How To Run Containers Inside the HSM

This guide gives an overview of how to run containers on the VaultContainers platform inside a Primus HSM.

To run a container inside Primus HSM, you need to:

1. Load the container image onto the HSM (via a USB stick).
2. Load the application config file for the containerized application onto the HSM (via a USB stick).
3. Start the container.

These steps:

• Require SO privileges.
• Must be repeated for every HSM in a cluster.

tip

For detailed instructions and commands, please see Section 14 "VaultContainers Platform" of the Primus HSM User Guide.

Deploying Securosys Containers

Securosys provides several container images that you can load onto the HSM. Each of them has its own repository, from where you can download the .container image and configuration files. Currently, Securosys offers the following products as loadable container images:

• VaultCode
• TSB / REST API
• A database (PostgreSQL, needed as a dependency of the above)

Deploying Custom Containers

Custom container images need to be provided as a signed bundle. This bundle is a ZIP file, but with the .container extension. The contents of the ZIP must be the following:

customer-app.container
├── customer-app.tar
└── customer-app.sig

info

Deploying customer container images requires Primus HSM CyberVault Server.