Run the Demisto SDK in a Docker container

Run Demisto SDK validations from within a Docker container.

Use the Docker image to run Demisto SDK commands locally or as a CI/CD process.

Prerequisites

• To use the Demisto SDK, create a content repository for Cortex XSOAR content in a structure that matches the official Cortex XSOAR content repository.

  You can generate your repository from this template.
• The Demisto SDK uses volume mounts to run on the local content repository, which may cause slowness on macOS or Windows. To optimize performance use one of the following:

  • A Linux machine
  • Windows WSL2

Get the Docker image

Pull the Docker image with docker pull demisto/demisto-sdk:<tag> .

The latest tags are in the Docker hub here.

Environment variables

Some commands such as demisto-sdk upload and demisto-sdk run need the following environment variables to communicate with your Cortex XSOAR server.

Environment Variable	Description
DEMISTO_BASE_URL	The URL of the Cortex XSOAR server.
DEMISTO_API_KEY	The API key.
DEMISTO_VERIFY_SSL	Whether to verify SSL certificates.

To pass the variables, do one of the following:

• Add the --env option, for example:

  docker run --env DEMISTO_BASE_URL="https://xsoar.com:443" <rest of the command>

• Use an .env file, for example:

  DEMISTO_BASE_URL="https://xsoar.com:443"
  DEMISTO_API_KEY="xxxxxxxxxxxxx"

  Pass the variables with the following command:

  docker run --env-file .env <rest of the command>

Run Docker-in-Docker (Docker Daemon binding)

Docker-in-Docker involves running Docker within a Docker container. Instead of interacting with the host's Docker daemon, a new Docker engine is spawned within a container, providing an isolated environment for managing containers and images. It enables creating isolated, reproducible, and secure environments within Docker containers.

To use Docker commands from within a container, you need to mount the host's Docker daemon socket as follows:

--mount source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind

Command arguments

docker run	Creates a container (if one does not exist) and runs the following command inside it.
-it	Keeps the stdin open and connects tty.
--rm	Removes the Docker container when done (omit this to reuse the container in the future).
--mount type=bind,source="$(pwd)",target=/content	Connects the pwd (if you're in content) to the container's content directory.
--mount source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind	Binds the Docker daemon socket to the container to enable running Docker- in- Docker.
demisto/demisto-sdk:\<tag>	The Docker image name. Replace the tag with the locked version, it can be found in the Docker Hub).
demisto-sdk validate -i Packs/ipinfo/Integrations/ipinfo_v2	The Demisto SDK command to run inside the container.

Create an alias to a command

Creating an alias to a command makes it easier to use the command. You can do this by adding the following line to your shell configuration files:

Example

alias demisto-sdk="docker run -it --rm \
--mount type=bind,source="$(pwd)",target=/content \
--mount source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind \
demisto/demisto-sdk:<tag>"

Use the validate command

For more information about the validate command, see validate.

Example

docker run -it --rm \
--mount type=bind,source="$(pwd)",target=/content \
--mount source=/var/run/docker.sock,target=/var/run/docker.sock,type=bind \
demisto/demisto-sdk:<tag> \
demisto-sdk validate -i Packs/ipinfo/Integrations/ipinfo_v2