> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/application-security/manage-network-tunnel/deploy-transporter-docker.md). # Set Up Transporter Network Tunnels using Docker Containers Deploy the Transporter network tunnel using Docker containers. 1. Before you begin. 1. Fulfill the [Requirements](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/manage-network-tunnel/manage-network-tunnel.md#requirements) listed in **Manage Transporter (Network Tunnel)**. 2. [Install Docker](https://docs.docker.com/engine/install/). The Transporter Client requires Docker to be installed in your environment with network access to your self-hosted provider, such as your VCS or Terraform Enterprise (Run Tasks). 3. **Proxy**: If you are using a proxy, refer to [Docker Proxy Integration](#docker-proxy-integration-) below for details on proxy connectivity. 4. **Self-signed certificates**: As mentioned in [Requirements for setting up the Transporter](https://github.com/PaloAltoNetworks/pc-docs-md/tree/main/enterprise-edition/content-collections/application-security/manage-network-tunnel/manage-network-tunnel.md#requirements), you must provide the Transporter with a TLS certificate to ensure a secure webhook connection between your version control system and the Transporter. If you are using a self-signed certificate, add a TLS CA certificate environment variables and configure the HTTPS\_CA variable. Refer to [Self-Signed Certificates](#self-signed-certificates-) below for more information. 2. On the **Application Security** console, select **Home** > **Settings** > **Network Tunnels**.
transporter network tunnel button
The **Manage Integrations** step of the installation wizard is displayed.
transporter mng int exp
1. Fill in the provided fields. * **Transporter Name**: The Transporter name serves a dual purpose: it acts as a unique identifier to group and define multiple connections on Prisma Cloud, while also functioning as the ‘Alias’ required for the transporter to successfully connect to the correct customer tenant. This alias is essential, particularly when multiple transporters are configured on the tenant, ensuring seamless and accurate connections. The Transporter name cannot contain spaces * **Transporter URL**: The URL that your firewall or proxies route to the Transporter at the port configured in the Port section * **Port**: The Transporter URL is a proxy URL with a port number you must define. This information will also be used in the Docker files that are configured in Transporter to communicate with Prisma Cloud * **Prisma Cloud Access Key ID**: The Access Key ID generated in step 1 above * **Prisma Cloud Secret Key**: The Secret key generated in step 1 above * **TLS Certificate path**: The path to the TLS certificate in order to use Transporter. Webhooks use the certificate path to integrate with Transporter. Ensure that the path is for the specified Transporter client URL and port * **TLS Certificate key path**: The path to the TLS certificate key. Allows WebSockets to encrypt traffic (communicate over HTTP). * **Provider Self Signed CA certificate path (Optional)**: The path for the self-signed CA certificate of your VCS/Terraform Enterprise provider when using self-signed certificates. * **VPN/Proxy CA certificate path (Optional)**: The path for the self-signed CA certificate of your VPN/proxy provider when using self-signed certificates, if it differs from the self-signed certificate used by the provider * **Proxy URL (Optional)**: The proxy URL, when using a proxy 2. Select **Next**. The **Deploy Client** step of the wizard is displayed.
transporter deploy client2.0
3. Copy the command from the **Verify and add permissions for set TLS Certificate path** field, and run it in your CLI terminal. This command sets the permissions for the TLS certificate and defines the local path to the certificate. .. Pull the Docker image: Copy the command from the **Docker pull CLI** field and run it in your CLI terminal. 4. Select **Using Docker commands** or **Docker compose** from the **Run Image** field to run the image and establish communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise.
transporter deploy client runimageoptions2.0
1. Option #1: **Run Image through Docker Commands** Use **Docker commands** to create a Docker image that contains the code and configuration for establishing communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise. Then run this image using Docker commands. * Copy and paste the command from the **Logs volume** command in your terminal to save the Docker logs as a dedicated volume. * Copy and paste the command from the **Docker Run CLI command** in your terminal to run the pulled Docker image. * **Enable debug level logs**: Add the `-e LOG_LEVEL=info \` environment variable to the list of variables in the **Docker Run CLI Command** field.
transporter log debug1.1
2. Option #2: **Run Image through Docker Compose** Use **Docker compose** to define a Docker application that contains the code and configuration for establishing communication between Prisma Cloud and your self-hosted VCS/Terraform Enterprise. Then run this application using Docker compose. * Copy and paste the content from the **Docker Compose Content** field into your file to create and save docker-compose file content that you can use later. * Copy and paste the command from the **Docker-Compose CLI Command** field in your CLI terminal to run the 'docker-compose' command. * **Enable debug level logs**: Add the `- LOG_LEVEL=info` environment variable to the list of variables in the **Docker Compose Content** field . The `-d` value in the command specifies the name of the Docker Compose yml file. 5. Select **Next** > **Done** to complete the integration. Only after the Transporter has run successfully can Prisma Cloud authenticate and establish a communication channel with your provider (such as VCS/Terraform Enterprise). Once the connection is established, Transporter will use WebSockets to communicate with each other. 6. **Next Step**: Select the Transporter that will act as the secure communication channel between the hosted Docker Client and Prisma Cloud. Refer to [Select Transporter and ensure Domain name consistency during Integration](/content-collections/application-security/manage-network-tunnel/select-transporter-domain-consistency.md) for more information. ## Verify Deployment and Connectivity You can verify that the transporter has been successfully deployed and is connected to your providers through both the Prisma Cloud console and your CLI. * **On Prisma Cloud console**: In **Application Security** select **Home** > **Settings > Manage Network Tunnels > Manage Integrations**. Select that your Transporter in the **Transporter** field, and verify connectivity by checking for a displayed message
transporter verify connectivity ui1.1
* **Using your CLI**: Run `docker logs [CONTAINER ID]`
transporter docker connectivity log2.2
## Add Additional Transporters You can add a new Transporter to a VCS/ Terraform Enterprise integration in **Application Security** through **Home** > **Settings** > **Manage Network Tunnels** > **Manage Integrations** > **New Transporter**, and repeating the deployment steps above. ## Manage Transporter You can manage the existing Transporter configuration in **Application Security** through **Home** > **Settings** > **Manage Network Tunnels** > **Manage Integrations**. * **Edit** Transporter: Select a Transporter from the menu in the Transporter field > Edit required the values in the same manner as the integration process above * **Delete** Transporter: Select a Transporter from the menu in the Transporter field > Click **Delete Transporter**. To delete the Transporter, you need to first remove the existing VCS/Terraform Enterprise integrations associated with it. ## Health Check The health check provides about the VCS/Terraform Enterprise integrations and the most recent connection establishment time. The Transporter runs health checks every hour, and you manually refresh the connection at any time through Prisma Cloud. For more on health checks see [Transporter Health Check](/content-collections/application-security/manage-network-tunnel/transporter-health-check.md). ## Enable Logs Configure logging to capture and store system events, errors, and activities for analysis and troubleshooting purposes by adding an environment variable. By default, set the logging level to `info`. You can adjust the `logLevel` parameter. Examples: `-e LOG_LEVEL=debug`, `- LOG_LEVEL=debug`. See **steps 4.1, 4.2** of the deployment setup above to enable logging configuration options. ## Self Signed Certificates Ensure the security of your Transporter Client when using self-signed certificates, by adding TLS CA Certificate environment variables, and configuring the HTTPS\_CA variable. ### Adding TLS CA Certificate Environment Variables To enhance security and enable TLS configuration for your Transporter Client, consider including Certificate Authority (CA) certificates. ### Configure TLS with HTTPS\_CA Variable When using a self-signed certificate for your Transporter Client, which is a common practice for internal or non-public systems, add the CA certificate that signed your self-signed certificate to the HTTPS\_CA environment variable. This step ensures that your VCS/Terraform Enterprise system can verify the domain’s identity and establish a secure connection using HTTPS, even with self-signed certificates. It is a way to establish trust for your self-signed certificate within your environment. **HTTPS\_SOCKET\_CA** ```dockerfile -e HTTPS_CA=/usr/bridgecrew/app/tls/ca.crt -v /Users/username/config/certificates/ca.pem:/usr/bridgecrew/app/tls/ca.crt ``` ### Configure Environment Variable for TLS Proxy (HTTPS\_SOCKET\_CA) When working with a TLS termination proxy in a proxy or VPN, configure the 'HTTPS\_SOCKET\_CA' environment variable with the appropriate CA certificate. This ensures secure TLS communication with properly authenticated endpoints during the TLS handshake process. This variable is required when the CA certificate used by the proxy differs from the CA certificate used by the Transporter Client (refer to the section above). **HTTPS\_SOCKET\_CA (TLS Termination Proxy CA)** ```dockerfile HTTPS_SOCKET_CA (TLS Termination Proxy CA) -e HTTPS_SOCKET_CA=/usr/bridgecrew/app/tls/ca.crt -v /Users/username/config/certificates/ca.pem:/usr/bridgecrew/app/tls/ca.crt ``` ## Docker Proxy Connectivity Using a proxy enhances security and network efficiency by enabling the establishment of a secure and isolated communication channel between the Prisma Cloud service and your self-hosted version control system, such as GitLab Self Managed or GitHub Server. The following diagram displays system architecture for proxy connectivity in a Docker Container environment.
transporter connectivity docker proxy 2.0
NOTES: * In the first diagram the connection between the VCS and Transporter Client does not pass through the firewall, while in the second diagram, the connectivity between the VCS and Transporter Client passes through a firewall * The Connectivity legend for the proxy matches with the legend Transporter connectivity above, except that traffic passes through the firewall from the Transporter Client to the Proxy, and then to the Prisma Cloud Tenant ### Configure Proxy Server and Certificate Authority (CA) Organizations using a proxy server to enhance network security can define the proxy settings using environment variables. To ensure security and integrity, configuring the Certificate Authority (CA) for the proxy is very important. ### Configure System Environment Variable Set up a proxy in your system environment using the following environment variable. `HTTPS_PROXY=http://proxy.domain.com:8080`. ### Configure Container Environment Variable For containerized environments, configure the following environment variable: `docker run -e PORT=8080 -e HTTPS_PROXY=http://proxy.domain.com:8080 bridgecrew/transporter`. ### Configure Environment Variable for TLS Proxy (HTTPS\_SOCKET\_CA) When working with a TLS termination proxy in a proxy or VPN, configure the HTTPS\_SOCKET\_CA environment variable with the appropriate CA certificate. This ensures secure TLS communication with properly authenticated endpoints during the TLS handshake process. **HTTPS\_SOCKET\_CA (TLS Termination Proxy CA)** ```dockerfile -e HTTPS_SOCKET_CA=/usr/bridgecrew/app/tls/ca.crt -v /Users/username/config/certificates/ca.pem:/usr/bridgecrew/app/tls/ca.crt ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/application-security/manage-network-tunnel/deploy-transporter-docker.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.