Ransomware attackers specifically target and attempt to destroy backup systems to increase the probability of payment. Hardening your system is critical. Please ensure you have reviewed your platform security using the Security Hardening Checklist
Cohesity

COHESITY Documentation

Explore our documentation to get started, discover products & new features, access troubleshooting guides, register sources, platforms support.

Products
Data Security Alliance
Visit Cohesity.com
Demos
Support
Blogs
Developers
Partner Portals
Cohesity Community
© 2026 Cohesity, Inc. All Rights Reserved.
Terms of Use|
Privacy Policy|
Legal|
  1. Home
  3. NetBackup™ Snapshot Manager for Data Center Administrator's Guide
  5. Deploying NetBackup Snapshot Manager for Data Center using container images
  7. Installing NetBackup Snapshot Manager for Data Center in the Docker/Podman environment
NetBackup™ Snapshot Manager for Data Center Administrator's Guide

Installing NetBackup Snapshot Manager for Data Center in the Docker/Podman environment

Note:

When you deploy NetBackup Snapshot Manager for Data Center, you may want to copy the commands below and paste them into your command line interface. If you do, replace the information in these examples that is different from your own: the product and build version, the download directory path, and so on.

NetBackup Snapshot Manager for Data Center installation prerequisites on Podman:

  • Run the following commands to install the required packages (lvm2, udev, plugins, udica, and policycoreutils-devel) on the hosts:

    #yum install -y lvm2

    #yum install -y lvm2-libs

    #yum install -y python3-pyudev

    #yum install -y systemd-udev

    #yum install -y podman-plugins

  • #yum install -y udica

  • #yum install -y policycoreutils-devel

Installing NetBackup Snapshot Manager for Data Center

Perform the following appropriate steps depending on the Docker or Podman environment.

To install NetBackup Snapshot Manager for Data Center

  1. Download the NetBackup Snapshot Manager for Data Center image to the system on which you want to deploy NetBackup Snapshot Manager for Data Center from the Veritas Support Portal.

    Note:

    You must log on to the support site to download.

    From the Products dropdown, select NetBackup and select the required version from the Version dropdown. Click Explore. Click Base and upgrade installers.

    The NetBackup Snapshot Manager for Data Center image name resembles the following format for Docker and Podman environment:

    NetBackup_SnapshotManager_<version>.tar.gz

    Note:

    The actual file name may vary depending on the release version.

  2. Un-tar the image file and list the contents:
    # ls
NetBackup_SnapshotManager_xx.x.x.x.xxxx.tar.gz
netbackup-flexsnap-xx.x.x.x.xxxx.tar.gz
flexsnap_preinstall.sh
  3. Run the following command to prepare the NetBackup Snapshot Manager for Data Center host for installation:

    # sudo ./flexsnap_preinstall.sh

    (For Docker on RHEL 7.9) The output resembles as follows:

    Validate host resources                  ...  done
Check for docker installation            ...  done
Validate docker version support          ...  done
Check for docker socket file             ...  done
Checking for required packages           ...  done
Validate required services health        ...  done
Loading Snapshot Manager service images  ...  done
Copying flexsnap_configure script        ...  done

    (For Podman on RHEL 8.x/RHEL-9.x) The output resembles as follows:

    Checking for disk space                  ...  done
Checking for swap space                  ...  done
Validate host resources                  ...  done
Validate SELINUX                         ...  done
Check for podman installation            ...  done
Validate podman version support          ...  done
Check for podman socket file             ...  done
Checking for required packages           ...  done
Validate required services health        ...  done
Removing deprecated services             ...  done
Loading Snapshot Manager service images  ...  done
Creating nbsvcusr user and group         ...  done
Loading CIL policy for containers        ...  done
Copying flexsnap_configure script        ...  done
  4. Use the following command options to configure and install help:

    Configure: # flexsnap_configure -h

    Usage: flexsnap_configure [OPTIONS] <COMMAND> [CMD_OPTIONS]
 
NetBackup Snapshot Manager (10.4.x.x-xxxx) configuration script
 
Options:
  -h, --help
        Print this message and exit
Command:
  backup      To create backup of Snapshot Manager metadata.
  install     To install the Snapshot Manager stack on a host.
  recover     To restore from backup copy Snapshot Manager 
              metadata.
  renew       To renew the Snapshot Manager certificates or 
              extension.
  restart     To restart the Snapshot Manager services on a host.
  start       To start the Snapshot Manager services on a host.
  status      To get the health status of Snapshot Manager 
              services.
  stop        To stop the Snapshot Manager services on a host.
  serverinfo  To get the NetBackup primary and Snapshot Manager 
              servers information.
  truststore  To list and update Snapshot Manager truststore.
  uninstall   To uninstall the Snapshot Manager stack on a host.
  updatedb    To update NetBackup details in Snapshot Manager 
              Database.
  verify      To verify the Snapshot Manager certificates.
      
Run flexsnap_configure <COMMAND> --help for more information

    Install: # flexsnap_configure install -h

    Usage: flexsnap_configure install [OPTIONS]

    Options

    Description

    --http-proxy <URI>

    HTTP proxy for all Snapshot Manager for Data Center connections. Example: http://proxy.mycompany.com:8080/

    Must be used with the --https-proxy and --no-proxy options.

    --port <port_number>

    NGINX port for Snapshot Manager for Data Center (default: 443).

    --primary <IP/FQDN>

    IP address, FQDN, or private hostname of the primary server. Not required when reinstalling Snapshot Manager for Data Center using the --force option.

    --snapshot-manager <IP/FQDN>

    IP address, FQDN, or private hostname of the Snapshot Manager for Data Center server.

    --token <token>

    Reissue or standard token. For the Snapshot Manager for Data Center extension, it acts as a workflow token. Applicable only for NetBackup CA deployment.

    (Mandatory) For interactive installation.

    (Optional) For Snapshot Manager for Data Center deployment if NetBackup primary security setting is medium or low.

    Not required if Snapshot Manager for Data Center is reinstalled using the --force option.

    See Creating tokens for installation.

    --add-host <hostname:ip>

    (Optional) You can add custom host to IP mapping in the container's /etc/hosts file. You can pass it multiple times for each hostname:ip combination. Use it when Snapshot Manager for Data Center stack is not able to resolve the provided primary hostname(s) using the system DNS.

    --ca <ca>

    (Optional) Absolute path of Root CA certificate file. Applicable when installing Snapshot Manager for Data Center using external CA. Must be used with the --chain and --key options.

    --chain <chain>

    (Optional) Absolute path of certificate chain. The directory must include all intermediate CAs and the server certificate, excluding the Root CA certificate. Use this when installing Snapshot Manager with an external CA. Must be used with the --ca and --key options.

    --crlcheck <level>

    (Optional) Controls how Snapshot Manager for Data Center checks certificate revocation status using CRL. Valid values:

    • 0 - Disabled

    • 1 - Leaf certificate only (default)

    • 2 - Entire certificate chain

    --crlpath <directory>

    (Optional) Absolute path of the directory containing CRL files. Use this when the Certificate Authority is not accessible from the Snapshot Manager for Data Center host.

    --extension

    (Optional) Installs the Snapshot Manager for Data Center extension. Use this for both fresh installations and upgrades. For fresh installations, must be used with the --extname and --snapshot-manager options.

    --extname <name>

    (Optional) Snapshot Manager for Data Center extension name identifier. Applicable for fresh installation of Snapshot Manager for Data Center extension.

    --force

    (Optional) Reinstalls Snapshot Manager for Data Center or its extension with the same version. No additional options are required, except --extension, when reinstalling the Snapshot Manager for Data Center extension.

    --host names <IP/FQDN>

    (Optional) IP address, FQDN, or private hostname of Snapshot Manager for Data Center. Default is the machine's FQDN.

    --https-proxy <URI>

    (Optional) HTTPS proxy for all Snapshot Manager for Data Center connections. Example: http://proxy.mycompany.com:8080/.

    Must be used with the --http-proxy and --no-proxy options.

    -i

    (Optional) For interactive installation or upgrade.

    --key <key>

    (Optional) Absolute path to the server certificate private key file. Required when installing Snapshot Manager for Data Center using an external CA. Must be used with the --ca and --chain options.

    --no-proxy <hostnames>

    (Optional) Hosts allowed to bypass the proxy server. Example: localhost,mycompany.com,192.168.0.10:80.

    Must be used with the --http-proxy and --https-proxy options.

    --path <install_path>

    (Optional) Absolute path of Snapshot Manager for Data Center home directory. Default is /cloudpoint.

    --passphrase <file>

    (Optional) Absolute path of file containing passphrase to access the keystore . Applicable when server certificate private key file is encrypted with a passphrase.

    --subnet4 <string>

    (Optional) Configure Snapshot Manager for Data Center network with a custom IPv4 subnet. The value must be in CIDR format.

    --subnet6 <string>

    (Optional) Configure Snapshot Manager for Data Center network with a custom IPv6 subnet. The value must be in CIDR format.

  5. Interactive and non-interactive installation of NetBackup Snapshot Manager for Data Center:

    Interactive installation of NetBackup Snapshot Manager for Data Center (NBCA/ECA)

    • NetBackup Snapshot Manager for Data Center host is behind a proxy server:

      # flexsnap_configure install -i --no-proxy <no_proxy_value> --http-proxy <http_proxy_value> --https-proxy <https_proxy_value>

    • NetBackup Snapshot Manager for Data Center/Primary server is configured with a private host name:

      # flexsnap_configure install -i --add-host <nbsm_hostname>:<IP> --add-host <primary_hostname>:<IP>

    • NetBackup Snapshot Manager for Data Center installation on custom path:

      # flexsnap_configure install -i --path <installation_path>

      Note:

      The flexsnap_configure CLI uses the privilege flag implicitly (-u 0).

      The installer displays messages similar to the following for interactive CLI (NBCA):

      # flexsnap_configure install -i
Configuration started at time: Sat Jul 29 14:34:08 UTC 2023
Docker server version: 20.10.7
This is a fresh install of NetBackup Snapshot Manager xx.x.x.x.xxxx

Please provide NetBackup Primary details:
NetBackup primary server IP Address or FQDN: <nbu_primary_fqdn>
Start configuring with NetBackup CA certificate.
Provide NetBackup authentication token: <security_token>
NetBackup Snapshot Manager hostname for TLS certificate (64 char FQDN limit): <snapshot_manager_fqdn>
Port (default:443):
Creating runtime CIL policy ...done
Configuration started at time: Wed Jan  3 05:33:08 UTC 2024
Podman server version: 4.2.0
This is a fresh install of NetBackup Snapshot Manager xx.x.x-xxxx
Creating network: flexsnap-network ...done
Starting container: flexsnap-fluentd ...done
Creating container: flexsnap-postgresql ...done
Creating container: flexsnap-rabbitmq ...done
Creating container: flexsnap-certauth ...done
Creating container: flexsnap-api-gateway ...done
Creating container: flexsnap-coordinator ...done
Creating container: flexsnap-listener ...done
Creating container: flexsnap-agent ...done
Creating container: flexsnap-onhostagent ...done
Creating container: flexsnap-scheduler ...done
Creating container: flexsnap-policy ...done
Creating container: flexsnap-notification ...done
Creating container: flexsnap-nginx ...done
Waiting for Snapshot Manager configuration to complete (21/21) ...done
Configuration complete at time Wed Jan  3 05:37:54 UTC 2024!
Please register Snapshot Manager with NetBackup primary server.

      The installer displays messages similar to the following for interactive CLI under ECA:

      # flexsnap_configure install -i
Configuration started at time: Sat Jul 29 10:43:06 UTC 2023
Docker server version: 24.0.2
This is a fresh install of NetBackup Snapshot Manager xx.x.x.x.xxxx

Please provide NetBackup Primary details:
NetBackup primary server IP Address or FQDN: <nbu_primary_fqdn>
Start configuring external CA certificate.
Absolute path of the root CA certificate file: <root_ca_file>
Absolute path of server private key file: <server_key_file>
Absolute path of server certificate chain: <server_chain_file>
Absolute path of key passphrase file (Press ENTER if keyfile is non encrypted): <server_passphrase_file>
Absolute path of CRL directory (Press ENTER for CDP based CRL check): <crl_path>
CRL check level, Press ENTER for default 1 i.e. LEAF (0: DISABLE, 1: LEAF and 2:CHAIN): <crl_level>
NetBackup Snapshot Manager hostname for TLS certificate (64 char FQDN limit): <snapshot_manager_fqdn>
Port (default:443): <snapshot_manager_port>
Creating runtime CIL policy ...done
Configuration started at time: Tue Jan  2 10:44:07 UTC 2024
Podman server version: 4.2.0
This is a fresh install of NetBackup Snapshot Manager xx.x.x-xxxx
Creating network: flexsnap-network ...done
Starting container: flexsnap-fluentd ...done
Creating container: flexsnap-postgresql ...done
Creating container: flexsnap-rabbitmq ...done
Creating container: flexsnap-certauth ...done
Creating container: flexsnap-api-gateway ...done
Creating container: flexsnap-coordinator ...done
Creating container: flexsnap-listener ...done
Creating container: flexsnap-agent ...done
Creating container: flexsnap-onhostagent ...done
Creating container: flexsnap-scheduler ...done
Creating container: flexsnap-policy ...done
Creating container: flexsnap-notification ...done
Creating container: flexsnap-nginx ...done
Waiting for Snapshot Manager configuration to complete (21/21) ...done
Configuration complete at time Tue Jan  2 10:49:02 UTC 2024!
Please register Snapshot Manager with NetBackup primary server

    Noninteractive installation of NetBackup Snapshot Manager for Data Center with NetBackup CA (NBCA)

    • NetBackup primary server security level is MEDIUM or Snapshot Manager for Data Center host name is known to the primary server:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn>

    • NetBackup primary server security level is HIGH or VERY HIGH:

      # flexsnap_configure install --primary <primary> --token <standard_token> --hostnames <nbsm_ip_or_fqdn>

    • NetBackup Snapshot Manager for Data Center host is behind a proxy server:

      Note:

      NetBackup Snapshot Manager for Data Center does not support HTTPS (TLS-enabled) proxy servers.

      # flexsnap_configure install --primary <primary> --token <standard_token> --hostnames <nbsm_ip_or_fqdn> --no-proxy <no_proxy_value> --http-proxy <http_proxy_value> --https-proxy <https_proxy_value>

    • NetBackup Snapshot Manager for Data Center/Primary server is configured with a private host name:

      # flexsnap_configure install --primary <primary> --token <standard_token> --hostnames <nbsm_ip_or_fqdn> --add-host <nbsm_hostname:IP> --add-host <primary_hostname:IP>

    • NetBackup Snapshot Manager for Data Center installation on custom path or port:

      # flexsnap_configure install --primary <primary> --token <standard_token> --hostnames <nbsm_ip_or_fqdn> --path <installation_path> --port <port>

      The installer displays messages similar to the following for non-interactive CLI (NBCA):

      # flexsnap_configure install --primary <nbu_primary_fqdn> --token <security_token>  --hostnames <snapshot_manager_fqdn>

Start configuring with NetBackup CA certificate.
Creating runtime SELinux policy ...done
Configuration started at time: Wed Jan 17 10:39:54 UTC 2024
Podman server version: 4.6.1
This is a fresh install of NetBackup Snapshot Manager 10.4.x.x-xxxx
Creating network: flexsnap-network ...done
Starting container: flexsnap-fluentd ...done
Creating container: flexsnap-postgresql ...done
Creating container: flexsnap-rabbitmq ...done
Creating container: flexsnap-certauth ...done
Creating container: flexsnap-api-gateway ...done
Creating container: flexsnap-coordinator ...done
Creating container: flexsnap-listener ...done
Creating container: flexsnap-agent ...done
Creating container: flexsnap-onhostagent ...done
Creating container: flexsnap-scheduler ...done
Creating container: flexsnap-policy ...done
Creating container: flexsnap-notification ...done
Creating container: flexsnap-nginx ...done
Waiting for Snapshot Manager configuration to complete (21/21) ...done
Configuration complete at time Wed Jan 17 10:45:05 UTC 2024!
Please register Snapshot Manager with NetBackup primary server

    Non-interactive installation of NetBackup Snapshot Manager for Data Center with external CA (ECA)

    • Encrypted private key:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file> --passphrase <file>

    • Non-encrypted private key:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file>

    • With user-provided CRL path/CRL check:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file> --crlpath <directory> --crlcheck <level>

    • NetBackup Snapshot Manager for Data Center host is behind a proxy server:

      Note:

      NetBackup Snapshot Manager for Data Center does not support HTTPS (TLS-enabled) proxy servers.

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file> --no-proxy <no_proxy_value> --http-proxy <http_proxy_value> --https-proxy <https_proxy_value>

    • NetBackup Snapshot Manager for Data Center/Primary server is configured with a private host name:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file> --add-host <nbsm_hostname:IP> --add-host <primary_hostname:IP>

    • NetBackup Snapshot Manager for Data Center installation on custom path/port:

      # flexsnap_configure install --primary <primary> --hostnames <nbsm_ip_or_fqdn> --ca <path_of_root_CA> --key <path_of_private_key_file> --chain <server_chain_file> --path <installation_path> --port <port>

      The installer displays messages similar to the following for non-interactive CLI (ECA):

      # flexsnap_configure install --primary <nbu_primary_fqdn> --hostnames <snapshot_manager_fqdn> --ca <root_ca_file> --key <server_key_file> --passphrase <server_passphrase_file> --chain <server_chain_file> --crlpath <crl_path> --crlcheck <level>
Start configuring external CA certificate.
Creating runtime CIL policy ...done
Configuration started at time: Tue Jan  2 11:35:21 UTC 2024
Podman server version: 4.2.0
This is a fresh install of NetBackup Snapshot Manager xx.x.x.x-xxxx
Creating network: flexsnap-network ...done
Starting container: flexsnap-fluentd ...done
Creating container: flexsnap-postgresql ...done
Creating container: flexsnap-rabbitmq ...done
Creating container: flexsnap-certauth ...done
Creating container: flexsnap-api-gateway ...done
Creating container: flexsnap-coordinator ...done
Creating container: flexsnap-listener ...done
Creating container: flexsnap-agent ...done
Creating container: flexsnap-onhostagent ...done
Creating container: flexsnap-scheduler ...done
Creating container: flexsnap-policy ...done
Creating container: flexsnap-notification ...done
Creating container: flexsnap-nginx ...done
Waiting for Snapshot Manager configuration to complete (21/21) ...done
Configuration complete at time Tue Jan  2 11:40:12 UTC 2024!
Please register Snapshot Manager with NetBackup primary server
  6. Use the following docker command to view the docker images that are loaded on the host:

    • (For Docker) # sudo docker images

    • (For Podman) # sudo podman images

    The output resembles as follows:

    REPOSITORY             TAG            IMAGE ID       CREATED       SIZE
veritas/flexsnap-deploy       10.3.x.xxxxx   5260748d9eab   18 minutes ago   586MB
veritas/flexsnap-rabbitmq     10.3.x.xxxxx   cff89dc78a2f   18 minutes ago   546MB
veritas/flexsnap-postgresql   10.3.x.xxxxx   0b87fe88cf94   18 minutes ago   537MB
veritas/flexsnap-nginx        10.3.x.xxxxx   ee1cf2a3159e   18 minutes ago   649MB
veritas/flexsnap-fluentd      10.3.x.xxxxx   a384e3fc4167   19 minutes ago   681MB
veritas/flexsnap-core         10.3.x.xxxxx   2393b221bf19   20 minutes ago   916MB
veritas/flexsnap-datamover    10.3.x.xxxxx   8254c537bdb4   38 hours ago     1.18GB
  7. Provide the following details when prompted on the command prompt:

    Parameter

    Description

    Authorization token

    If NetBackup Certificate Authority is used, the installer requires an authorization token to successfully deploy security certificates.

    Host name for TLS certificate

    Specify the IP address or the Fully Qualified Domain Name (FQDN) of the NetBackup Snapshot Manager for Data Center host.

    The specified name or IP address is added to the list of host names to use for configuring NetBackup Snapshot Manager for Data Center. The installer uses this name to generate a server certificate for the NetBackup Snapshot Manager for Data Center host.

    Port

    Specify the port through which the NetBackup Snapshot Manager for Data Center can communicate. The default is port 443.

    The installer then displays messages similar to the following:

    Configuring admin credentials ...done
Waiting for Snapshot Manager configuration to complete (22/22) ...done
Configuration complete at time Thu Jun 9 06:15:43 UTC 2022!

    Note:

    After the deployment of NetBackup Snapshot Manager for Data Center, ensure that the IPv6 interface on the system is not disabled.

  8. This concludes the NetBackup Snapshot Manager for Data Center deployment process. The next step is to register the NetBackup Snapshot Manager for Data Center with the NetBackup primary server.

Note:

If you ever need to restart NetBackup Snapshot Manager for Data Center, use the docker run command so that your environmental data is preserved.

See Restarting NetBackup Snapshot Manager for Data Center.

Feedback

Was this page helpful?
Previous

Before you begin installing NetBackup Snapshot Manager for Data Center

Next

Securing the connection to NetBackup Snapshot Manager for Data Center

Feedback

Was this page helpful?