# Technical Requirements > Hardware, operating system and network requirements for the server. Source: https://scansuite.eu/documentation/installation/technical-requirements Last reviewed: 2026-10-19 What a server needs before you run the installer, and how to check each point. ScanSuite Teams runs in Docker on Linux; **Ubuntu 22.04 or newer** is the recommended system. For Google Cloud or Azure, see the requirements on [Install on Google Cloud](https://scansuite.eu/documentation/installation/install-on-google-cloud) or [Install on Microsoft Azure](https://scansuite.eu/documentation/installation/install-on-azure) instead. ## Check the host Run these as the account that will install ScanSuite. Each line says what to expect. | Requirement | Check | Expected | |---|---|---| | Operating system | . /etc/os-release; echo $ID $VERSION_ID | ubuntu 22.04 or newer; see the Docker table below for others | | CPU architecture | uname -m | x86_64 | | CPU cores | nproc | 4 or more | | Memory | free -g | 16 or more in the total column of Mem | | Disk for Docker | df -BG /var/lib/docker 2>/dev/null \|\| df -BG /var | Available at least 20G; 40G or more to install every scanner | | Disk for scans and logs | df -BG /var/tmp | Available at least 10G | | A non-root account with sudo | id -u; sudo -n true && echo sudo-ok | a number other than 0, then sudo-ok. "a password is required" also passes: the person types the sudo password when the installer asks. | | curl | command -v curl | a path, such as /usr/bin/curl | | Ports 80 and 443 free | sudo ss -ltnp '( sport = :80 or sport = :443 )' | only the header line; otherwise see Ports below | | systemd, for the boot service | systemctl --version | a version line | | The image registry is reachable | curl -sI https://registry-1.docker.io/v2/ \| head -1 | HTTP/... 401 (401 is right: it asks for the sign-in) | | The clock is synchronised | timedatectl show -p NTPSynchronized --value | yes | Docker itself does not have to be there yet: on Ubuntu, CentOS, Debian and Kali the installer installs it. If it is already installed, `docker compose version` should print a version. ## Hardware | Resource | Recommended | |---|---| | CPU | 4 cores | | Memory | 16 GB RAM | | Storage | 100 GB SSD | This size runs **two scans in parallel**, which is what a default installation does: it starts two scan workers, each running one scan at a time, and queues the rest. For more, give the host more cores and memory and start more workers with `./scansuite restart `. The count is not saved: after a reboot the boot service starts two again. Most of the disk is images. The installer looks for about **15 GB** free for a default installation (the application and DefectDojo, no scanner containers) and about **40 GB** to install every scanner; with less it warns and carries on. Scans, their work files and the logs need room on top of that: `./scansuite doctor` reports a problem when less than 20 GB is free for Docker's images or less than 10 GB in `/var/tmp`. ## Operating system and Docker | Distribution | Installer sets up Docker | |---|---| | Ubuntu | Yes, from get.docker.com | | CentOS | Yes, from get.docker.com | | Debian, Kali | Yes, from the Docker apt repository | | RHEL, Rocky Linux, AlmaLinux and others | No: install Docker and its Compose plugin yourself first; the installer stops with No docker installer for this distribution otherwise | The installer also needs `curl`; it installs `git` itself with apt, dnf or yum when it is missing. It uses sudo to install Docker, to create `/opt/scansuite` and to register the `scansuite` systemd service that starts the installation at boot. Without systemd there is no boot service, and you start ScanSuite with `./scansuite start` after a reboot. Install as an **ordinary account with sudo**, not as root. The installation then belongs to that account: run `./scansuite` as that account, without sudo. ## Accurate time The licence is time-bound, and a host whose clock has drifted fails in a way that looks like a licence problem. Keep the clock synchronised (the check above). To have the installer and `./scansuite doctor` check your NTP server as well, pass `--ntp=` to the install, and set `NTP_SERVER=` in `/opt/scansuite/.env` for doctor. ## Ports | Port | Used by | If it is taken | |---|---|---| | 443, 80 | The console, through ScanSuite's own nginx; 80 redirects to 443. | If the host already serves these ports, let its web server proxy to ScanSuite: [SSL/TLS Setup](https://scansuite.eu/documentation/installation/ssl-tls-setup). | | 8443, 8080 | DefectDojo, when installed. | Move them with DD_TLS_PORT and DD_PORT: [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo). | | 5000 | The web service, inside the installation only. | Published on the loopback address only for the proxy route. | ## What you need from your order > **A person does this step:** Have the licence file (_.lic, sent with your order) on the server, and keep the registry access token (it starts with dckr_pat_) at hand for the person who runs the installer. The token is typed at the installer's prompt, never pasted into a chat. The registry user name is built into the installer, so a server install asks only for the token. DefectDojo is installed on the same host by default; `--no-dojo` leaves it out (see [Set up DefectDojo](https://scansuite.eu/documentation/installation/set-up-defectdojo)). ## Network and firewall If the server's internet access is restricted, allow these during installation and every update: *Allow-list: install and update* ``` https://scansuite.eu https://raw.githubusercontent.com https://github.com https://get.docker.com https://download.docker.com https://registry-1.docker.io https://auth.docker.io https://production.cloudflare.docker.com https://production.cloudfront.docker.com ``` Docker Hub serves image layers from more than one content delivery network, so allow both `production.*.docker.com` hosts. When the installer installs Docker or git, the distribution's own package mirrors are needed as well. While scanning, the server reaches: - your **AI provider**'s endpoint — every AI scan needs it; - your **git servers**, over HTTPS or SSH, for repository scans; - the **targets** of web, API and infrastructure scans and AI pentests; - Nessus, OpenVAS, Acunetix and DefectDojo, if you connect them, and the services you give keys for in [API keys for external systems](https://scansuite.eu/documentation/administration/configuring-api-keys-for-external-systems). A server with no access to the registry at all is installed from images carried over on disk; see the offline section of [Install ScanSuite Teams](https://scansuite.eu/documentation/installation/install-scansuite-server). A download that keeps failing with `TLS handshake timeout` is covered in [Troubleshooting](https://scansuite.eu/documentation/installation/troubleshooting).