---
title: "Signer - Setup on Docker"
description: "Setup of Signer on Docker with the lacunasoftware/signer image: SQL Server database, shared storage and OIDC server (GrantID), via env variables."
canonical: "https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/docker"
locale: "en"
product: "Signer"
last_updated: "2026-10-22"
---

# Signer - Setup on Docker

For Docker-based setup the following image is provided on DockerHub:

**[Signer Docker Image](https://hub.docker.com/r/lacunasoftware/signer)**

This image requires: 

* A SQL Server Database connection: the database collation must be Latin1_General_100_CI_AI or Latin1_General_CI_AI. 
* Storage (shared between all instances of the image): see BlobStorage settings bellow for further information.
* OIDC Server ([GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id)) Cloud or On-Premises.

## Basic Configuration

The container for this image is configured using Environment variables.

Environment variable names must follow the pattern: `Section__Setting`, for instance: for the General section, to
configure the SupportEmailAddress you must set a variable with name: `General__SupportEmailAddress`.

The required settings are presented below.

### Database connection string

Under section **ConnectionStrings**:

* **DefaultConnection**: set the connection string to the database. A typical connection string looks like this:

```text
Data Source=SERVER;Initial Catalog=DATABASE;User ID=USERNAME;Password=PASSWORD
```

> **Note**
>
> If you created the database using advanced features such as log shipping or mirroring, your connection string may be different

Example:

```sh
ConnectionStrings__DefaultConnection=Server=SERVER;Initial Catalog=DATABASE;User ID=USERNAME;Password=PASSWORD;
```

> **Note**
>
> Most Server endpoints require the following format for the Data Source/Server parameter:

```sh
tcp:<hostname>,<portnumber>
```

### BlobStorage Section

Defines how the application will store and retrieve files.

See [BlobStorage Configuration](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/blob-storage) for details and examples of supported services.

### Serilog Section

Defines where application logs will be stored. 

Please see [Serilog Configuration](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/serilog) for details and examples of supported services.

### Open ID Connect configuration

The section **Oidc** configures the OpenID Connect server, required for user management. A [GrantID](https://docs.lacunasoftware.com/en-us/articles/grant-id) subscription is required.

You can either use a SaaS subscription on [grantid.com](https://grantid.com/) or run your own instance of GrantID.

* **Authority**: the OIDC authority (e.g. *https://patorum.grantid.com*)
* **ApiEndpoint**: the API endpoint of the OIDC server (e.g. *https://api.grantid.com*)
* **ApiName**: the API scope that will be required on access tokens
* **ClientAppId**: the *client id* of the dashboard app
* **AppId**: the *client id* of the backend app
* **AppSecret**: the *client secret* of the backend app
* **RequireHttps** (optional): set to `false` if the OIDC server does not use HTTPS

See [Configuring a SPA Application page](https://docs.lacunasoftware.com/en-us/articles/grant-id/on-premises/configure-spa-app) for instructions on how to obtain these values.

Example:

```sh
Oidc__ApiEndpoint=https://api.grantid.com
Oidc__ApiName=myapp-api
Oidc__AppId=myapp-backend
Oidc__AppSecret=8CqeGeur46k...
Oidc__Authority=https://mysubscription.grantid.com
Oidc__ClientAppId=myapp
Oidc__CpfClaim=cpf
Oidc__CustomScopes=mysub-cpf
```

### PKI Suite

Under section **PkiSuite**:

* **SdkLicense**: your license for the PKI SDK, in Base64 format (**required**)
* **WebLicense**: your license for the Web PKI component in binary (Base64) format. Only required if users will issue certificates on their computers (web issuing procedure)
* **WebBrand**: if you have a custom *setup brand* on Web PKI, set it here

Example:

```sh
PkiSuite__SdkLicense=AxAAzHeWJY9AK...
PkiSuite__WebLicense=ApwBY29uZml1A...
```

### General Configuration

* **SiteUrl**: the URL where the application will be running from.
* **SiteName**: the name of the application.
* **SupportEmailAddress**: the support email which will be included at the bottom of every email sent by the application.

Example: 

```sh
General__SiteUrl=https://signer.myapp.com
General__SiteName=MyApp Signer
General__SupportEmailAddress=support@email.com
```

### Bindings Configuration

* **UseReverseProxy**: set as `true` if the container will be executed behind a reverse proxy or load balancer. It can be omitted otherwise.

```sh
Bindings__UseReverseProxy=true
```

### Email sending

Under section **Email**:

* **Enabled**: by default, email sending is enabled. To disable it, set this setting to `false` and ignore the remainder of this section
* **ServerHost**: hostname of the SMTP server
* **EnableSsl**: by default, the SMTP conversation is performed over SSL. To disable SSL, set this setting to `false`
* **ServerPort**: by default, the SMTP conversation is performed over port 587. Set this setting to use a different port
* **Username** and **Password**: if the SMTP server requires authentication, set these settings
* **SenderAddress**: email address to be used as sender (*from* field)
* **SenderName**: name to be used as the sender name (optional)

Example:

```sh
Email__ServerHost=email-smtp.us-east-1.amazonaws.com
Email__Username=USERNAME
Email__Password=PASSWORD
Email__SenderAddress=no-reply@email.com
Email__SenderName=MYAPPNAME
```

## Additional Configuration

Additional settings can be found at the [Signer Settings page](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/settings).

## Installation

Pull the latest stable image, configure the required environment variables and run the container. 

> **Warning**
>
> Start with **only one container** as in the first startup, the database tables will be created (more containers could create a race condition). 
> Once the initial startup is complete, you may run as many containers as you want.

## Updating Guidelines

See [Updating Signer on Docker](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/docker/update).

## See also

* [Updating Signer on Docker](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises/docker/update)
* [Signer on-premises](https://docs.lacunasoftware.com/en-us/articles/signer/on-premises)