<< Click to Display Table of Contents >> Raynet One > 2026.2 > User Guide > Start your journey now! > Add a new runner  Add a Linux runner via Runners

We provide the Linux variant of the runner as a Docker image. Using a dedicated Docker Compose file you can link the runner into your own Docker-powered infrastructure. The runner can be configured using environment variables in the same way as the Windows variant.

 

Some functionality tied to the Windows operating system may not be available in the Linux variant.

 

Basic Linux runner Docker compose template

services:
  rno-runner:
    container_name: rno-runner
    hostname: runner.rno
    image: raynetgmbh/raynet-one-runner:latest
    restart: always
    volumes:
      - rno_runner_data:/app/data
    environment:
      RunnerDatabaseConfig__Location: /app/data/runner.db
      Logging__LogLevel__Default: Information
      ServiceSettings__BackendServerApiUrl: [BACKENDURL]
      ServiceSettings__EnrollmentToken: [TOKEN]
      ServiceSettings__HearBeatDelaySeconds: 20
      HttpProxySettings__IsEnabled: false
      HttpProxySettings__Address: http://proxy.url/
      HttpProxySettings__Port: 3128
      HttpProxySettings__BypassProxyOnLocal: false
      HttpProxySettings__UseDefaultCredentials: false
      HttpProxySettings__UseCredentials: false
      HttpProxySettings__UserName: user
      HttpProxySettings__Password: password
      HttpProxySettings__DisableSslVerification: true
      Messaging__Configuration__Protocol: [PROTOCOL]
    sysctls:
      net.ipv4.ping_group_range: "0 2147483647"
      net.ipv4.ip_unprivileged_port_start: 591
    cap_add:
      - NET_RAW
      - NET_BIND_SERVICE
    networks:
      - rno_runner_isolation
 
networks:
  rno_runner_isolation:
 
volumes:
  rno_runner_data:

 

Copy the above template into a new Docker Compose file (named for example docker-compose.yaml) in a dedicated separate directory. Before execution using docker compose up, you need to configure it.

 

If you already have a Docker Compose file and want to extend it with the runner, copy & paste the rno-runner service entry into the service list, the rno_runner_data volume entry into the volume list and the rno_runner_isolation network into the networks list of your own file.

 

The hostname of the rno-runner container should be set to not conflict with other containers. If you already have another container using that hostname, please resolve the conflict by choosing appropriate hostnames. The runner does share its configured hostname with the system to aid configuration by placeholder.

 

It is a good idea to isolate the network traffic of the runner. That is why the runner has been assigned its own Docker network (rno_runner_isolation).

 

Important runner configuration parameters

We support the adjustment of the following configuration parameters to set-up and maintain your runner. The parameter key is in environment variable notation.

 

 

Required Linux capabilities for network operations

If the runner is intended to perform network discovery or inventory operations (for example, ping-based network scans or RVIA data uploads), the container must be granted the following Linux kernel capabilities. These are already included in the Docker Compose template above.

 

 

In addition to cap_add, the sysctls entries in the template configure the kernel to permit ICMP from unprivileged processes and allow the non-root process to bind to port 591. If you do not plan to use network discovery or the RVIA Data Service, these entries are optional.

 

Preparing the compose file for the RVIA Data Service

If you plan to run the RVIA Data Service on this Linux runner, the service port must be mapped from the Docker container to the host machine. Without this port mapping, RVIA clients located outside of the Docker network cannot reach the runner's data service endpoint to upload discovery and inventory files (.ndi, .mmi).

 

Add a ports entry to the rno-runner service in your Docker Compose file to expose the RVIA Data Service port:

 

    ports:
      - "[RVIAPORT]:[RVIAPORT]"

 

Replace [RVIAPORT] with the port number you configure in the RVIA Data Service wizard. The default port value is 591.

 

In addition to the Docker port mapping, verify that the host system's firewall permits inbound TCP traffic on the selected port from the IP addresses of all RVIA client devices that will connect to this runner. See the RVIA Data Service chapter for full configuration details and network requirements.

 

Adding transport encryption security certificate authorities to the runner container

If your runner needs to connect to secure local network endpoints that use a private or corporate CA certificate, you must configure certificate trust using OpenSSL environment variables. Because the runner container runs as a non-root user, it cannot write to system certificate directories at runtime. No custom entrypoint is required.

 

Place your CA certificate file in a certs/ directory next to the Docker Compose file. Then extend the rno-runner service definition with the following volume mount and environment variable:

 

    volumes:
      - rno_runner_data:/app/data
      - ./certs:/certs:ro
    environment:
      ...
      SSL_CERT_FILE: /certs/rootCA.crt

 

Use SSL_CERT_FILE to point OpenSSL to a single PEM file containing one or more trusted CA certificates. To trust multiple CA certificates stored as individual files in the certs/ directory, use SSL_CERT_DIR instead:

 

      SSL_CERT_DIR: /certs

 

Note: The SSL_CERT_FILE and SSL_CERT_DIR environment variables are recognized by OpenSSL on Linux and take effect at process startup without any entrypoint customization. They apply to all HTTPS connections made by the runner, including connections to the Raynet One backend. For additional details about the certificate volume-mount approach and troubleshooting, refer to the Installation Guide section Migrating Certificate Installation to Rootless Containers.