advantys/workflowgen repository overview

⁠WorkflowGen - Business Process Automation Platform

This image contains a WorkflowGen Server using IIS and WorkflowGen's Windows Services. Use this image to run WorkflowGen's web application, Windows services, or both.

⁠⚠️ Platform & Database Support

WorkflowGen application: Windows containers only (all versions)

Database options for production:

Development/Testing database options:

⁠PostgreSQL images for WorkflowGen 10.5.0

WorkflowGen 10.5.0 provides separate PostgreSQL 17 and 18 images with pgvector. Use the latest corrective release within the supported range above. For customer-managed servers, install the latest pgvector version compatible with the PostgreSQL major, operating system and architecture; Docker images use the versions listed in the PostgreSQL overview.

Use a versioned major/platform tag for a controlled deployment. The leading version identifies WorkflowGen; postgres17 or postgres18 selects the database major. Legacy versioned tags without the major remain PG17 aliases. For all moving aliases and PostgreSQL volume examples, see the PostgreSQL overview⁠.

To update within the same PostgreSQL major, back up the database, pull the new image, stop the old container cleanly and create its replacement with the existing compatible volume. Pulling an image alone does not update a running container or its database.

Changing the image does not convert an existing database to another PostgreSQL major. Never attach a PostgreSQL 17 data directory directly to PostgreSQL 18, or an 18 directory to 17. Linux PostgreSQL 18 uses a volume at /var/lib/postgresql with PGDATA=/var/lib/postgresql/18/docker; PostgreSQL 17 uses /var/lib/postgresql/data. Installing newer pgvector files does not automatically update the extension registered in an existing database.

⁠Available Tags

Dockerfile sources:

• v10.4 Windows images⁠
• v9.7 Windows images⁠

Each directory contains Windows Server 2019 and 2022 Dockerfiles and their customizable onbuild variants.

Example tags:

• 10.5.0-win-ltsc2022 - WorkflowGen v10.5.0 for Windows Server 2022
• 10.5.0-win-ltsc2019 - WorkflowGen v10.5.0 for Windows Server 2019
• 9.7.0-win-ltsc2022 - WorkflowGen v9.7.0 for Windows Server 2022
• 9.7.0-win-ltsc2019 - WorkflowGen v9.7.0 for Windows Server 2019
• 8.3.5-win-ltsc2019 - WorkflowGen v8.3.5
• latest - Latest stable v10 release; points to the primary Windows Server 2019 image
• -onbuild suffix - Customizable variant

⁠Requirements

1. On Windows 10 Pro or Enterprise, install Hyper-V and Docker Desktop⁠, switch to Windows containers, and use an ltsc2019 image. Windows 10 does not support Windows Server 2022 container images.
2. Use Windows 11 or Windows Server 2022 or later for ltsc2022 images. Consult Microsoft's Windows container version compatibility⁠ matrix when the host and container versions differ.
3. On Windows Server, use the image tag matching the host version for process isolation. A newer compatible host can run an older image with Hyper-V isolation.
4. A WorkflowGen license to copy into the C:\wfgen\licenses volume.
5. A serial number to set via WFGEN_APP_SETTING_ApplicationSerialNumber.
6. A database: v10 uses PostgreSQL or SQL Server 2025; v9/v8 use SQL Server.

⁠Run the Container

Before running, ensure the database is initialized with provided SQL scripts.

docker run -it --env-file .\workflowgen.env -v C:\path\to\licenses:C:\wfgen\licenses --name wfgen advantys/workflowgen:{version}-win-{windows-version}

Replace {version} with your WorkflowGen version and {windows-version} with the matching Windows container version, such as ltsc2022 or ltsc2019.

⁠Quick Setup with Docker Compose

The PostgreSQL example uses WorkflowGen 10.5.0 and an explicit PostgreSQL 17 tag. The Windows examples use Windows Server 2022 tags. For Windows Server 2019, replace every ltsc2022 tag in the same stack with its ltsc2019 counterpart. Do not mix Windows container versions in one Windows-hosted stack.

⁠v10 with PostgreSQL on Windows

Prerequisites:

# Create volumes
docker volume create licenses
docker volume create wfgdata
docker volume create pgdata

# Copy license
$licensesPath = docker volume inspect --format "{{.Mountpoint}}" licenses
Copy-Item ~\Desktop\license.lic $licensesPath

# Generate symmetric encryption key (32 characters)
[guid]::NewGuid().ToString("N")
# Example: ca8e4e2b04254aeeadbcfc0724e3b62a

docker-compose.yml:

services:
  workflowgen:
    image: advantys/workflowgen:10.5.0-win-ltsc2022
    depends_on:
      - database
    environment:
      - WFGEN_DATABASE_CONNECTION_STRING=Host=database;Port=5432;Database=wfgen;Username=wfgen_user;Password=yourStrong(!)Password;
      - WFGEN_DATABASE_CONNECTION_STRING_PROVIDER_NAME=Npgsql
      - WFGEN_APP_SETTING_ApplicationUrl=http://localhost:8888/wfgen
      - WFGEN_APP_SETTING_ApplicationSerialNumber=YOUR_WORKFLOWGEN_SERIAL_NUMBER
      - WFGEN_APP_SETTING_ApplicationSecurityPasswordSymmetricEncryptionKey=ca8e4e2b04254aeeadbcfc0724e3b62a
    ports:
      - 8888:80
    volumes:
      - licenses:C:\wfgen\licenses:RO
      - wfgdata:C:\wfgen\data
  database:
    image: advantys/workflowgen-postgres:10.5.0-postgres17-win-ltsc2022
    container_name: database
    environment:
      - PGDATA=C:\pgsql\data
      - POSTGRES_INITDB_ARGS=--username=postgres
      - POSTGRES_PASSWORD=yourStrong(!)Password
      - WFGEN_DATABASE_USER_PASSWORD=yourStrong(!)Password
      - WFGEN_ADMIN_PASSWORD=yourStrong(!)Password
    volumes:
      - pgdata:C:\pgsql\data
    ports:
      - 5432:5432

volumes:
  licenses:
    external: true
  wfgdata:
  pgdata:

For a new PostgreSQL 18 deployment on LTSC2022, select 10.5.0-postgres18-win-ltsc2022 and a fresh database volume. Do not reuse an existing PostgreSQL 17 data volume directly.

Run:

docker compose up -d

Access: http://localhost:8888/wfgen⁠ (username: wfgen_admin, password: yourStrong(!)Password)

⁠v10 with SQL Server 2025 Express on Windows

Prerequisites:

# Create volumes
docker volume create licenses
docker volume create wfgdata
docker volume create sqldata

# Copy license
$licensesPath = docker volume inspect --format "{{.Mountpoint}}" licenses
Copy-Item ~\Desktop\license.lic $licensesPath

# Generate symmetric encryption key
[guid]::NewGuid().ToString("N")
# Example: ca8e4e2b04254aeeadbcfc0724e3b62a

docker-compose.yml:

services:
  workflowgen:
    image: advantys/workflowgen:10.5.0-win-ltsc2022
    depends_on:
      - database
    environment:
      - WFGEN_DATABASE_CONNECTION_STRING=Data Source=database;Network Library=DBMSSOCN;Initial Catalog=WFGEN;User ID=WFGEN_USER;Password=yourStrong(!)Password;TrustServerCertificate=True;
      - WFGEN_APP_SETTING_ApplicationUrl=http://localhost:8888/wfgen
      - WFGEN_APP_SETTING_ApplicationSerialNumber=YOUR_WORKFLOWGEN_SERIAL_NUMBER
      - WFGEN_APP_SETTING_ApplicationSecurityPasswordSymmetricEncryptionKey=ca8e4e2b04254aeeadbcfc0724e3b62a
    ports:
      - 8888:80
    volumes:
      - licenses:C:\wfgen\licenses:RO
      - wfgdata:C:\wfgen\data
  database:
    image: advantys/workflowgen-sql:10.5.0-express-win-ltsc2022
    container_name: database
    environment:
      - SA_PASSWORD=yourStrong(!)Password
      - WFGEN_DATABASE_USER_PASSWORD=yourStrong(!)Password
      - WFGEN_ADMIN_PASSWORD=yourStrong(!)Password
    volumes:
      - sqldata:C:\wfgen\sql
    ports:
      - 1433:1433

volumes:
  licenses:
    external: true
  wfgdata:
  sqldata:

Run:

docker compose up -d

Access: http://localhost:8888/wfgen⁠ (username: wfgen_admin, password: yourStrong(!)Password)

⁠Linux Database Containers

WorkflowGen application images run on Windows, but v10 can connect to a Linux database container. See the dedicated repositories for complete examples:

• PostgreSQL⁠
• SQL Server⁠

⁠Configuration

⁠Database Connection Strings

⁠v10: PostgreSQL

WFGEN_DATABASE_CONNECTION_STRING=Host=database;Port=5432;Database=wfgen;Username=wfgen_user;Password=<password>;
WFGEN_DATABASE_CONNECTION_STRING_PROVIDER_NAME=Npgsql

⁠v10: SQL Server 2025

WFGEN_DATABASE_CONNECTION_STRING=Data Source=database;Initial Catalog=WFGEN;User ID=WFGEN_USER;Password=<password>;TrustServerCertificate=True

For v8 and v9 connection-string examples, see the documentation for the corresponding image tag.

⁠web.config File

Configure settings via environment variables: WFGEN_APP_SETTING_<name>

Example:

WFGEN_APP_SETTING_ApplicationUrl=https://example.com/wfgen

⁠iisnode Configuration for Node Applications

Configure IISNode: WFGEN_IISNODE_<app name>_<setting name>

Replace <app name> with the node child application name, such as AUTH, HOOKS, GRAPHQL, MCP, or SCIM.

Example:

WFGEN_IISNODE_AUTH_loggingEnabled=true

⁠iisnode Special Options

WFGEN_ENABLE_IISNODE_OPTION_<app name> - exposelogs value exposes logs via HTTP (debugging only)

⁠MCP OAuth Environment Variables (v10.3.0+)

Starting with WorkflowGen v10.3.0 images, the WorkflowGen MCP child application (/wfgen/mcp) accepts direct OAuthServer* and Mcp* environment variables. During container startup, the Docker entrypoint projects those values into the root wfgen\web.config appSettings so the MCP child app sees the same centralized configuration under IIS/iisnode.

WorkflowGen MCP Server 1.0.0 is supported starting with WorkflowGen 10.4.0. MCP OAuth browser login requires WorkflowGen to use OIDC or SAML authentication. If the container uses another authentication mode, keep OAuthServerEnabled=false.

The standard WorkflowGen Docker image deploys the portal under /wfgen, so the supported MCP endpoint is /wfgen/mcp. Do not override McpResourceUri to a root /mcp URL while the portal still runs under /wfgen; root /mcp is intended for no-virtual-directory deployments that use the root deployment configuration.

Minimum MCP OAuth configuration:

OAuthServerEnabled=true
OAuthServerKeyEncryptionKey=<base64-or-base64url-32-byte-key>
OAuthServerBridgeTokenSigningSecret=<strong-random-secret>

Optional overrides:

OAuthServerAccessTokenLifetimeSeconds=3600
OAuthServerAuthorizationCodeLifetimeSeconds=600
OAuthServerRefreshTokenLifetimeSeconds=7776000
OAuthServerAllowLocalhostRedirects=true
McpResourceUri=https://<public-host>/wfgen/mcp
McpAllowedScopes=mcp:read mcp:write mcp:process_admin mcp:admin
McpDiagnosticLogLevel=INFO

McpResourceUri should normally be ApplicationUrl + "/mcp". If it is explicitly overridden, it must be an absolute HTTPS URL without a query string or fragment, and its path must end with /mcp. Because MCP OAuth metadata requires HTTPS, expose the container through HTTPS and set WFGEN_APP_SETTING_ApplicationUrl to the public HTTPS WorkflowGen URL.

The Docker image uses the durable WorkflowGen OAuth store and the hardened production IIS profile automatically, so no extra store or child-application setting is normally required.

Set OAuthServerAllowLocalhostRedirects=true only when an authorized desktop or command-line client uses a loopback callback such as http://localhost, http://127.0.0.1, or http://[::1]. This setting does not allow arbitrary HTTP redirect URIs.

⁠Custom Connection Strings

Add custom connection strings: WFGEN_CUSTOM_CONNECTION_STRING_<name>=<connection_string>

This adds the connection string with default provider System.Data.SqlClient.

Specify custom provider:

WFGEN_CUSTOM_CONNECTION_STRING_<name>_PROVIDER_NAME=<provider_name>

Example (PostgreSQL):

WFGEN_CUSTOM_CONNECTION_STRING_MyCustomDB=Host=myserver;Port=5432;Database=mydb;Username=user;Password=pass;
WFGEN_CUSTOM_CONNECTION_STRING_MyCustomDB_PROVIDER_NAME=Npgsql

⁠Secrets Management

For Docker Secrets and Kubernetes Secrets, any environment variable can be suffixed with _FILE. Its value is a path to a file containing the real value.

Note: Variables with and without _FILE suffix are mutually exclusive.

Docker Swarm example:

# Create secrets
"84c953d4eac14da2ba93c010e85c76e0" | docker secret create ApplicationSecurityPasswordSymmetricEncryptionKey -
"Host=database;Port=5432;Database=wfgen;Username=wfgen_user;Password=secretPassword;" | docker secret create WFGEN_DATABASE_CONNECTION_STRING -
"YOUR_SERIAL_NUMBER" | docker secret create ApplicationSerialNumber -

# Create WorkflowGen service (v10 with PostgreSQL)
docker service create `
    --env WFGEN_APP_SETTING_ApplicationSecurityPasswordSymmetricEncryptionKey_FILE=C:\ProgramData\Docker\secrets\ApplicationSecurityPasswordSymmetricEncryptionKey `
    --env WFGEN_DATABASE_CONNECTION_STRING_FILE=C:\ProgramData\Docker\secrets\WFGEN_DATABASE_CONNECTION_STRING `
    --env WFGEN_DATABASE_CONNECTION_STRING_PROVIDER_NAME=Npgsql `
    --env WFGEN_APP_SETTING_ApplicationSerialNumber_FILE=C:\ProgramData\Docker\secrets\ApplicationSerialNumber `
    --secret ApplicationSecurityPasswordSymmetricEncryptionKey `
    --secret WFGEN_DATABASE_CONNECTION_STRING `
    --secret ApplicationSerialNumber `
    --mount "type=volume,src=licenses,dst=C:\wfgen\licenses,readonly" `
    advantys/workflowgen:10.5.0-win-ltsc2022

⁠Special Environment Variables

⁠Example Configuration Using Environment File

When you have multiple environment variables, use --env-file with docker run.

Example with Azure AD authentication (v10 with PostgreSQL):

WFGEN_AUTH_MODE=azure-v1
WFGEN_APP_SETTING_ApplicationUrl=https://example.com/wfgen
WFGEN_APP_SETTING_ApplicationSecurityAuthProvider=azure-v1
WFGEN_APP_SETTING_ApplicationSecurityAuthMetadataUrl=https://login.microsoftonline.com/<Directory ID>/.well-known/openid-configuration
WFGEN_APP_SETTING_ApplicationSecurityAuthClientId=SomeClientId
WFGEN_APP_SETTING_ApplicationSecurityAuthClientSecret=SomeClientSecret
WFGEN_APP_SETTING_ApplicationSecurityAuthUsernameClaim=upn
WFGEN_APP_SETTING_ApplicationSecurityAuthAppIdClaim=appid
WFGEN_APP_SETTING_ApplicationSecurityAuthSessionTokenSigningSecret=SomethingVerySecret
WFGEN_APP_SETTING_ApplicationSecurityPasswordSymmetricEncryptionKey=84c953d4eac14da2ba93c010e85c76e0
WFGEN_DATABASE_CONNECTION_STRING=Host=database;Port=5432;Database=wfgen;Username=wfgen_user;Password=secretPassword;
WFGEN_DATABASE_CONNECTION_STRING_PROVIDER_NAME=Npgsql

For v8 and v9 environment-file examples, see the documentation for the corresponding image tag.

⁠Authentication Methods

⁠OpenID Connect Providers

Supports Azure Active Directory, Auth0, ADFS, and Okta. See WorkflowGen docs⁠ for provider configuration.

For Docker deployments:

1. Set authentication method: WFGEN_AUTH_MODE (e.g., azure-v1, auth0, okta)
2. Set provider: WFGEN_APP_SETTING_ApplicationSecurityAuthProvider
3. Pass provider information via corresponding WFGEN_APP_SETTING_* environment variables

⁠Application Authentication

No special setup required. WFGEN_AUTH_MODE=application (default).

⁠Windows Integrated / Basic

Set WFGEN_AUTH_MODE=windows or basic. Requires Active Directory environment (container host must be domain joined).

⁠Volumes

Example:

docker run ... -v C:\Path\To\Licenses:C:\wfgen\licenses ... advantys/workflowgen:10.5.0-win-ltsc2019

Note: Map all volumes to persist data. Unmapped volumes lose data when container is removed.

⁠Site Offline/Online

# Set offline
docker container exec -i wfgen powershell C:\set-state.ps1 Offline

# Set online
docker container exec -i wfgen powershell C:\set-state.ps1 Online

Customize offline page:

Add your HTML file under appdata\Templates\server\offline.htm in the volume mounted at C:\wfgen\data. Compose prefixes volume names with its project name; use the actual mount, not a separately precreated wfgdata volume. Run this from the Compose directory on the Docker host with access to that mount:

$offlinePath = ".\offline.htm"
$containerId = @(docker compose ps -q workflowgen)
if ($LASTEXITCODE -ne 0 -or $containerId.Count -ne 1) { throw 'Select one running WorkflowGen container.' }
$mounts = docker inspect --format '{{json .Mounts}}' $containerId[0] | ConvertFrom-Json
if ($LASTEXITCODE -ne 0) { throw 'Container inspection failed.' }
$dataMount = @($mounts | Where-Object { $_.Destination -ieq 'C:\wfgen\data' })
if ($dataMount.Count -ne 1 -or -not (Test-Path -LiteralPath $dataMount[0].Source)) { throw 'Data mount is unavailable on this host.' }
$serverTemplatePath = Join-Path $dataMount[0].Source 'appdata\Templates\server'
if (-not (Test-Path $serverTemplatePath)) {
    New-Item $serverTemplatePath -ItemType Directory -Force
}
Copy-Item $offlinePath $serverTemplatePath

⁠Default Container State

When no environment variables are supplied:

• ApplicationUrl defaults to localhost/wfgen
• Authentication method is applicative (handled by WorkflowGen)
• No SSL certificate (HTTP by default)
• Password symmetric encryption key is generated randomly
  • For production: use a fixed 32-character key via WFGEN_APP_SETTING_ApplicationSecurityPasswordSymmetricEncryptionKey

⁠Customize Files and Libraries

Use the onbuild variant to customize files in C:\inetpub\wwwroot or C:\Program Files\Advantys\WorkflowGen.

Example: Customize web.config, banner, and add custom library

File structure:

context-dir\
    inetpub\
        wwwroot\
            wfgen\
                web.config
                bin\MyCustomLib.dll
                App_Themes\Default\portal\banner\banner.htm
    Program Files\
        Advantys\WorkflowGen\Services\Bin\MyCustomLib.dll

Dockerfile:

#escape=`
FROM advantys/workflowgen:10.5.0-win-ltsc2019-onbuild

Build:

docker build -t mycorporation/workflowgen:10.5.0-win-ltsc2019 .

⁠Updates

Update by changing the version in your Dockerfile and rebuilding:

- FROM advantys/workflowgen:10.4.0-win-ltsc2019-onbuild
+ FROM advantys/workflowgen:10.5.0-win-ltsc2019-onbuild

docker build -t mycorporation/workflowgen:10.5.0-win-ltsc2019 .

⁠Support and Documentation

• WorkflowGen Docker Guide: https://docs.workflowgen.com/docker⁠
• WorkflowGen Documentation: https://docs.workflowgen.com⁠
• Database Images:
  • PostgreSQL (v10): advantys/workflowgen-postgres⁠
  • SQL Server (v8, v9, v10): advantys/workflowgen-sql⁠

⁠License

By using this image, you agree to the WorkflowGen End User License Agreement. Visit workflowgen.com⁠ for details.