---
title: Docker upgrades
description: When using Docker, instead of upgrading PingAuthorize Server, you deploy a container with the new PingAuthorize version and use the same server profile.
component: pingauthorize
version: 11.0
page_id: pingauthorize:upgrading_pingauthorize:paz_docker_upgrades
canonical_url: https://docs.pingidentity.com/pingauthorize/11.0/upgrading_pingauthorize/paz_docker_upgrades.html
revdate: April 28, 2025
section_ids:
upgrading-pingauthorize-server-using-docker: Upgrading PingAuthorize Server using Docker
about-this-task: About this task
steps: Steps
upgrading-the-pingauthorize-policy-editor-using-docker: Upgrading the PingAuthorize Policy Editor using Docker
steps-2: Steps
---
# Docker upgrades
## Upgrading PingAuthorize Server using Docker
When using Docker, instead of upgrading PingAuthorize Server, you deploy a container with the new PingAuthorize version and use the same server profile.
### About this task
If you deployed a container using a server profile, when you want to deploy a newer PingAuthorize Server version, you deploy a container with that version using the same server profile.
### Steps
* For more information, see .
The server profiles for Docker deployments differ from those discussed in [Deployment automation and server profiles](../pingauthorize_server_administration_guide/paz_deploy_auto_server_prof.html).
## Upgrading the PingAuthorize Policy Editor using Docker
If you originally installed the Policy Editor with Docker per [Deploying the Policy Editor using Docker](../installing_and_uninstalling_pingauthorize/paz_install_server_pe_docker.html#pe_install_docker), use this procedure to upgrade the PingAuthorize Policy Editor when a new version is released.
### Steps
1. In your current Policy Editor, complete the steps in [Backing up policies](paz_back_up_policies.html).
2. Stop the old Docker container and start the new one.
When a new Docker image for the PingAuthorize Policy Editor is available, you stop the existing Docker container and start the new container from the new image while mounting the same volumes.
| | |
| - | ---------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | If you use a shared volume, you should always stop the Docker container running the older version of the Policy Editor before you start the new container. |
The following commands stop the running container and run a new image named *\*. This image uses the volumes from *\* to house the policy database. Also, the command uses the same `PING_H2_FILE` location from [Example: Override the configured policy database location](../pingauthorize_server_administration_guide/paz_start_pe.html#override_policy_db_location).
| | |
| - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | * The Ping Identity DevOps Docker images use the PingAuthorize `setup` tool to update the H2 policy database on the mounted volume. If you store your policies in a PostgreSQL database, follow the instructions in [Deploying the Policy Editor using Docker](../installing_and_uninstalling_pingauthorize/paz_install_server_pe_docker.html#pe_install_docker) to update your policy database.
* For proper communication between containers, create a Docker network using a command such as `docker network create --driver `, and then connect to that network with the `--network=` option. |
```shell
$ docker container stop
$ docker run --network= --name \
-p 443:1443 -d --env-file ~/.pingidentity/config \
--volumes-from \
--env PING_H2_FILE=/opt/out/Symphonic \
pingidentity/{PAP_CONTAINER_NAME}:
```
The Docker image *\* used in the example is only a placeholder. For actual tag values, see Docker Hub ().
| | |
| - | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| | The `setup` tool uses the default credentials to upgrade the policy database. If the credentials no longer match the default values, the server administrator should pass the correct credentials to the `setup` tool using the `PING_DB_ADMIN_USERNAME`, `PING_DB_ADMIN_PASSWORD`, `PING_DB_APP_USERNAME`, and `PING_DB_APP_PASSWORD` UNIX environment variables.For example, if the old policy database admin credentials have been previously set to admin/Passw0rd, and the application credentials have been set to app/S3cret, the docker `run` command should include those environment variables as shown in this example.```shell
$ docker container stop
$ docker run --network= --name \
-p 443:1443 -d --env-file ~/.pingidentity/config \
--env PING_H2_FILE=/opt/out/Symphonic \
--env PING_DB_ADMIN_USERNAME=admin \
--env PING_DB_ADMIN_PASSWORD=Passw0rd \
--env PING_DB_APP_USERNAME=app \
--env PING_DB_APP_PASSWORD=S3cret \
pingidentity/{PAP_CONTAINER_NAME}:
```The Docker image *\* used in the example is only a placeholder. For actual tag values, see Docker Hub ().This command ensures that the `setup` tool has the correct credentials to access the policy database, and that it does not reset credentials to their defaults. |
3. In the new Policy Editor, complete the steps in [Upgrading the Trust Framework and policies](paz_upgrade_trust_framework_policies.html).