By default Traffic Parrot reads its license from a trafficparrot.license file on the classpath
(typically placed in the installation directory). This works well for a local installation, but baking the license
file into a Docker image means you have to rebuild the image whenever the license changes, and the license is then
embedded in an image layer.
You can instead supply the license through the TRAFFICPARROT_LICENSE
environment variable, so it can be injected at runtime from a Kubernetes Secret, a Docker secret, or a secrets
manager such as HashiCorp Vault — this follows the
12-factor approach of keeping configuration out of the image.
If the environment variable is not set, Traffic Parrot reads the trafficparrot.license file from the
classpath exactly as before, so existing installations are unaffected.
Encoding the license
The license content is multi-line and encrypted, so it must be base64-encoded before it can be carried safely in an
environment variable. Encode your trafficparrot.license file once and use the resulting single line as the
value of the variable:
base64 -w0 trafficparrot.license
The -w0 flag disables line wrapping so the whole value is produced on a single line. (On macOS, GNU
coreutils provides gbase64 -w0; the BSD base64 does not wrap by default.)
A stray trailing newline in the value is tolerated — Traffic Parrot trims the value before decoding it.
Precedence
Traffic Parrot resolves the license from the first source that is set, in this order:
| Priority |
Source |
Value |
| 1 (highest) |
System property -Dtrafficparrot.license.content |
base64-encoded license content |
| 2 |
Environment variable TRAFFICPARROT_LICENSE |
base64-encoded license content |
| 3 (lowest) |
Classpath file trafficparrot.license |
the raw license file (default behaviour) |
If the environment variable or system property is set but not valid (the value is not valid base64,
or the decoded content is not a parseable license), Traffic Parrot fails to start with a clear error that names the
variable — it does not silently fall back to the classpath file. This is intentional: a
set-but-broken value is a misconfiguration you need to see rather than have masked. An unset (or empty) variable falls
back to the classpath file as normal.
Docker
Pass the encoded license to docker run with --env:
docker run --name trafficparrot -d \
--env TRAFFICPARROT_LICENSE=BASE64_LICENSE_CONTENT \
-p 127.0.0.1:8080:8080 -p 127.0.0.1:8081:8081 trafficparrot
To avoid the value appearing in your shell history or process list, keep it in an
env file that is not committed to
source control and reference it with --env-file:
# trafficparrot.env (do not commit this file)
TRAFFICPARROT_LICENSE=BASE64_LICENSE_CONTENT
docker run --name trafficparrot -d \
--env-file trafficparrot.env \
-p 127.0.0.1:8080:8080 -p 127.0.0.1:8081:8081 trafficparrot
Docker Compose
With Docker Compose, inject the value at runtime rather than hard-coding it in a committed
docker-compose.yml. The example below reads the variable from the environment of the host that runs
docker compose up (for example exported from your secrets manager):
services:
trafficparrot:
image: trafficparrot
environment:
# value supplied from the host environment, not stored in this file
TRAFFICPARROT_LICENSE: ${TRAFFICPARROT_LICENSE}
ports:
- "127.0.0.1:8080:8080"
- "127.0.0.1:8081:8081"
Kubernetes
In Kubernetes, store the encoded license in a
Secret and reference it from the
pod with valueFrom.secretKeyRef.
Create the Secret:
kubectl create secret generic trafficparrot-license \
--from-literal=license=BASE64_LICENSE_CONTENT
Reference it from the container:
env:
- name: TRAFFICPARROT_LICENSE
valueFrom:
secretKeyRef:
name: trafficparrot-license
key: license
The same approach works with the sample Helm chart — supply the encoded license
as a chart value backed by a Secret rather than baking it into the image.
Keep the license secret
The license is sensitive. Inject it at runtime via a Kubernetes Secret, a Docker secret, or a secrets manager such as
Vault. Do not commit the license (encoded
or raw) to a source repository, and do not bake it into a Docker image layer. Traffic Parrot never logs the license
content or the value of the environment variable.
The Traffic Parrot License Server supports supplying its own license through an
environment variable in the same way — see
Supplying the license in the
License Server documentation.