Your first imaging archive.

Choose how you want to run Store.

EASI Store is a self-hosted DICOM service with a patient/study library, an embedded EASI View workspace, DICOMweb and DIMSE connections, and reproducible research datasets. The server runs on your machine or your own infrastructure. No cloud account or external database is required.

Store is source-available under its community license, with free use for qualifying individuals, research institutions, nonprofits, and organization groups with annual gross revenue strictly below US$5 million. Institutional exceptions and commercial terms are explained on the licensing page and in the full license.

1. Start a local archive with Docker.

Start Docker, then run these commands in a terminal. Docker downloads the published image automatically; no GitHub registry sign-in or source checkout is required.

docker volume create easi-store-archive
docker run -d --name easi-store --init --restart unless-stopped \
  --read-only --tmpfs /tmp:size=64m,mode=1777 \
  --cap-drop ALL --security-opt no-new-privileges \
  --publish 127.0.0.1:8048:8048 \
  --mount source=easi-store-archive,target=/data \
  ghcr.io/davidvaccaro/easi-store:1.0.0-rc.1

Open http://127.0.0.1:8048/. The published port is restricted to your own machine. The named easi-store-archive volume holds the catalog, original instances and Store configuration, independently of the application container.

Create your own administrator account.

Follow the first-run screen. There is no default username or password. If it requests a bootstrap token, read that one-time setup token from the container:

docker exec easi-store cat /data/bootstrap-token

Use the token only in your local setup screen. Create the administrator account and sign in. The default DICOMweb access profile requires authentication; administrative functions always require authorization.

Know how to stop and restart it.

docker logs --tail=100 easi-store
docker stop easi-store
docker start easi-store

These commands retain the archive volume. Keep that volume when replacing the application container. Removing the archive volume deletes the stored data; it is not an update procedure.

Prefer Compose? The packaging guide documents the supplied persistent-volume configuration and docker compose pull / docker compose up --no-build -d workflow from a checkout. The container package page lists published image versions.

Or extract a portable package and open its launcher.

1. Open the 1.0.0-rc.1 release downloads and choose your matching platform: macOS ARM64, Windows x64, or Linux x64.
2. Compare the downloaded archive’s SHA-256 with its published sidecar or SHA256SUMS. The verification instructions include macOS/Linux and PowerShell commands.
3. Extract the complete package into an application folder, separate from any archive/data directory.
4. Open the root Start EASI Store launcher. Keep its terminal window open while using Store; Control-C stops the server.
5. Complete first-run setup in the browser at http://127.0.0.1:8048/.

The packages include a verified Node runtime, application dependencies, documentation, license notices and a CycloneDX dependency inventory. They do not require npm, Python or an internet connection for normal startup. The archive lives in your application-data directory and survives replacing the extracted application folder.

These are unsigned downloads. If your operating system blocks a launcher, follow the reviewed platform instructions in the installation guide; do not disable system-wide security protections.

Build from source when you want to develop or customize.

With Git, Node.js 24 and npm installed, run:

git clone https://github.com/davidvaccaro/easi-store.git
cd easi-store
git checkout v1.0.0-rc.1
npm ci
npm run build
npm start -- --open

The source guide covers platform launchers, archive-directory overrides and custom ports. Store itself does not need Python or a machine-learning framework.

2. Import, find and view your first study.

1. Start with the synthetic demo. After signing in, add Store’s built-in generated demo to explore the library without patient files.
2. Import your DICOM files. Choose the files you want to archive. Valid extensionless DICOM instances are supported. Review import outcomes: a new original, an identical duplicate and a conflicting UID are distinct results.
3. Find the examination. Search the library, choose a patient or study, and browse its series and instances.
4. Open it in EASI View. View supported images, navigate stacks and frames, adjust presentation, and use the available viewing tools. Metadata loads first; originals load as needed while you navigate.
5. Export when needed. Choose Export originals to download an original-file ZIP with a SHA-256 manifest. Source identifiers remain in the originals.

Archive acceptance and viewer display support are separate: an original can be stored even if the current viewer cannot render that object. Export is neither anonymization nor a complete archive backup. See the study-management guide for viewing, exports, removal safeguards and recovery.

3. Connect an application or another imaging archive.

DICOMweb: use the archive from your application.

The default DICOMweb base URL is http://127.0.0.1:8048/dicomweb. Its supported profile includes QIDO study/series/instance search, STOW original imports, WADO original retrieval, nested JSON metadata, and supported frame and referenced-bulk retrieval.

1. In Store, open Administration → Identity and create a named, expiring API credential with the required role.
2. Configure your application’s DICOMweb source with the base URL and the Store credential as an HTTP Bearer token. A reader can search and retrieve; a contributor can also import.
3. Keep long-lived credentials in your application’s server-side secret store. Configure browser access through your application’s authenticated connection or proxy; do not publish a service token in frontend code.
4. Test with generated data, then review the DICOMweb transactions, examples and limits before relying on an optional representation.

For a source or portable archive restricted to one workstation, an administrator can explicitly choose Administration → Client access → Local research to allow local DICOMweb clients without credentials. Both listeners and actual clients must remain on literal loopback addresses. This is a distinct opt-in profile; a Docker port published to localhost does not itself satisfy the application’s listener requirements. Administration stays protected. Follow the client-access guide for the exact setup.

DIMSE: connect traditional DICOM systems.

The optional native listener defaults to AE title EASISTORE, port 4248, on loopback. The supported profile includes C-ECHO, C-STORE, Study Root and Patient Root C-FIND, C-GET, and configured-destination C-MOVE.

DIMSE uses its own configured calling-AE and source-IP policy, separately from HTTP users and tokens. Network use needs an explicit listener bind, allowed peers, and appropriate firewall/transport configuration. Docker does not expose DIMSE by default. Native DICOM TLS is outside this release’s profile; use the DIMSE setup guide rather than simply publishing a port.

Exchange studies through saved connections.

In Connections → Add connection, choose DICOMweb or DIMSE, enter the reviewed peer settings, and run Test. Use Search studies → Retrieve study to copy remote objects into Store, or a local study/series/instance’s Send action to transmit originals. Activity → Transfers shows persistent progress, retry and cancellation. The transfer runbook explains restart and credential behavior.

4. Configure access for your team.

A local archive starts with one built-in administrator. For individual organizational users, choose an explicit OpenID Connect configuration rather than sharing that administrator password.

Map users or groups to reader, contributor or administrator. These are archive-wide roles: readers can retrieve originals, contributors can import and curate datasets, and administrators manage settings and destructive operations. They do not provide per-patient or tenant isolation.

For a networked deployment, use authenticated client access, an exact HTTPS public URL and a reviewed reverse proxy. Follow identity and permissions for private configuration, credentials, password recovery and role boundaries. Provider recipes cover Microsoft Entra ID, Okta, Keycloak, and the shared OIDC checklist. Qualify your actual provider and deployment.

5. Turn archived series into reproducible research inputs.

For research and AI data preparation, a shared archive is a useful starting point. Store’s Datasets workspace adds an explicit selection, review and verified-download workflow.

1. Choose Datasets → New dataset, or Try a synthetic cohort to start with six generated subjects and 36 images.
2. Choose series across studies. Save your research purpose, organizational labels and review notes; inspect representative images in EASI View.
3. Review indexed technical checks and counts, then Freeze version to record exact membership, encoded sizes and SHA-256 hashes. Optional explicit train/validation/test splits keep each known, source-scoped subject group together.
4. Open Frozen versions, verify availability and hashes, and download the manifest and Python consumer.
5. Copy the version-specific command from Run a verified download. Supply a reader credential privately through EASI_STORE_TOKEN; keep credentials out of commands, notebooks and manifests.

For example, if you saved the downloaded consumer as download_dataset.py, the command has this form. Replace the dataset UUID and exact manifest digest with the values shown for your frozen version:

python3 download_dataset.py \
  --base-url http://127.0.0.1:8048 \
  --dataset DATASET_UUID --version 1 \
  --manifest-sha256 EXACT_MANIFEST_SHA256 \
  --output ./private-dataset-v1

The client streams bounded downloads, checks original sizes and hashes, re-verifies completed files on resume, and produces an integrity report and datalist. An optional, separately qualified MONAI example demonstrates a narrow native-image CPU loading path.

Store prepares and tracks data; it does not provide image annotation, segmentation labeling, anonymization or model training. Frozen versions record membership but do not retain originals against later archive removal. Subject grouping does not establish cross-source patient identity. See the dataset workflow and limits and Python consumer guide for exact behavior and privacy preparation.

6. Protect the archive as you use it.

Open Administration → Archive health to inspect capacity, configure intake safeguards, and run a bounded, cancellable original-integrity review. The service distinguishes liveness from intake readiness and refuses imports when its storage safeguards cannot be met.

• Keep one writer per archive. The catalog and original files form one archive on reliable local storage. Do not share a SQLite archive directory across hosts or replicas.
• Back up the whole archive. Stop Store and follow the verified offline backup procedure. An exported study ZIP does not include the full catalog, configuration and security state.
• Test a restore. Restore into a separate directory or volume and port. Check counts, original hashes and the intended access configuration before relying on the backup.
• Upgrade deliberately. Stop the service, make a verified pre-upgrade backup, review migration notes, and replace the application separately from its data. A schema downgrade requires the matching earlier backup and runtime.
• Qualify shared deployments. Review HTTPS, identity, transport, workload and recovery in your actual environment. Engineering checks do not establish clinical or regulatory qualification.

The archive-health guide documents safeguards and offline verification. The operations runbook covers persistent data, credentials, container backups, restore drills and updates.

Keep the complete reference close.

This guide covers a first setup. The public repository contains the full versioned implementation, protocol profiles and operational instructions.

• Release downloads — portable bundles, SHA-256 sidecars, SHA256SUMS, dependency inventories and sanitized qualification reports.
• Docker images — public Linux AMD64/ARM64 image, pinned here to ghcr.io/davidvaccaro/easi-store:1.0.0-rc.1.
• Source repository, complete README and installation and packaging reference.
• DICOMweb, DIMSE and the separate management API.
• Identity and permissions, client access, operations and archive health.
• Research datasets and Python/MONAI examples.
• Supported first-release profile, current status, candidate-specific validation and private security reporting.

Store, EASI JS and EASI View are independently packaged products with their own legal notices. See community eligibility and commercial licensing before distributing or deploying them for an organization.