Documentation

Ship the pack.
Run it yourself.

Pam Terminal is a self-contained Docker appliance. Download the offline pack, extract it on a 64-bit host, and start the stack — no registry, no cloud control plane.

Overview

Each release is a single .tgz archive. Inside: Compose files, a host .env, helper scripts, and two image archives (pam-images-amd64.tar and pam-images-arm64.tar). On first start, the image-load service imports the archive that matches the Docker engine architecture.

1
Download

Sign in, open Products, download the entitled pack.

2
Extract

Unpack the .tgz on the host that will run Docker.

3
Start

Run start (or docker compose up -d).

4
Activate

Open the web UI and apply your signed license key.

Walkthrough

Watch the full path from pack download through host install and license activation before you dig into the written steps below.

00:00
00:00

How to download

Packs are not public files. You need an account and a fixed-term license whose term covers the release (one-time prepaid purchase; not perpetual; does not auto-renew).

  1. Create an account and verify your email.
  2. Purchase a plan from Pricing, then generate your license key on Licenses.
  3. Sign in and open Products.
  4. Download the published pam-terminal-<version>.tgz for your term.

The same pack includes both amd64 and arm64 images. You do not pick an architecture at download time — the host Docker engine selects the matching tar on start.

Air-gapped hosts

Copy the .tgz to the target machine over USB or an internal share. The pack does not pull images from a registry.

Requirements

Docker

  • Docker Engine 24+ or Docker Desktop 4.x
  • Compose V2 plugin — the docker compose command
  • Not the legacy docker-compose v1 binary

Host

  • 64-bit OS only (see platforms)
  • Several GB free for image tars + volumes
  • Open ports from .env (default HTTP 8080, HTTPS 443)

Supported platforms

Images ship for 64-bit hosts only.

Architecture Also called Typical hosts Status
amd64 x86-64 Intel / AMD 64-bit PCs and servers Supported
arm64 AArch64 Ampere, AWS Graviton, Apple Silicon (Docker Desktop) Supported
x86 i386 / 32-bit Legacy 32-bit PCs Not supported

Operating systems

OS How you run Docker Scripts
Linux (Ubuntu, Debian, RHEL, and similar) Docker Engine + Compose plugin *.sh
Windows 10 / 11 / Server Docker Desktop, or Engine where supported *.ps1
macOS (Intel or Apple Silicon) Docker Desktop *.sh

Install

Extract the archive into a dedicated directory and keep that directory as the Compose project root. .env must be a file, not a directory (Compose sometimes creates a stub folder).

Install Docker Engine and the Compose plugin, then extract and start:

install.sh 
mkdir -p /opt/pam-terminal && tar -xzf pam-terminal-<version>.tgz -C /opt/pam-terminal
cd /opt/pam-terminal
chmod +x *.sh
./start.sh

After start, open http://localhost:8080 (or the port in PAM_WEB_PORT). First boot creates secrets in .env and named Docker volumes.

Operate

Run these from the extracted pack directory. Linux and macOS use the .sh scripts; Windows uses the matching .ps1. You can also call Compose directly.

start Bring the stack up

Checks that .env and both image tars exist, then runs docker compose --env-file .env up -d. Compose starts image-load first (imports the matching tar), then env-init, Postgres, guacd, and pam-web.

start.sh 
./start.sh
# Windows: .\start.ps1
stop Stop containers, keep data

Runs docker compose down without -v. Named volumes stay on the host so recordings, the database, and secrets survive.

stop.sh 
./stop.sh
# Windows: .\stop.ps1
upgrade Replace images, keep volumes

Recreates containers from the files in the current directory: docker compose down then up -d. Existing .env secrets are kept; empty fields are filled by env-init.

upgrade.sh 
./upgrade.sh
# Windows: .\upgrade.ps1
load Optional image import

Manually runs docker load on pam-images-<arch>.tar for the engine architecture. You normally skip this — docker compose up -d already loads via the image-load service.

load.sh 
./load.sh
# Windows: .\load.ps1
Never use docker compose down -v to upgrade

The -v flag deletes named volumes. That wipes the database, recordings, drive files, and secrets. Stop and upgrade scripts omit -v on purpose.

License

The appliance runs on your infrastructure. After purchase, generate a signed license key on Licenses with your Machine ID. Paste it in the product admin. Keys can be machine-bound; keep the same host when you upgrade.

Offline / air-gapped sites do not need this website at runtime. The license file travels with you.

Data & upgrades

Persistent state lives in Docker named volumes, not in the extracted folder:

  • pam_pgdata — application database
  • pam_recordings — session recordings
  • pam_drive — file transfer / drive
  • pam_secrets — generated secrets
  • pam_dataprotection — data-protection keys
  • pam_logs — application logs

Ports and secrets are in the host .env (bound into the container as /pam-env/.env). To upgrade: extract the new pack into the same project directory (keep .env and do not delete volumes), then run upgrade.

FAQ

If the first start fails, these are the usual causes — and what to do. The pack itself does not need internet, .NET, or Node.js; it does need a working Docker that can run Linux containers.

Which environments are not suitable?

32-bit Windows and 32-bit CPUs are not supported. Windows containers mode is not supported — Docker Desktop must run Linux containers. Very old Docker without Compose V2, and uncertified engines such as Podman, are also outside the supported set. You need a 64-bit host (amd64 or arm64).

Is Docker the only thing I need to install?

Yes. Install Docker Engine 24+ or Docker Desktop 4.x with Compose V2 (the command docker compose, not the old docker-compose). The pack does not include Docker. You do not need a public registry, Git, or any application SDK.

What must be enabled on Windows?

Install Docker Desktop with WSL 2 and switch it to Linux containers. Confirm docker version shows a Linux server (linux/amd64 or linux/arm64). If WSL 2 is off or the engine is not running, compose will not start.

Can I run it without internet?

Yes. Application images are inside the .tgz; do not run docker compose pull. Docker itself must already be installed on the host (offline, if the site has no network).

docker compose up fails: port is already allocated

Another service is using the HTTP or HTTPS port (defaults are 80 and 443). Stop that service, or change PAM_WEB_PORT and PAM_WEB_HTTPS_PORT in the host .env and run docker compose up -d again.

Import fails or the database will not start

Leave several gigabytes free (about 3–4 GB) for the image archives and the first volumes. A full disk usually fails during image import or Postgres initialization.

Error: .env is a directory

Docker created an empty folder named .env because a file was missing. Delete that folder, keep .env.example, then run docker compose up -d again. The env-init service will create a real .env file.

Error: No such image: pam-web:offline

Compose tried to create the application before the offline images were imported. Use the current pack, then from the extracted folder run docker compose down and docker compose up -d. On an older pack, run docker compose up -d image-load first, then docker compose up -d.

I ran docker compose down -v and data is gone

The -v flag deletes named volumes: database, recordings, drive files, and secrets. Do not use it for upgrades. Extract the new pack into the same folder so the existing .env is kept, then run docker compose up -d (or the upgrade helper).

Permission denied, or Docker cannot be reached

The pack needs the Docker socket. Rootless Docker, a missing socket, or strict SELinux/AppArmor rules can block image-load and the web container. Use a standard Docker Desktop install or a rootful Engine.

Extract or start hangs on Windows

Antivirus or endpoint protection sometimes locks the large image tar files. Add an exclusion for the pack folder, or wait for the scan to finish and try docker compose up -d again.

Can I use Podman or another container engine?

The pack expects Docker Engine or Docker Desktop and a Docker socket. Other engines are not certified.

Which image tar is used?

Both tars ship in the archive. image-load (or load) picks pam-images-amd64.tar or pam-images-arm64.tar from the Docker engine architecture.

Where is the admin password?

After the first successful start it is written to .env as PAM_ADMIN_PASSWORD. You can also run docker compose logs env-init. Default user is admin.

Need a walkthrough?

Talk to us — we can review your host and license term.