Configure Licensing
MoveIt Pro validates its license against a stable identity for the computer running the licensed process. In a container, provide access to the same host hardware and persistent data on every start. Inconsistent access can change or hide the identity and prevent activation.
Configure the License Key
Set MOVEIT_LICENSE_KEY in the environment of every process that uses licensed MoveIt Pro functionality. Keep the key out of images, source control, logs, and Compose files. Use a secret manager or an environment file with restricted permissions.
For operation without a continuous connection to the license server, see Running Offline Without an Internet Connection.
Understand the Hardware Identity
MoveIt Pro selects the first available identity source:
- The TPM 2.0 endorsement key through
/dev/tpmrm0. - The permanent MAC address of a physical network interface through host sysfs.
If neither source is accessible, activation fails. Container IDs, virtual Ethernet addresses, CPU model, and architecture are not used because they are not stable, machine-unique identities.
After successful validation, MoveIt Pro records the selected source in <data-dir>/licensing/fingerprint_pin. It continues using that source even if a higher-priority source becomes available later. This prevents a configuration change from silently creating a different identity and consuming another activation.
Every restart, container replacement, and licensed service must retain access to the source used for activation. A TPM-pinned installation does not fall back to a MAC address when TPM access disappears. A MAC-pinned installation does not switch to a TPM when one appears.
Do not delete fingerprint_pin unless you intend to select a new source and activate again. Re-activation can consume another activation. Contact support@picknik.ai before changing the source when the license is near its activation limit.
Configure a Linux Container
The shipped Linux MoveIt Pro Compose files configure the required access. Apply the same contract to custom Compose files and MoveIt Pro Core containers on Linux hosts. The sysfs and TPM paths below are Linux-specific.
Persist Licensing Data
Bind-mount the standard persistent host directory at the container data directory and set MOVEIT_CONTAINER_DATA_DIR to that path:
environment:
MOVEIT_CONTAINER_DATA_DIR: /home/${MOVEIT_USERNAME:-moveit-pro-user}/.local/share/moveit_pro
volumes:
- ${MOVEIT_HOST_DATA_DIR:-${HOME}/.local/share/moveit_pro}:/home/${MOVEIT_USERNAME:-moveit-pro-user}/.local/share/moveit_pro:rw
The default host path keeps moveit_pro_license, manual offline request and response exchange, and the container on the same licensing state. If MOVEIT_HOST_DATA_DIR overrides that path, set MOVEIT_CONTAINER_DATA_DIR to the same host path when running moveit_pro_license. The container user must be able to create <data-dir>/licensing/ and write fingerprint_pin. For a non-root container, initialize the bind-mounted host directory with ownership and mode bits that grant its effective UID and GID write access. Keep this mount across image upgrades and container replacement. Do not use an anonymous or temporary volume.
Different named MoveIt Pro instances may use separate data directories, but each directory must remain persistent and each instance must receive consistent access to the same host identity sources.
Provide Host Sysfs
Mount the complete host /sys tree read-only and point MOVEIT_HOST_SYSFS at it:
environment:
MOVEIT_HOST_SYSFS: /host/sys
volumes:
- /sys:/host/sys:ro
Mounting only /sys/class/net does not work. Its entries are symbolic links into /sys/devices, so the complete tree must be available. Keep the mount read-only.
Host networking is not required. The sysfs mount provides the same permanent network identity in host and bridge network modes.
Provide TPM Access
The TPM must expose an endorsement key at the standard persistent handle 0x81010001. For a container that does not run with --privileged, pass the TPM resource-manager device through Docker's device interface:
devices:
- /dev/tpmrm0:/dev/tpmrm0
A bind mount alone does not grant device-cgroup permission. Prefer devices or Docker's equivalent --device=/dev/tpmrm0:/dev/tpmrm0 option instead of adding privileged: true solely for licensing.
The container process also needs normal Unix permission to open the device. /dev/tpmrm0 is commonly mode 0660 and owned by the host's tss group. For a non-root process, add the numeric group ID that owns the host device:
export TPM_GID="$(stat -c '%g' /dev/tpmrm0)"
group_add:
- "${TPM_GID}"
Use the host's numeric GID rather than assuming the container's tss group has the same number. Device visibility and file permission are separate requirements: seeing /dev/tpmrm0 inside the container does not prove the process can read it.
Run docker compose from the same shell, or store TPM_GID in the Compose .env file, so Compose receives the value.
If the host has no TPM, omit the device and group settings. Keep the full sysfs configuration so MoveIt Pro can use a permanent network interface instead.
Keep Deployments Consistent
Apply these rules to every licensed container on a computer:
- Supply the same license key intentionally; do not bake it into an image.
- Preserve each container's configured data directory across replacement and upgrades.
- Keep the hardware access used at activation available on every start.
- Use the full read-only host sysfs mount wherever the MAC tier may be needed.
- Pass TPM access with the same device path and host group permissions wherever the TPM tier may be needed.
- Update all Compose overlays, service definitions, launch scripts, and orchestration manifests together.
A partial rollout can leave one service able to resolve the pinned identity while another fails. Diagnose the container's hardware mounts, device permissions, data directory, and fingerprint_pin before requesting another activation.
Change Hardware
Replacing the selected network adapter, replacing the TPM, or changing container access to the pinned source can prevent validation. The error identifies the missing or changed source and the pin file.
Restore the original hardware access when possible. Developer licenses use hosted-floating activations. A new identity consumes another concurrent activation slot, so ensure one is available before changing the source. Runtime licenses use node-locked activations. Contact support@picknik.ai to clear or review the existing activation before removing the pin and activating with a new source.