Skip to main content

Deploy Linksight on Windows Server

This guide provides step-by-step instructions for deploying Linksight on Windows Server using Docker Engine and Docker Compose. This deployment method is suitable for organizations running Windows Server infrastructure and provides a self-hosted solution for the Linksight platform. The installation methods described here have been tested on Windows Server 2025, Windows Server 2022 and Windows Server 2019 (Datacenter edition).

Prerequisites​

Before installation, make sure the following is ready:

  • A server with Windows Server 2025, 2022 or 2019 Datacenter edition
    • Minimum specifications: 4 (v)CPUs, 16 GB memory, 60 GB SSD storage
    • Optimal configuration depends on use-case and size of datasets. In general, more is better; the data station utilizes all CPU cores available during computation.
  • Administrator access to the Windows Server
  • (Optional) A PEM encoded TLS certificate to secure the Analysis Hub.
    • Using a TLS certificate is optional, however it is recommended to secure the connection between the user and the backend.
    • It is possible to automatically issue a certificate using Let's Encrypt. Review the page TLS to setup and enable automated certificate issuance.
    • TLS connections can also be established in other ways, e.g. by using a reverse proxy which terminates TLS. In these cases, TLS does not need to be set up in the Linksight software.
caution

If there is a firewall enabled for the VM, please review the Required Connections & Firewall Rules page and apply the listed firewall rules to be able to connect to the services of Linksight.

Servers without internet access

Only Docker Engine and Docker Compose have to be downloaded from hosts that are not part of the required connections. If the server is restricted to the connections listed on the network connections page, use the No internet access tab under Install Docker Engine and Docker Compose to download those installers on another machine and transfer them to the server. Every step after that works unchanged.

Connections to the Linksight domains are still required, though: the Linksight files are retrieved from setup.linksight.network during installation, and the container images from registry.linksight.network during installation and on every update, so a fully isolated server is not supported. Automatic certificate issuance with Let's Encrypt cannot be used either; see Servers without internet access.

Install the Windows Containers feature​

Docker Engine on Windows Server uses Windows Containers, which run natively on Windows without requiring a Linux virtual machine. Enable the feature before installing Docker. For detailed information, refer to the official Microsoft documentation.

  1. Open PowerShell as Administrator and run the following command to install the Windows Containers features:

    Install-WindowsFeature -Name Containers

  2. Restart the server to enable the Windows Containers feature.

caution

Install the Containers feature and restart the server before installing Docker. Recent versions of dockerd check for container support when the service is registered, and fail to register with a vmcompute.dll load error if the feature is not enabled yet.

Install Docker Engine and Docker Compose​

Docker Compose is a tool for defining and running multi-container Docker applications. It allows you to use a YAML file to configure your application's services. Both Docker Engine and Docker Compose are installed on the server.

info

On Windows Server, Docker Compose is installed as the standalone docker-compose binary rather than as a CLI plugin: manually installing the plugin is documented by Docker for Linux only.

Open PowerShell as Administrator and run the commands below.

  1. Install Docker Engine (see the official Microsoft documentation):

    Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/Windows-Containers/Main/helpful_tools/Install-DockerCE/install-docker-ce.ps1" -o install-docker-ce.ps1
    .\install-docker-ce.ps1

  2. Install Docker Compose (this is similar to the official instructions from Docker for Windows Server):

    New-Item -ItemType Directory -Force -Path $Env:ProgramFiles\Docker
    Invoke-WebRequest -UseBasicParsing "https://github.com/docker/compose/releases/latest/download/docker-compose-windows-x86_64.exe" -o $Env:ProgramFiles\Docker\docker-compose.exe

  3. Edit the PATH variable to include the Docker directory, to be able to use docker and docker-compose from other directories as well:

    $machinePath = [Environment]::GetEnvironmentVariable("Path", "Machine")
    [Environment]::SetEnvironmentVariable("Path", "$machinePath;$Env:ProgramFiles\Docker", "Machine")
    $Env:Path += ";$Env:ProgramFiles\Docker"

    The last line makes the commands available in the current PowerShell session as well; without it you would have to open a new session first.

Verify the Docker installation​

Run the following commands, which should display the version of Docker Engine and Docker Compose:

docker version
docker-compose --version

The output of docker version should contain both a Client and a Server section. The daemon can take some seconds to start; if the Server section is still missing when you retry, the Docker service is not running.

Set up working directory​

Create a working directory for your installation:

New-Item -ItemType Directory -Path <workdir>
Set-Location -Path <workdir>
caution

There may be issues with volume mounting in containers if the working directory is located on a non-system NTFS partition. In our experience, reliable volume mounting is typically achieved only when the working directory is on the C:\ drive. If you encounter problems with volume mounts, try moving your working directory to C:\.

Configuration and Deployment​

  1. Create the data directory:

    New-Item -ItemType Directory -Path <workdir>\data

  2. Download the Docker Compose file template for the supervisor, and put the files in the working directory.

    Alternatively, download the files from PowerShell:

    Invoke-WebRequest https://setup.linksight.network/v3-windows/docker-compose.yml -OutFile docker-compose.yml
    Invoke-WebRequest https://setup.linksight.network/v3-windows/.env.ltsc2025.example -OutFile .env

  3. Configure the following variables in the .env file:

    Required variables​

    Environment variableDescription
    FULLDATAPATHThe full (absolute) path to the directory which will store the persisted data. E.g. C:\Users\Administrator\linksight\data.
    ANALYSISHUB_FRONTEND_FQDNFully qualified domain name (FQDN) of the Analysis Hub. This will be used in the OIDC redirect URL if using an OIDC identity provider. E.g. https://my.domain-name.com or http://my.domain-name.com:8000. Make sure to configure ANALYSISHUB_PORT accordingly.
    DATASTATION_HOSTThe external public hostname/IP of the VM where other (external) data stations can reach the data station.

    Optional variables​

    Environment variableDescription
    ANALYSISHUB_FRONTEND_TLS_CERTFILE, ANALYSISHUB_FRONTEND_TLS_KEYFILESet to secure the connection to the Analysis Hub with TLS. Leaving these variables empty results in connections without TLS.

    The certificate file should be a PEM encoded .crt file. The key file should be an unencrypted PEM encoded .key file. Encrypted key files are not supported.

    The files should be put in the <workdir>\data\analysis folder, after creating it:
    New-Item -ItemType Directory -Path <workdir>\data
    New-Item -ItemType Directory -Path <workdir>\data\analysis

    The ANALYSISHUB_FRONTEND_TLS_ variables can then be set to /data/<key>.key and /data/<cert>.crt (so without analysis in the path).
    ANALYSISHUB_AUTOCERT_ENABLEDEnable automatic certificate issuance from Let's Encrypt. Review page TLS for more info. Cannot be used on a server without internet access: see Servers without internet access.
    ANALYSISHUB_AUTOCERT_HTTP01_ENABLEDEnable server for Let's Encrypt http-01 challenge responses on port 80. Enabled by default. Review page TLS for more info.
    ANALYSISHUB_AUTH_PROVIDERIdentity provider used for authentication to the Analysis Hub. The default value is linksight. Other options are localdb, microsoft, customoidc. See User Identity Management for more information on user identities and identity providers.
    ANALYSISHUB_AUTH_XXXDepending on the chosen identity provider, additional configuration might be required. Consult the User Identity Management page to learn more.
    ANALYSISHUB_PORTPort for the Analysis Hub frontend. Defaults to 8000.
    ANALYSISHUB_GRPC_PORTPort for the Analysis Hub backend gRPC server. Defaults to 8080.
    DATASTATION_ALTHOSTSAlternative hosts for the datastation, comma-separated. These will be used by internal components to route traffic internally.
    DATASTATION_HTTP_PORTPort for the data station mTLS HTTP server. Defaults to 8443. It should be externally accessible.
    DATASTATION_GRPC_PORTPort for the data station mTLS gRPC server. Defaults to 9090. It should be externally accessible.

Start components​

  1. Pull the supervisor container image:

    docker-compose pull
    note

    Downloading the container image may take several minutes, as the Windows base image is quite large.

  2. Start all components:

    docker-compose up -d

  3. Check whether the frontend of the Analysis Hub is reachable (URL configured as ANALYSISHUB_FRONTEND_FQDN).

  4. Follow the instructions on the page to complete the registration for the Analysis Hub and data station (accepting the registration tokens on the Linksight Governance Hub).

  5. Check the logs to see whether all components have been registered successfully:

    docker-compose logs -f

The Linksight software is now up and running.

Next steps​

  • Configure the server firewall. Note that this is different from the network firewall, which should be configured separately. See Required Connections & Firewall Rules

    • Allow traffic to ports 8443 and 9090: 
      netsh advfirewall firewall add rule name="Allow Linksight mTLS" dir=in action=allow protocol=TCP localport=8443
      netsh advfirewall firewall add rule name="Allow Linksight gRPC" dir=in action=allow protocol=TCP localport=9090

  • Register the nodes. Follow the instructions on the page Register nodes.