Containers

docker pull radiatorsoftware/radiator-server:nightly

services:
  radiator:
    image: radiatorsoftware/radiator-server:latest
    container_name: radiator-server
    volumes:
      - radiator-lib:/var/lib/radiator:rw
      - radiator-log:/var/log/radiator:rw
    environment:
      # Management UI admin password hash. Override MANAGEMENT_PASSWORD in the
      # shell or .env file before production deployment.
      - MANAGEMENT_PASSWORD=${MANAGEMENT_PASSWORD:-{argon2}$$argon2id$$v=19$$m=19456,t=2,p=1$$Gogh4zohE/bskDvpWAp0hQ$$Jdr4OtvfqENd7DdM6BpYpACMcDSWi2UknKX0mqpfM+4}
      # Optional monitor-only account password hash; it is absent when unset.
      # - MONITOR_PASSWORD=${MONITOR_PASSWORD}
      # Export operations require writable temporary storage
      - TMPDIR=/var/lib/radiator/tmp
      # Additional environment variable options:
      # Override the default working directory (defaults to /var/lib/radiator)
      # - RADIATOR_SERVER_WORKING_DIR=/var/lib/radiator
      # Override the default configuration directory (defaults to /var/lib/radiator)
      # - RADIATOR_SERVER_CONFIG=/var/lib/radiator
    ports:
      # HTTP management API
      - "8443:8443/tcp"
      # Standard RADIUS authentication
      - "1812:1812/udp"
      # Standard RADIUS accounting
      - "1813:1813/udp"
      # RADIUS over TLS (RadSec), including RADIUS/1.1
      - "2083:2083/tcp"
      # CoA and Disconnect Messages
      - "3799:3799/udp"
      # TACACS+
      - "49:49/tcp"
      # TACACS+ with TLS
      - "300:300/tcp"
      # Optional: Legacy RADIUS authentication port (RFC 2865)
      # - "1645:1645/udp"
      # Optional: Legacy RADIUS accounting port (RFC 2866)
      # - "1646:1646/udp"
      # Security capabilities needed for network functions
    cap_add:
      - NET_ADMIN # Required for network interface operations
      - NET_RAW # Required for raw socket access (for packet capture)
      - NET_BIND_SERVICE # Required to bind to privileged ports (<1024)
    # Drop all other capabilities for security hardening
    cap_drop:
      - ALL
    # Prevent container from gaining additional privileges
    security_opt:
      - no-new-privileges=true
    # Set container filesystem as read-only for additional security
    read_only: true
    deploy:
      resources:
        limits:
          memory: 1g
    restart: unless-stopped
    networks:
      - radiator-net

volumes:
  radiator-lib:
    name: radiator-lib
  radiator-log:
    name: radiator-log

networks:
  radiator-net:
    driver: bridge

# This example hash corresponds to ChangeThisPassword!; replace it for production.
export MANAGEMENT_PASSWORD='{argon2}$argon2id$v=19$m=19456,t=2,p=1$Gogh4zohE/bskDvpWAp0hQ$Jdr4OtvfqENd7DdM6BpYpACMcDSWi2UknKX0mqpfM+4'
docker run --rm \
  --env MANAGEMENT_PASSWORD \
  --volume radiator-lib:/var/lib/radiator:rw \
  --volume radiator-log:/var/log/radiator:rw \
  --name radiator-server \
  --read-only \
  --publish 8443:8443/tcp \
  --publish 1812:1812/udp \
  --publish 1813:1813/udp \
  --publish 2083:2083/tcp \
  --publish 3799:3799/udp \
  --publish 49:49/tcp \
  --publish 300:300/tcp \
  --memory 1g \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  --cap-add NET_BIND_SERVICE \
  --cap-drop ALL \
  --security-opt no-new-privileges=true \
  radiatorsoftware/radiator-server:latest