keepersecurityinc/pam-gateway-base repository overview

⁠Keeper PAM Gateway Base Image (Production)

Production-ready base image for Keeper PAM Gateway containing all dependencies.

Repository: keepersecurityinc/pam-gateway-base

⁠What's Included

• Rocky Linux 9 - Enterprise Linux compatible base OS
• Python 3.12 - System Python with pip
• KCM guacd - Keeper's Guacamole fork (Keeper Connection Manager)
• KeeperDB - Database CLI tool from keeper-security/keeperdb⁠
• ODBC Drivers
  • MSSQL ODBC Driver 18 (SQL Server)
  • MariaDB ODBC (MySQL/MariaDB)
• Terminal Fonts
  • JetBrains Mono Nerd Font (primary)
  • JuliaMono (fallback for technical symbols)
• Pango 1.42.4 - Downgraded to fix underscore rendering issues

⁠What's NOT Included

This is a base image only. You must provide:

• Gateway application code (keeper-gateway.tar.gz)
• Entrypoint script
• Application-specific configuration

⁠Tag Format

Tags follow a strict naming convention for complete version tracking:

Example: el9-x86_64-py312-kdb0.38.0-kcm2.22.prod.20251202.20260113.1

Format: {os}-{arch}-{python}-{keeperdb}-{kcm_version}.{kcm_env}.{kcm_build_date}.{our_build_date}.{build_num}

Breakdown:

• el9 ← OS (Rocky Linux 9)
• x86_64 ← Architecture (x86_64 or aarch64)
• py312 ← Python version (3.12)
• kdb0.38.0 ← KeeperDB version
• kcm2.22 ← KCM version
• prod ← KCM environment (prod/dev/qa)
• 20251202 ← KCM RPM build date
• 20260113 ← Our build date
• 1 ← Build number

⁠Tag Components

⁠Available Tags

Each build creates three tags:

• Full tag: el9-x86_64-py312-kdb0.38.0-kcm2.22.prod.20251202.20260113.1 (complete version info)
• Short tag: x86_64-20260113.1 (arch + build date + build number)
• Latest: latest (points to most recent build)

Note: Short tags include architecture (x86_64 or aarch64) to support multi-arch deployments.

⁠Why Two Dates?

• KCM Build Date - When the KCM RPM was published (important for tracking which KCM build)
• Our Build Date - When we built this base image (allows rebuilding same KCM with patches)

⁠Usage

# Full tag (most specific, recommended for production)
FROM keepersecurityinc/pam-gateway-base:el9-x86_64-py312-kdb0.38.0-kcm2.22.prod.20251202.20260113.1

# Short tag (convenient, still pinned to specific build)
FROM keepersecurityinc/pam-gateway-base:x86_64-20260113.1

# Latest (always moving, use for testing only)
FROM keepersecurityinc/pam-gateway-base:latest

# Add your gateway code
COPY keeper-gateway.tar.gz /tmp/
RUN tar -xzf /tmp/keeper-gateway.tar.gz -C /opt/keeper/gateway

# Add your entrypoint
COPY entrypoint.sh /usr/local/bin/
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]

Note: For production use, pin to specific version tags (full or short) for reproducibility.

⁠Platform

• Architecture: linux/amd64
• OS: Rocky Linux 9

⁠Runtime User

The image includes a pre-configured non-privileged user:

• User: keeper-gw
• Groups: keeper-gw, guacd
• Home: /home/keeper-gw

Important: No default USER is set in the Dockerfile. This is intentional because:

• This is a base image - your entrypoint controls the runtime user
• Your entrypoint may need to perform root operations first (setup, permissions, etc.)
• Then switch to keeper-gw for running the gateway

Your entrypoint should switch to keeper-gw:

#!/bin/bash
# Do root setup if needed
# ...

# Switch to keeper-gw user
exec su keeper-gw -s /bin/bash -c "exec your-gateway-command"

⁠Key Directories

• /opt/keeper/sbin/guacd - KCM guacd binary
• /opt/keeper/keeperdb/ - KeeperDB installation
• /recording_pipes/ - Recording pipes directory (700 permissions)
• /etc/guacamole/ - Guacamole configuration

⁠Labels

All images include OCI standard labels plus custom Keeper labels for version tracking:

org.opencontainers.image.vendor=Keeper Security
org.opencontainers.image.version=<tag>
com.keepersecurity.python.version=3.12
com.keepersecurity.kcm.version=2.22
com.keepersecurity.kcm.env=prod
com.keepersecurity.kcm.build-date=20251202
com.keepersecurity.keeperdb.version=0.38.0
com.keepersecurity.build-date=20260113
com.keepersecurity.build-number=1
com.keepersecurity.os=rocky9

Query labels:

docker inspect keepersecurityinc/pam-gateway-base:latest --format '{{json .Config.Labels}}' | jq

⁠Variants

• keepersecurityinc/pam-gateway-base (this repo) - Production clean base
• keepersecurityinc/pam-gateway-base-dev - Dev/QA variant with Zscaler cert, sudo, and dev tools