intersystems-community/iris-agentic-dev/iris-cpf-merge

from iris_devtester.config.presets import CPFPreset
# Enable CallIn service only
CPFPreset.ENABLE_CALLIN
# → [Actions]
# → ModifyService:Name=%Service_CallIn,Enabled=1,AutheEnabled=48
# Clear the expiry on SuperUser and _SYSTEM, enable CallIn
CPFPreset.SECURE_DEFAULTS
# Despite the name this keeps the default password: the account stays `SYS`, with no expiry.
# Use it for CI containers that are never published or shared, and nowhere else.
# Memory tuning for CI
CPFPreset.CI_OPTIMIZED
# → [config]
# → globals=0,0,256,0,0,0
# → gmheap=64000

# merge.cpf
[Actions]
CreateDatabase:Name=MYAPP_DATA,Directory=/dur/iris/mgr/MYAPP_DATA
CreateNamespace:Name=MYAPP,Globals=MYAPP_DATA,Routines=MYAPP_DATA,Interop=1
ModifyService:Name=%Service_CallIn,Enabled=1,AutheEnabled=48

# docker-compose.yml
services:
  iris:
    ports:
      - "127.0.0.1:1972:1972"
      - "127.0.0.1:52773:52773"
    environment:
      - ISC_CPF_MERGE_FILE=/irisdev/app/merge.cpf
      - ISC_DATA_DIRECTORY=/dur/iris
      # Passed through from the shell that runs `docker compose up`; never a literal here.
      - IRIS_PASSWORD
    volumes:
      - .:/irisdev/app
      - iris-data:/dur

[Actions]
# Create a namespace with separate databases
CreateResource:Name=%DB_MYNS_DATA,Description="MYNS data"
CreateDatabase:Name=MYNS_DATA,Directory=/dur/iris/mgr/MYNS_DATA
CreateNamespace:Name=MYNS,Globals=MYNS_DATA,Routines=MYNS_DATA,Interop=1
 
# Enable CallIn (required for DBAPI)
ModifyService:Name=%Service_CallIn,Enabled=1,AutheEnabled=48
 
# Give an application user only the roles it needs. %All is for an administrator.
ModifyUser:Name=myapp,Roles=%Developer

# 1. The intersystemsdc images read IRIS_PASSWORD at first boot and set _SYSTEM's password.
#    It then shows in `docker inspect` and in the run command, so prefer 2 for anything shared.
docker run -d --name my-iris -p 127.0.0.1:1972:1972 -p 127.0.0.1:52773:52773 \
  -e IRIS_PASSWORD="$IRIS_PASSWORD" intersystemsdc/iris-community:latest

from iris_devtester import IRISContainer
from iris_devtester.config.presets import CPFPreset
# Automatic (1.18.0+): start() injects SECURE_DEFAULTS automatically
with IRISContainer.community() as iris:
    conn = iris.get_connection()   # expiry cleared by CPF, password still the default: CI only
# Manual override: provide your own CPF content
iris = (
    IRISContainer.community()
    .with_cpf_merge(CPFPreset.SECURE_DEFAULTS + "\nCreateResource:Name=%DB_APP,Description=app")
)
# From file
iris = IRISContainer.community().with_cpf_merge("/path/to/merge.cpf")

# WRONG: calling unexpire_all_passwords() before every connection
unexpire_all_passwords(container_name)   # docker exec, fragile, fails in restricted CI
conn = iris.connect(...)
# RIGHT (1.18.0+): CPF merge handles it at startup
# iris.get_connection() is optimistic — no pre-emptive docker exec
conn = iris.get_connection()