts)
### Environment Variables
In addition to environment variables inherited from **[pingidentity/pingbase](https://devops.pingidentity.com/docker-images/pingbase/)**, the following environment `ENV` variables can be used with this image.
| ENV Variable | Default | Description |
| ------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| SHIM | ${SHIM} | |
| IMAGE\_VERSION | ${IMAGE\_VERSION} | |
| IMAGE\_GIT\_REV | ${IMAGE\_GIT\_REV} | |
| DATE | ${DATE} | |
| PING\_PRODUCT\_VERSION | ${VERSION} | |
| PING\_PRODUCT | PingIntelligence\_ASE | Ping product name |
| LICENSE\_FILE\_NAME | PingIntelligence.lic | Name of license File |
| LICENSE\_DIR | ${SERVER\_ROOT\_DIR}/config | License directory |
| LICENSE\_SHORT\_NAME | pingintelligence | Shortname used when retrieving license from License Server |
| LICENSE\_VERSION | ${LICENSE\_VERSION} | Version used when retrieving license from License Server |
| STARTUP\_COMMAND | ${SERVER\_ROOT\_DIR}/bin/start\_ase.sh | The command that the entrypoint will execute in the foreground to instantiate the container |
| STARTUP\_FOREGROUND\_OPTS | | The command-line options to provide to the the startup command when the container starts with the server in the foreground. This is the normal start flow for the container |
| STARTUP\_BACKGROUND\_OPTS | | The command-line options to provide to the the startup command when the container starts with the server in the background. This is the debug start flow for the container |
| ROOT\_USER\_PASSWORD\_FILE | | |
| ADMIN\_USER\_PASSWORD\_FILE | | |
| ENCRYPTION\_PASSWORD\_FILE | | |
| PING\_INTELLIGENCE\_ADMIN\_USER | admin | PingIntelligence global variables PingIntelligence default administrative user (this should probably not be changed) |
| PING\_INTELLIGENCE\_ADMIN\_PASSWORD | 2FederateM0re | PingIntelligence default administrative user credentials (this should be changed) |
| PING\_INTELLIGENCE\_ASE\_HTTP\_PORT | 8000 | The ASE HTTP listener port |
| PING\_INTELLIGENCE\_ASE\_HTTPS\_PORT | 8443 | The ASE HTTPS listener port |
| PING\_INTELLIGENCE\_ASE\_MGMT\_PORT | 8010 | the ASE management port |
| PING\_INTELLIGENCE\_ASE\_TIMEZONE | utc | The timezone the ASE container is operating in |
| PING\_INTELLIGENCE\_ASE\_ABS\_PUBLISH | true | Whether the ASE should poll the ABS service that publishes discovered APIs |
| PING\_INTELLIGENCE\_ASE\_ABS\_PUBLISH\_REQUEST\_MINUTES | 10 | The interval in minute to poll the API discovery list |
| PING\_INTELLIGENCE\_ASE\_MODE | sideband | Defines running mode for API Security Enforcer (Allowed values are inline or sideband). |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_SIDEBAND\_AUTHENTICATION | false | Enable client-side authentication with tokens in sideband mode |
| PING\_INTELLIGENCE\_ASE\_HOSTNAME\_REWRITE | false | |
| PING\_INTELLIGENCE\_ASE\_KEYSTORE\_PASSWORD | OBF:AES:sRNp0W7sSi1zrReXeHodKQ:lXcvbBhKZgDTrjQOfOkzR2mpca4bTUcwPAuerMPwvM4 | |
| PING\_INTELLIGENCE\_ASE\_ADMIN\_LOG\_LEVEL | 4 | For controller.log and balancer.log only 1-5 (FATAL, ERROR, WARNING, INFO, DEBUG) |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_CLUSTER | false | enable cluster |
| PING\_INTELLIGENCE\_ASE\_SYSLOG\_SERVER | | Syslog server |
| PING\_INTELLIGENCE\_ASE\_CA\_CERT\_PATH | | Path the to CA certificate |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_HEALTH | false | enable the ASE health check service |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_ABS | true | Set this value to true, to allow API Security Enforcer to send logs to ABS. |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_ABS\_ATTACK\_LIST\_RETRIEVAL | true | Toggle ABS attack list retrieval |
| PING\_INTELLIGENCE\_ASE\_BLOCK\_AUTODETECTED\_ATTACKS | false | Toggle whether ASE blocks auto-detected attacks |
| PING\_INTELLIGENCE\_ASE\_ATTACK\_LIST\_REFRESH\_MINUTES | 10 | ABS attack list retieval frequency in minutes |
| PING\_INTELLIGENCE\_ASE\_HOSTNAME\_REFRESH\_SECONDS | 60 | Hostname refresh interval in seconds |
| PING\_INTELLIGENCE\_ASE\_DECOY\_ALERT\_INTERVAL\_MINUTES | 180 | Alert interval for teh decoy services |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_XFORWARDED\_FOR | false | Toggle X-Forwarded-For |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_FIREWALL | true | Toggle ASE Firewall |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_SIDEBAND\_KEEPALIVE | false | Enable connection keepalive for requests from gateway to ASE in sideband mode When enabled, ASE sends 'Connection: keep-alive' header in response When disabled, ASE sends 'Connection: close' header in response |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_GOOGLE\_PUBSUB | false | Enable Google Pub/Sub |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_ACCESS\_LOG | true | Toggle the access log |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_AUDIT | false | Toggle audit logging |
| PING\_INTELLIGENCE\_ASE\_FLUSH\_LOG\_IMMEDIATELY | true | Toggle whether logs are flushed to disk immediately |
| PING\_INTELLIGENCE\_ASE\_HTTP\_PROCESS | 1 | The number of processes for HTTP requests |
| PING\_INTELLIGENCE\_ASE\_HTTPS\_PROCESS | 1 | The number of processes for HTTPS requests |
| PING\_INTELLIGENCE\_ASE\_ENABLE\_SSL\_V3 | false | Toggle SSLv3 — this should absolutely stay disabled |
| PING\_INTELLIGENCE\_TCP\_SEND\_BUFFER\_BYTES | 212992 | Kernel TCP send buffer size in bytes |
| PING\_INTELLIGENCE\_TCP\_RECEIVE\_BUFFER\_BYTES | 212992 | enrel TCP receive buffer size in bytes |
| PING\_INTELLIGENCE\_ASE\_ATTACK\_LIST\_MEMORY | 128MB | |
| PING\_INTELLIGENCE\_CLUSTER\_PEER\_NODE\_CSV\_LIST | | a comma-separated list of hostname:cluster\_manager\_port or IPv4\_address:cluster\_manager\_port the ASE will try to connect to each server peer in the list |
| PING\_INTELLIGENCE\_CLUSTER\_ID | ase\_cluster | The ASE cluster ID — this must be unique |
| PING\_INTELLIGENCE\_CLUSTER\_MGMT\_PORT | 8020 | The ASE cluster management port |
| PING\_INTELLIGENCE\_CLUSTER\_SECRET\_KEY | OBF:AES:nPJOh3wXQWK/BOHrtKu3G2SGiAEElOSvOFYEiWfIVSdummoFwSR8rDh2bBnhTDdJ:7LFcqXQlqkW9kldQoFg0nJoLSojnzHDbD3iAy84pT84 | Secret key required to join the cluster |
| PING\_INTELLIGENCE\_ABS\_ENDPOINT | | a comma-separated list of abs nodes having hostname:port or ipv4:port as an address. |
| PING\_INTELLIGENCE\_ABS\_ACCESS\_KEY | | access key for ase to authenticate with abs node |
| PING\_INTELLIGENCE\_ABS\_SECRET\_KEY | | secret key for ase to authenticate with abs node |
| PING\_INTELLIGENCE\_ABS\_ENABLE\_SSL | true | Setting this value to true will enable encrypted communication with ABS. |
| PING\_INTELLIGENCE\_ABS\_CA\_CERT\_PATH | | Configure the location of ABS's trusted CA certificates. |
| PING\_INTELLIGENCE\_ABS\_DEPLOYMENT\_TYPE | cloud | Default deployment type — Supported values (onprem/cloud) |
| PING\_INTELLIGENCE\_ABS\_DEPLOYMENT\_TYPE\_VALIDATION | true | Must be either cloud or onprem |
| PING\_INTELLIGENCE\_GATEWAY\_CREDENTIALS | | Obtain the appropriate JWT token in PinOne under Connections→PingIntelligence |
| PING\_INTELLIGENCE\_GATEWAY\_CREDENTIALS\_REDACT | true | |
| PING\_STARTUP\_TIMEOUT | 8 | The amount of time to wait for ASE to start before exiting |
| TAIL\_LOG\_FILES | ${SERVER\_ROOT\_DIR}/logs/access.log | Files tailed once container has started Other potentially useful log file to tail for debug purposes are logs/controller.log and logs/balancer.log |
### Running a PingIntelligence container
To run a PingIntelligence container:
```shell
docker run \
--name pingintellgence \
--publish 8443:8443 \
--detach \
--env PING_IDENTITY_ACCEPT_EULA=YES \
--env PING_IDENTITY_DEVOPS_USER=user@pingone.com \
--env PING_IDENTITY_DEVOPS_KEY=