Standalone Container¶

The standalone image packages the complete OpenECPDS stack — MariaDB, Master Server, Data Mover, and Monitor — in a single Docker container that starts pre-configured and ready to use. No build step, no manual database setup, no separate compose file required.

Requirements¶

Start¶

docker run -d \
  --name standalone \
  -v $(pwd)/ecpds-data:/data \
  -p 7443:7443 \
  -p 7022:7022 \
  -p 8443:8443 \
  -p 8883:8883 \
  -p 127.0.0.1:8080:8080 \
  -p 127.0.0.1:9404:9404 \
  -p 127.0.0.1:9405:9405 \
  -p 127.0.0.1:9406:9406 \
  ghcr.io/ecmwf/open-ecpds/standalone:latest

The database initialises automatically on first start. The /data volume persists everything across restarts. Wait about 30 seconds for all services to become available.

Access¶

Hawtio includes preset connections for the Master, Monitor, and Mover Jolokia agents. When prompted by Hawtio, use jolokia / jolokia2021 for the Jolokia login. These credentials are for evaluation only; do not expose the standalone image to an untrusted network.

Hawtio is served over HTTPS using the same keystore as the Monitor UI (/etc/ecpds/monitor/ecpds-monitor.pfx), so the browser shows the same self-signed certificate warning. Hawtio reads the certificate at startup: after replacing the Monitor certificate, restart Hawtio with docker exec standalone supervisorctl restart hawtio. Set HAWTIO_TLS_KEYSTORE to another PKCS#12 file to use a different certificate, or to none to fall back to plain HTTP.

Exposed ports¶

Connect Grafana to Prometheus metrics¶

The JMX exporter endpoints are available at http://localhost:9404/metrics (Master), http://localhost:9405/metrics (Mover), and http://localhost:9406/metrics (Monitor) when using the localhost port mappings above. Add the endpoint(s) as Prometheus scrape targets, then configure Grafana to use that Prometheus instance as a data source. If Prometheus runs in another container, use a host address reachable from that container instead of localhost (which would refer to the Prometheus container itself). These endpoints have no authentication; keep them restricted to trusted clients.

Populate some data¶

The standalone image ships with a few example destinations (e.g. hourly_aq), but they start out empty and switched off. Before trying the protocols below, log into the Monitoring UI and start one or two of them so there is some data to experiment with. This requires the container to have outbound Internet access, as these destinations acquire data from external providers:

1. Open https://localhost:8443 and log in as admin / admin2021.
2. On the main page, in the Transmission section, select Destinations.
3. Click a destination's name (e.g. hourly_aq) in the table to open its Data page.
4. Click the green Start Destination (▶) button above the transfers table.

Once started, the destination retrieves files from its source host and makes them available through the Data Portal, so the commands below have something to list and download.

Try the protocols¶

All examples use the pre-configured test / test2021 account.

HTTPS — browser or curl¶

Open https://localhost:7443 in a browser to access the Data Portal UI, or use curl:

# List available destinations as JSON
curl -k -u test:test2021 -H "Accept: application/json" \
  https://localhost:7443/ecpds/data/list/

Example output:

[{"name":"efas_iconeu_opendata","size":null,"time":"2025-09-29T13:56:23.598Z","directory":true},{"name":"hourly_aq","size":null,"time":"2025-09-29T14:02:53.465Z","directory":true},{"name":"wis2_sbo","size":null,"time":"2025-09-29T13:58:05.020Z","directory":true}]

# List files in a destination
curl -k -u test:test2021 -H "Accept: application/json" \
  https://localhost:7443/ecpds/data/list/hourly_aq

Example output (trimmed):

[{"name":"HourlyData_2026091600.dat","size":758823,"time":"2026-09-16T14:50:54.098Z","directory":false},{"name":"HourlyData_2026091601.dat","size":757791,"time":"2026-09-16T14:50:55.191Z","directory":false}, ... ,{"name":"HourlyData_2026091705.dat","size":746933,"time":"2026-09-17T08:15:20.546Z","directory":false}]

SFTP¶

sftp -P 7022 -o StrictHostKeyChecking=no test@localhost
# Password: test2021

S3¶

Using AWS CLI:

aws configure set aws_access_key_id test
aws configure set aws_secret_access_key test2021
aws s3 ls s3:// --endpoint-url https://localhost:7443/s3 --no-verify-ssl

Using rclone:

rclone lsd :s3: \
  --s3-provider=Other \
  --s3-endpoint=https://localhost:7443/s3 \
  --s3-access-key-id=test \
  --s3-secret-access-key=test2021 \
  --s3-v2-auth \
  --no-check-certificate

Note: --s3-v2-auth forces the older AWS V2 signature scheme. Some rclone/AWS SDK versions have V4-signing quirks that don't match this server's implementation, causing a SignatureDoesNotMatch error; V2 auth is a reliable workaround.

WebDAV¶

Using curl:

# List root directory (PROPFIND)
curl -k -u test:test2021 -X PROPFIND https://localhost:7443/webdav/

Using rclone:

rclone lsd :webdav: \
  --webdav-url=https://localhost:7443/webdav \
  --webdav-vendor=other \
  --webdav-user=test \
  --webdav-pass=$(rclone obscure test2021) \
  --no-check-certificate

Using cadaver (interactive WebDAV client):

# cadaver does not support self-signed certs natively — set SSL_CERT_FILE or
# configure ~/.cadaverrc: use-ssl-noverify=yes
cadaver https://localhost:7443/webdav
# Username: test  Password: test2021
dav:/webdav/> ls

Or mount directly from your OS file manager:

• macOS Finder: Go → Connect to Server… (⌘K), enter https://localhost:7443/webdav, click Connect, then log in with test / test2021.
• Windows Explorer: Right-click This PC → Map network drive, choose a drive letter, enter https://localhost:7443/webdav as the folder, check Connect using different credentials and log in with test / test2021.
• Linux (GNOME Files / Nautilus): Go → Connect to Server…, enter davs://localhost:7443/webdav, log in with test / test2021.
• Linux (command-line): mount with davfs2: sudo mount -t davfs https://localhost:7443/webdav /mnt/webdav

MQTTS¶

Using mqttx CLI (recommended):

mqttx sub \
  -h localhost -p 8883 \
  -l mqtts \
  -u test -P test2021 \
  --insecure \
  -t '#'

REST API¶

The REST API is served by the Monitor on port 8443. All examples use the pre-configured api / api2021 super-user (full permissions). See the REST API Reference for the complete endpoint list.

# Check server version (no auth required)
curl -k https://localhost:8443/ecpds/v1/version

{ "status": "ok", "version": "6.7.7-20240701" }

# List all destinations
curl -k -u api:api2021 https://localhost:8443/ecpds/v1/destination/list

# Get details for a specific destination
curl -k -u api:api2021 https://localhost:8443/ecpds/v1/destination/hourly_aq

# List all incoming (data) users
curl -k -u api:api2021 https://localhost:8443/ecpds/v1/incoming/user/list

# Create a new incoming user (portalService is optional, defaults to
# "standard-login"; other values are "open-access" and "self-service").
# active=true is required here since a new incoming user is inactive by
# default, and incoming/association/add fails with "User newuser not
# found/active" until the user is active.
curl -k -u api:api2021 -X POST \
  "https://localhost:8443/ecpds/v1/incoming/user/add?id=newuser&pass=secret&email=newuser@example.com&iso=gb&portalService=standard-login&active=true"

# Associate a user with a destination
curl -k -u api:api2021 -X POST \
  "https://localhost:8443/ecpds/v1/incoming/association/add?id=newuser&destination=hourly_aq"

# List a user's destination associations
curl -k -u api:api2021 \
  "https://localhost:8443/ecpds/v1/incoming/association/list?id=newuser"

# Remove a user–destination association
curl -k -u api:api2021 -X DELETE \
  "https://localhost:8443/ecpds/v1/incoming/association/del?id=newuser&destination=hourly_aq"

# Deactivate a user
curl -k -u api:api2021 -X DELETE \
  https://localhost:8443/ecpds/v1/incoming/user/del/newuser

Logs¶

# All services (supervisord output)
docker logs -f standalone

# Individual service logs
docker exec standalone tail -f /data/log/master/master.log
docker exec standalone tail -f /data/log/mover/mover.log
docker exec standalone tail -f /data/log/monitor/monitor.log

Stop and remove¶

# Stop (data is preserved in ./ecpds-data)
docker stop standalone

# Restart later
docker start standalone

# Remove completely (keeps ./ecpds-data on disk)
docker rm standalone

Known limitations¶

Next steps¶

• Explore the Monitoring UI to see destinations, hosts, and transfer history. Three accounts give different perspectives:
  • admin / admin2021 — full administrator view with access to all destinations, hosts, transfer queues, users, and system configuration.
  • monitor / monitor2021 — restricted user view showing only a limited set of destinations and features, as a regular monitoring user would experience it.
  • operator / operator2021 — operator view: all destinations and the Operations section, without the administration pages.

See Monitor UI overview for how the three profiles differ. - Read Data Acquisition and Data Dissemination to understand the two active services. - Explore the Data Portal for how remote users push and pull data. - Ready for a real deployment? See Installation → First Run.