When an engine needs a Docker image it pulls it either from Docker
Hub or from a custom registry, if defined in the server configuration:
The engine can fetch Docker images directly from the Cortex XSOAR
server. If the engine fails to fetch the Docker image from the registry
it tries to fetch it from the Cortex XSOAR server. The server packages
the image when running
, and sends
it to the engine, which enables the engine to obtain the required
images, even if it does not have network access to the Docker Hub.
The engine can only obtain images that are available from the server.
Script and Integration Configuration
Specifying which Docker image to use is done in the Cortex XSOAR
). If an image is not specified,
a default Docker image using Python 2.7 is used. New scripts and
integrations use Python 3, unless there is a specific reason not
to use it. For example, a need to use a library which is not available
for Python 3.
You can specify in the Cortex XSOAR IDE the Python version
(2.7 or 3.x). If 3.x is chosen, the latest Cortex XSOAR Python 3
Docker image is selected automatically.
The selected Docker image is configured in the script or integration
YAML file under the
In some cases, a YAML file may specify to use the latest version
of a Docker image, instead of a specific version name. In this case,
or if a Docker image did not update due to connection issues when
new content was downloaded, you can update a
Docker image of a script or integration.
When modifying an existing Docker image,
ensure the change does not disrupt other integrations that may use
the same package. All Docker images are created with unique version
tags, for which overriding is blocked. When a new version of a Docker
image is created, an integration using that image must specify the
new version in the YAML file or specify that the latest version
of the Docker image should be used.