Experience Center
App Connector Deployment Guide for Docker
The App Connector Docker image is available on Docker Hub for both the arm64 and amd64 platforms:
docker pull zscaler/zpa-connector:latest.amd64docker pull zscaler/zpa-connector:latest.arm64
To learn more about the different repositories available, see Docker Hub.
Docker support is not available for Kubernetes. To learn more about support for CentOS 7.x, see End-of-Support for CentOS 7.x, RHEL 7.x, and Oracle Linux 7.x.
Prerequisites
An environment variable named ZPA_PROVISION_KEY is required to run this image. You can retrieve the provisioning key from the Admin Portal. To learn more, see About App Connector Provisioning Keys.
Only one container per host is allowed. The container is deployed in a Docker Community Edition (CE) environment and is not an orchestration tool like Docker Swarm or Kubernetes.
Deploying a Docker Image on x86-64 Systems
A minimum of 2 cores and 4 GB RAM is required for x86-64 systems.
To deploy the Docker image, create a new container using the run command and provisioning key.
Docker provides a random name for the container if you don’t include the “--name” option when you run the following command. If you want, you can replace “zpa-connector” with a different container name.
For example:
The domain (e.g., api.private.com) in the echo statement will depend on what cloud you are on.
sudo docker run -d --init\
--name zpa-connector \
--cap-add cap_net_admin \
--cap-add cap_net_bind_service \
--cap-add cap_net_raw \
--cap-add cap_sys_nice \
--cap-add cap_sys_time \
--cap-add cap_sys_resource \
--restart always \
-e ZPA_PROVISION_KEY="3|api.private.zscaler.com|..." \
zscaler/zpa-connector:latest.amd64
To deploy the Docker image, create a new container using the run command and provisioning key.
Deploying a Docker Image on an Arm Platform
A minimum of 2 cores and 4 GB RAM is required for arm64 systems.
To deploy the Docker image on ARM64 architecture, create a new container using the run command and provisioning key.
Docker provides a random name for the container if you don’t include the “--name” option when you run the following command. If you want, you can replace “zpa-connector” with a different container name.
For example:
The domain (e.g., api.private.com) in the echo statement will depend on what cloud you are on.
sudo docker run -d --init\
--name zpa-connector \
--cap-add cap_net_admin \
--cap-add cap_net_bind_service \
--cap-add cap_net_raw \
--cap-add cap_sys_nice \
--cap-add cap_sys_time \
--cap-add cap_sys_resource \
--restart always \
-e ZPA_PROVISION_KEY="2|api.private.zscaler.com|..." \
zscaler/zpa-connector:latest.arm64
To deploy the Docker container, ensure --init is included in the run command.
Linux Capabilities
The following table provides a list of Linux capabilities that the container uses:
| Linux Capability | Behavior or Operation | Description |
|---|---|---|
CAP_NET_ADMIN | Performs the following network-related operations:
| Fundamental to Private Applications networking. |
CAP_NET_BIND_SERVICE | Binds a socket to the Internet domain privileged ports (port numbers less than 1024). | This capability is required to bind to a port below 1024. If you are running a service that listens to a port above 1024, remove this capability. |
CAP_NET_RAW | Binds to any address for transparent proxying and uses RAW and PACKET sockets. | Fundamental to Private Applications networking. |
CAP_SYS_BOOT* | Reboots or loads a new kernel for future execution. | This capability is optional and can be turned off in the container. |
CAP_SYS_NICE | Performs the following network-related operations:
| Private Applications forks new processes and assigns the CPU affinity. |
CAP_SYS_TIME | Sets the system clock (i.e., settimeofday(2), time(2), adjtimex(2)) and the real-time (hardware) clock. | N/A |
CAP_SYS_RESOURCE | Increases resource limits. | Increases resource limits for SYS_RESOURCE. |