jetbrains/teamcity-server pulls statistics

TeamCity Server - Powerful Continuous Integration and Continuous Delivery out of the box

This is an official JetBrains TeamCity server image. The image is suitable for production use and evaluation purposes.

<img src="https://raw.githubusercontent.com/JetBrains/teamcity-docker-images/master/docs/media/GitHub.png" height="20" align="center"/> More details about tags and components are here.

How to Use This Image

First, pull the image from the Docker Hub Repository

docker pull jetbrains/teamcity-server

Linux container

Use the following command to start a container with TeamCity server

docker run --name teamcity-server-instance  \
    -v <path-to-data-directory>:/data/teamcity_server/datadir \
    -v <path-to-logs-directory>:/opt/teamcity/logs  \
    -p <port-on-host>:8111 \
    jetbrains/teamcity-server

where

• <path-to-data-directory> is the host machine directory to serve as the TeamCity Data Directory where TeamCity stores project settings and build results. Pass an empty directory for the brand new start. If the mapping is not set, you will lose all the TeamCity settings on the container shutdown.
• <path-to-logs-directory> is the host machine directory to store the TeamCity server logs. The mapping can be omitted, but then the logs will be lost on container shutdown which will make issues investigation impossible.

Due to security reasons, by default, the container is launched under user 1000. If you need root permissions (user 0), a corresponding configuration key could be passed to Docker - docker run ... --user 0 ... jetbrains/teamcity-server.

Please, note that the running of Docker Containers under root user impose potential security vulnerabilities, including privilege escalation, thus a strong security assessment of the environment is recommended prior to the start-up.

TeamCity behind HTTPS reverse proxy

If TeamCity acts as an endpoint for a reverse proxy server like Nginx or Apache, it should be configured to provide secure cookies to end users.

To achieve that, you can pass an additional -e TEAMCITY_HTTPS_PROXY_ENABLED=true parameter to the docker run command. With this parameter, TeamCity will be started with an alternative server-https-proxy.xml configuration file which enables HTTPS options.

Alternatively, you can use a custom Tomcat configuration (see below).

Configuring HTTPS Access to TeamCity Server

If a TeamCity Server uses the HTTPS connection, it transmits encrypted traffic through port 443 by default.

For security reasons, some operating systems impose restrictions on using "privileged" ports (typically, ports below 1024) for non-root users, such as user 1000. As a result, port 443 can be unavailable for processes running inside TeamCity Containers that are launched under user 1000.

To avoid this issue, do one of the following:

1. (recommended) Map a non-privileged 8443 port inside the container to the default HTTPS port 443 on a host machine. This solution allows TeamCity to be accessible via HTTPS without running the server under the root user (which is otherwise required for accessing the privileged port 443).

docker run --name teamcity-server-instance  \
    ...
    -p 443:8443
    ...
    jetbrains/teamcity-server

1. Launch TeamCity Container under a root user. This approach is less secure and is generally avoided. Before running the server under the root user, perform a thorough security risk assessment.

docker run --name teamcity-server-instance  \
    ...
    --user 0
    ...
    jetbrains/teamcity-server

Alternative Tomcat configuration

TeamCity has Tomcat J2EE server under the hood, and if you need to provide an alternative configuration for the TomCat, you can use extra parameter

-v /alternative/path/to/conf:/opt/teamcity/conf 

To get a sample of the current contents of the Tomcat's conf directory, use the docker cp command.

Windows container

docker run --name teamcity-server-instance
    -v <path-to-data-directory>:C:/ProgramData/JetBrains/TeamCity
    -v <path-to-logs-directory>:C:/TeamCity/logs
    -v <path-to-temp-directory>:C:/TeamCity/temp
    -p <port-on-host>:8111
    jetbrains/teamcity-server

See the <path-to-data-directory> and <path-to-logs-directory> descriptions above; <path-to-temp-directory> is the directory for temporary files.

We also suggest allocating a sufficient amount of resources to the Docker process, like in this example:

docker run --memory="6g" --cpus=4 -e TEAMCITY_SERVER_MEM_OPTS="-Xmx3g -XX:MaxPermSize=270m -XX:ReservedCodeCacheSize=640m" --name teamcity-server-instance
    -v <path-to-data-directory>:C:/ProgramData/JetBrains/TeamCity
    -v <path-to-logs-directory>:C:/TeamCity/logs
    -v <path-to-temp-directory>:C:/TeamCity/temp
    -p <port-on-host>:8111
    jetbrains/teamcity-server

The details on the known problems in Windows containers are available in the TeamCity documentation.

Database

TeamCity stores set of users and build results in an SQL database in addition to the Data Directory. By default, the TeamCity server uses an internal database stored on the file system under the data directory. However, production use requires an external database.…