Docs/Platform/Docker Deployment

Docker Deployment

Build and run FireSonic with Docker or Docker Compose.

FireSonic can be built into a Docker image and deployed with Docker or Docker Compose. The distribution contains the runtime JAR, libraries, configuration, scripts, rules, resources, Dockerfile, and Compose configuration required to build the image in your own environment. FireSonic does not publish a prebuilt official runtime image.

Build the runtime image

The supplied Dockerfile uses a Java 25 JRE, installs FireSonic under /opt/firesonic, creates runtime directories, exposes MLLP and management ports, and starts the JAR with the required JVM access options.

FROM eclipse-temurin:25-jre

WORKDIR /opt/firesonic

COPY firesonic.jar ./firesonic.jar
COPY libs/ ./libs/
COPY config/ ./config/
COPY scripts/ ./scripts/
COPY rules/ ./rules/
COPY resources/ ./resources/

RUN mkdir -p data logs output backup

EXPOSE 2575 8181

ENTRYPOINT ["java", \
  "--sun-misc-unsafe-memory-access=allow", \
  "--enable-native-access=ALL-UNNAMED", \
  "-jar", \
  "firesonic.jar"]

Runtime Compose configuration

A typical single-container deployment mounts configuration and runtime data from the host so configuration, the SQLite database, logs, scripts, rules, and backups survive container replacement.

services:
  firesonic:
    build:
      context: .
      dockerfile: Dockerfile
    image: firesonic:0.1.0
    container_name: firesonic
    restart: unless-stopped
    ports:
      - "2575:2575"
      - "8181:8181"
    volumes:
      - ./config:/opt/firesonic/config
      - ./scripts:/opt/firesonic/scripts
      - ./rules:/opt/firesonic/rules
      - ./data:/opt/firesonic/data
      - ./logs:/opt/firesonic/logs
      - ./output:/opt/firesonic/output
      - ./backup:/opt/firesonic/backup
    environment:
      FHIR_SERVER_URL: "http://host.docker.internal:8080/fhir"
      JAVA_TOOL_OPTIONS: "-Xms256m -Xmx2048m -Xss512k -XX:+UseG1GC"
    extra_hosts:
      - "host.docker.internal:host-gateway"

To build the image and start the Compose deployment, run:

docker compose build
docker compose up -d

Environment-variable names

The environment variable name must match the placeholder used by application.properties. The current configuration template uses FHIR_SERVER_URL for fhir.server.base.url.

Persistent directories

Host path	Container path	Purpose
`./config`	`/opt/firesonic/config`	Application properties, license, and additional TLS certificates.
`./scripts`	`/opt/firesonic/scripts`	Customer Groovy integration scripts.
`./rules`	`/opt/firesonic/rules`	Semantic validation rules.
`./data`	`/opt/firesonic/data`	SQLite database and durable message state.
`./logs`	`/opt/firesonic/logs`	Runtime logs.
`./output`	`/opt/firesonic/output`	Generated output when configured.
`./backup`	`/opt/firesonic/backup`	Database backup files.

Ports and host connectivity

Purpose	Port / URL
HL7 v2 MLLP intake	`2575`
Admin Console / health	`8181`
FHIR server on Docker host	`http://host.docker.internal:8080/fhir`

host.docker.internal allows the FireSonic container to reach a service running on the Docker host. The Compose example maps it with host-gateway.

Prometheus & Grafana monitoring Commercial

Commercial deployments can expose the FireSonic /metrics endpoint for Prometheus collection and use the official FireSonic Grafana dashboard for operational monitoring. Prometheus and Grafana are not included with Community Edition and must be deployed separately when this commercial capability is used.

Operate and verify

docker compose ps
docker compose logs -f firesonic

After startup, verify:

MLLP:   localhost:2575
Admin:  http://localhost:8181/admin
Health: http://localhost:8181/health

Production guidance

Persist data and backup outside the ephemeral container filesystem.
Externalize passwords, tokens, and encryption secrets using environment variables or your secrets platform.
Change Administration Console and Grafana default credentials before production use.
Mount config/certs when private/hospital TLS certificate authorities are required.
Size JVM heap, CPU, storage, and retention for expected workload and container limits.
Restrict ports according to site network policy.