--- title: Docker upgrades description: When using Docker, deploy a container with the new PingAuthorize version using the same server profile instead of upgrading in place. component: pingauthorize version: 10.2 page_id: pingauthorize:upgrading_pingauthorize:paz_docker_upgrades canonical_url: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_docker_upgrades.html llms_txt: https://docs.pingidentity.com/pingauthorize/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: December 19, 2025 superseded_by: https://docs.pingidentity.com/pingauthorize/11.1/upgrading_pingauthorize/paz_docker_upgrades.html section_ids: upgrading-pingauthorize-server-using-docker: Upgrading PingAuthorize Server using Docker upgrading-the-pingauthorize-policy-editor-using-docker: Upgrading the PingAuthorize Policy Editor using Docker steps: Steps --- # Docker upgrades ## Upgrading PingAuthorize Server using Docker When using Docker, deploy a container with the new PingAuthorize version using the same server profile instead of upgrading in place. You can find more information about server profiles in [Server Profile Structures](https://developer.pingidentity.com/devops/reference/profileStructures.html) in the DevOps documentation. | | | | - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The server profiles for Docker deployments differ from those discussed in [Deployment automation and server profiles](../pingauthorize_server_administration_guide/paz_deploy_auto_server_prof.html). | ## Upgrading the PingAuthorize Policy Editor using Docker If you originally installed the Policy Editor with Docker, do the following to upgrade the Policy Editor when a new version is released. ### Steps 1. In your current Policy Editor, complete the steps in [Backing up policies](paz_back_up_policies.html). 2. Stop the old Docker container and start the new one. When a new Docker image for the PingAuthorize Policy Editor is available, you stop the existing Docker container and start the new container from the new image while mounting the same volumes. | | | | - | ---------------------------------------------------------------------------------------------------------------------------------------------------------- | | | If you use a shared volume, you should always stop the Docker container running the older version of the Policy Editor before you start the new container. | The following commands stop the running container and run a new image named *\*. This image uses the volumes from \[.var]\## to house the policy database. Also, the command uses the same `PING_H2_FILE` location from [Example: Override the configured policy database location](../pingauthorize_server_administration_guide/paz_start_pe.html#override_policy_db_location). | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | * The Ping Identity DevOps Docker images use the PingAuthorize `setup` tool to update the H2 policy database on the mounted volume. If you store your policies in a PostgreSQL database, follow the instructions in [Deploying](../installing_and_uninstalling_pingauthorize/paz_install_server_pe_docker.html#install_pe_docker) to update your policy database. * For proper communication between containers, create a Docker network using a command such as `docker network create --driver `, and then connect to that network with the `--network=` option. | \+ ```shell $ docker container stop $ docker run --network= --name \ -p 443:1443 -d --env-file ~/.pingidentity/config \ --volumes-from \ --env PING_H2_FILE=/opt/out/Symphonic \ pingidentity/{PAP_CONTAINER_NAME}: ``` \+ The Docker image \ used in the example is only a placeholder. For actual tag values, refer to [Docker Hub](https://hub.docker.com/r/pingidentity/pingauthorizepap). \+ | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | The `setup` tool uses the default credentials to upgrade the policy database. If the credentials no longer match the default values, the server administrator should pass the correct credentials to the `setup` tool using the `PING_DB_ADMIN_USERNAME`, `PING_DB_ADMIN_PASSWORD`, `PING_DB_APP_USERNAME`, and `PING_DB_APP_PASSWORD` UNIX environment variables.For example, if the old policy database admin credentials have been previously set to admin/Passw0rd, and the application credentials have been set to app/S3cret, the docker `run` command should include those environment variables as shown in this example.```shell $ docker container stop $ docker run --network= --name \ -p 443:1443 -d --env-file ~/.pingidentity/config \ --env PING_H2_FILE=/opt/out/Symphonic \ --env PING_DB_ADMIN_USERNAME=admin \ --env PING_DB_ADMIN_PASSWORD=Passw0rd \ --env PING_DB_APP_USERNAME=app \ --env PING_DB_APP_PASSWORD=S3cret \ pingidentity/{PAP_CONTAINER_NAME}: ```The Docker image \ used in the example is only a placeholder. For actual tag values, refer to [Docker Hub](https://hub.docker.com/r/pingidentity/pingauthorizepap).This command ensures that the `setup` tool has the correct credentials to access the policy database, and that it does not reset credentials to their defaults. | 3. In the new Policy Editor, complete the steps in [Upgrading the Trust Framework and policies](paz_upgrade_trust_framework_policies.html).