Technical Requirements
Hardware, operating system and network requirements for the server.
What a server needs before you run the installer, and how to check each point. ScanSuite Teams runs in Docker on Linux; Ubuntu 22.04 or newer is the recommended system. For Google Cloud or Azure, see the requirements on Install on Google Cloud or Install on Microsoft Azure instead.
Check the host
Run these as the account that will install ScanSuite. Each line says what to expect.
| Requirement | Check | Expected |
|---|---|---|
| Operating system | . /etc/os-release; echo $ID $VERSION_ID | ubuntu 22.04 or newer; see the Docker table below for others |
| CPU architecture | uname -m | x86_64 |
| CPU cores | nproc | 4 or more |
| Memory | free -g | 16 or more in the total column of Mem |
| Disk for Docker | df -BG /var/lib/docker 2>/dev/null || df -BG /var | Available at least 20G; 40G or more to install every scanner |
| Disk for scans and logs | df -BG /var/tmp | Available at least 10G |
| A non-root account with sudo | id -u; sudo -n true && echo sudo-ok | a number other than 0, then sudo-ok. "a password is required" also passes: the person types the sudo password when the installer asks. |
| curl | command -v curl | a path, such as /usr/bin/curl |
| Ports 80 and 443 free | sudo ss -ltnp '( sport = :80 or sport = :443 )' | only the header line; otherwise see Ports below |
| systemd, for the boot service | systemctl --version | a version line |
| The image registry is reachable | curl -sI https://registry-1.docker.io/v2/ | head -1 | HTTP/... 401 (401 is right: it asks for the sign-in) |
| The clock is synchronised | timedatectl show -p NTPSynchronized --value | yes |
Docker itself does not have to be there yet: on Ubuntu, CentOS, Debian and Kali the installer installs it. If it is already installed, docker compose version should print a version.
Hardware
| Resource | Recommended |
|---|---|
| CPU | 4 cores |
| Memory | 16 GB RAM |
| Storage | 100 GB SSD |
This size runs two scans in parallel, which is what a default installation does: it starts two scan workers, each running one scan at a time, and queues the rest. For more, give the host more cores and memory and start more workers with ./scansuite restart <n>. The count is not saved: after a reboot the boot service starts two again.
Most of the disk is images. The installer looks for about 15 GB free for a default installation (the application and DefectDojo, no scanner containers) and about 40 GB to install every scanner; with less it warns and carries on. Scans, their work files and the logs need room on top of that: ./scansuite doctor reports a problem when less than 20 GB is free for Docker's images or less than 10 GB in /var/tmp.
Operating system and Docker
| Distribution | Installer sets up Docker |
|---|---|
| Ubuntu | Yes, from get.docker.com |
| CentOS | Yes, from get.docker.com |
| Debian, Kali | Yes, from the Docker apt repository |
| RHEL, Rocky Linux, AlmaLinux and others | No: install Docker and its Compose plugin yourself first; the installer stops with No docker installer for this distribution otherwise |
The installer also needs curl; it installs git itself with apt, dnf or yum when it is missing. It uses sudo to install Docker, to create /opt/scansuite and to register the scansuite systemd service that starts the installation at boot. Without systemd there is no boot service, and you start ScanSuite with ./scansuite start after a reboot.
Install as an ordinary account with sudo, not as root. The installation then belongs to that account: run ./scansuite as that account, without sudo.
Accurate time
The licence is time-bound, and a host whose clock has drifted fails in a way that looks like a licence problem. Keep the clock synchronised (the check above). To have the installer and ./scansuite doctor check your NTP server as well, pass --ntp=<server> to the install, and set NTP_SERVER=<server> in /opt/scansuite/.env for doctor.
Ports
| Port | Used by | If it is taken |
|---|---|---|
| 443, 80 | The console, through ScanSuite's own nginx; 80 redirects to 443. | If the host already serves these ports, let its web server proxy to ScanSuite: SSL/TLS Setup. |
| 8443, 8080 | DefectDojo, when installed. | Move them with DD_TLS_PORT and DD_PORT: Set up DefectDojo. |
| 5000 | The web service, inside the installation only. | Published on the loopback address only for the proxy route. |
What you need from your order
Have the licence file (<name>_<code>.lic, sent with your order) on the server, and keep the registry access token (it starts with dckr_pat_) at hand for the person who runs the installer. The token is typed at the installer's prompt, never pasted into a chat.
The registry user name is built into the installer, so a server install asks only for the token. DefectDojo is installed on the same host by default; --no-dojo leaves it out (see Set up DefectDojo).
Network and firewall
If the server's internet access is restricted, allow these during installation and every update:
https://scansuite.eu
https://raw.githubusercontent.com
https://github.com
https://get.docker.com
https://download.docker.com
https://registry-1.docker.io
https://auth.docker.io
https://production.cloudflare.docker.com
https://production.cloudfront.docker.comDocker Hub serves image layers from more than one content delivery network, so allow both production.*.docker.com hosts. When the installer installs Docker or git, the distribution's own package mirrors are needed as well.
While scanning, the server reaches:
- your AI provider's endpoint — every AI scan needs it;
- your git servers, over HTTPS or SSH, for repository scans;
- the targets of web, API and infrastructure scans and AI pentests;
- Nessus, OpenVAS, Acunetix and DefectDojo, if you connect them, and the services you give keys for in API keys for external systems.
A server with no access to the registry at all is installed from images carried over on disk; see the offline section of Install ScanSuite Teams. A download that keeps failing with TLS handshake timeout is covered in Troubleshooting.
Last reviewed 2026-10-19