Container Configuration

In a container, Pano keeps everything in the /data volume and can take its database and mail settings from environment variables instead of the Setup Wizard.

The /data volume

/data is the only place Pano writes to. Mount a volume or a folder there and back it up.

In /data	What it is
Pano-<version>.jar and the UIs	The Pano release. The full image copies its jar here on first start
.pano-jar	File name of the jar the launcher starts. See Container mode
config.conf	Pano's configuration file
plugins/, uploads, logs	Everything Pano creates while it runs

The rest of the container can stay read-only; Pano only needs /data and a temporary /tmp. Pano Host runs every Pano Instance that way.

The image runs as uid 10000. A named volume just works; a host folder must be writable by that user (chown -R 10000:10000 <folder>) or you pass your own --user.

Environment variables

On first boot Pano writes these variables into config.conf, so it already knows its database and mail server. Later changes to them are ignored; change the settings in the panel instead. All are optional.

Variable	Sets
PANO_DB_HOST, PANO_DB_PORT (3306)	Database server
PANO_DB_NAME, PANO_DB_USER, PANO_DB_PASSWORD	Database and its user
PANO_SMTP_HOST, PANO_SMTP_PORT (587)	SMTP server
PANO_SMTP_USER, PANO_SMTP_PASSWORD	SMTP login
PANO_SMTP_FROM, PANO_SMTP_STARTTLS	Sender address; STARTTLS mode DISABLED, OPTIONAL or REQUIRED (default: chosen from the port)
PANO_HTTP_PORT	Port Pano listens on inside the container (8088)
PANO_JVM_ARGS	Java options, space separated (-XX:MaxRAMPercentage=75)

Example:

docker run -d --name pano \
  -e PANO_DB_HOST=mariadb \
  -e PANO_DB_NAME=pano \
  -e PANO_DB_USER=pano \
  -e PANO_DB_PASSWORD=change-me \
  -v pano-data:/data \
  ghcr.io/panomc/pano:latest

Keep passwords out of shell history: use --env-file or your orchestrator's secrets. The one-command installer sets the same variables in its pano.env.

Pano Host variables

Pano Host sets a few more. You do not need them for your own installs.

Variable	Purpose
PANO_HOSTED	pano-host marks the instance as managed by Pano Host: the panel shows "managed by Pano Host" and quota notices. The variables above are then applied on every start, and the port and SSL settings in the panel are ignored
PANO_HOST_WORKLOAD_ID	The instance's id at Pano Host
PANO_HOST_INSTANCE_SECRET	Lets the instance redeem panel sign-ins from panomc.com and read its notices
PANO_HOST_API_URL	Pano Host API address

Older Pano versions ignore all of these variables.

config.conf

Pano rewrites config.conf when it shuts down. An edit made while the container runs is lost on the next stop. To change a setting by hand:

1. Stop the container (docker stop pano) and wait until it has exited.
2. Edit /data/config.conf.
3. Start the container again.

Settings you can change from the panel are safer to change there. For older Pano versions without environment variable support, the same order works: start once so Pano creates config.conf, stop, add your settings, start.