# Connect NGINX Plus container images

Type of document: How-to guide
Product: NGINX One Console

---


## Overview

This guide explains how to set up an F5 NGINX Plus Docker container with NGINX Agent and connect it to the NGINX One Console.

---

## Before you start

Before you start, make sure you have:

- A valid JSON Web Token (JWT) for your NGINX subscription.
- [A data plane key from NGINX One](/nginx-one-console/connect-instances/create-manage-data-plane-keys.md).
- Docker installed and running on your system.

#### Download your JWT license from MyF5

1. Log in to [MyF5](https://my.f5.com/manage/s/).
1. Go to **My Products & Plans > Subscriptions** to see your active subscriptions.
1. Find your NGINX subscription, and select the **Subscription ID** for details.
1. Download the **JSON Web Token** file from the subscription page.

---

## Process for private registry

### Log in to the NGINX private registry

Use your JWT to log in to the NGINX private registry. Replace `YOUR_JWT_HERE` with your JWT.

```sh
sudo docker login private-registry.nginx.com --username=YOUR_JWT_HERE --password=none
```

**Note:** 
To protect your system and data, follow these security practices:

1. **JWTs:** Treat JSON Web Tokens (JWTs) as sensitive data. Store them securely and delete them after use to prevent unauthorized access.

2. **Shell history:** Commands with JWTs or passwords are saved in plain text in your shell history. After running such commands, clear the history to protect credentials. For example:
   - Edit your shell history file (such as ~/.bash_history or ~/.zsh_history) to remove specific commands.
   - Use `history -c` to clear all shell history in bash or zsh.

### Pull the NGINX Plus image

Pull the NGINX Plus image from the private registry. Replace `<version-tag>` with the desired version, such as `alpine`, `debian`, or `ubi`.

```sh
docker pull private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
```

You must specify a version tag that matches your distribution. The `latest` tag is not supported. Learn more in the [Deploying NGINX and NGINX Plus on Docker](/nginx/admin-guide/installing-nginx/installing-nginx-docker.md#pull-the-image) guide.

<br>

**Note:** 
To pull the `debian` image:

```sh
sudo docker pull private-registry.nginx.com/nginx-plus/agent:debian
```

### Start the NGINX Plus container

Start the Docker container to connect it to NGINX One. Replace `YOUR_NGINX_ONE_DATA_PLANE_KEY_HERE` with your data plane key and `version-tag` with the version tag you pulled.

**For NGINX Plus R33 or later**:

- Use the `NGINX_LICENSE_JWT` variable to pass your JWT license. Replace `YOUR_JWT_HERE` with your JWT.

For more details, see [About subscription licenses](solutions/about-subscription-licenses.md).

```sh
sudo docker run \
--env=NGINX_LICENSE_JWT=<YOUR_JWT_HERE> \
--env=NGINX_AGENT_COMMAND_SERVER_PORT=443 \
--env=NGINX_AGENT_COMMAND_SERVER_HOST=agent.connect.nginx.com \
--env=NGINX_AGENT_COMMAND_AUTH_TOKEN=<YOUR_DATAPLANE_KEY_HERE> \
--env=NGINX_AGENT_COMMAND_TLS_SKIP_VERIFY=false \
--restart=always \
--runtime=runc \
-d private-registry.nginx.com/nginx-plus/agentv3:<version-tag>
```

<br>

**Note:** 
To start the container with the `debian` image:

```sh
sudo docker run \
--env=NGINX_LICENSE_JWT=<YOUR_JWT_HERE> \
--env=NGINX_AGENT_COMMAND_SERVER_PORT=443 \
--env=NGINX_AGENT_COMMAND_SERVER_HOST=agent.connect.nginx.com \
--env=NGINX_AGENT_COMMAND_AUTH_TOKEN=<YOUR_DATAPLANE_KEY_HERE> \
--env=NGINX_AGENT_COMMAND_TLS_SKIP_VERIFY=false \
--restart=always \
--runtime=runc \
-d private-registry.nginx.com/nginx-plus/agentv3:debian
```

---

## References

For more details, see:

- [Deploying NGINX and NGINX Plus on Docker](/nginx/admin-guide/installing-nginx/installing-nginx-docker.md)
- [Full List of Agent Environment Variables](/agent/configuration/configuration-overview.md#cli-flags-and-environment-variables)
- [NGINX One Data Plane Keys](/nginx-one-console/connect-instances/create-manage-data-plane-keys.md)
- [My F5 Knowledge Article](https://my.f5.com/manage/s/article/K000090257)