Distributing Knime AP Best Practices: Balancing Read-Only Installations (Program Files) with User Customization

KNIME Analytics Platform
1

I am working with our internal Self-Service Software Distribution team to roll out KNIME Analytics Platform. We are facing a dilemma regarding the installation directory and would appreciate expert advice on best practices for restricted environments.

The Challenge:

  1. Read-Only Installation (C:\Program Files): If we deploy here, users cannot modify the knime.ini to adjust their Heap Size (-Xmx) based on their hardware, nor can they install required extensions because the directory is write-protected.

  2. User-Writable Location: If we allow installation in a writable folder (like %AppData%), users gain the ability to re-enable blocked features (e.g., K-AI, external Update Sites, Workflow Coach) by modifying the .ini or preferences, which violates our Security Team’s requirements.

Our Questions:

  • How do we allow users to adjust Heap Size (-Xmx) without giving them write access to the main installation folder or the master knime.ini? Is there a way to point KNIME to a “User-level” .ini

  • What is the best way to handle Extensions? Can we redirect the extension installation folder to a writable user path while keeping the main app directory locked?

  • Configuration Locking: How can we enforce “Mandatory Preferences” (like disabling AI Assistant and Workflow Coach) so that even if a user has write access to their workspace, they cannot override these specific security settings?

We are looking for a “locked-down” but functional deployment model.

2

after the install, run a shell script that

  1. replaces the heapsize value with 80% of the available memory.
  2. moves the extensions to a writeable location and creates a symlink
1 Like
3

Since KNIME Analytics Platform is built on the Eclipse Platform, we share a lot of setup/configuration options with Eclipse. Thus, the Eclipse documentation could be useful for you, in particular the docs about the different areas of an installation: Help - Eclipse Platform

Unfortunately it is not possible to fracture the knime.ini over multiple places. The KNIME launcher (aka. Eclipse equinox-launcher) takes a --launcher.ini <location> argument (see here), but this only allows relocating the ini file (so users are either able to change it completely or not at all).

In addition to set the heap via a post-install script, it may be useful to set it as a percentage of available system RAM:

-XX:InitialRAMPercentage=percent
-XX:MaxRAMPercentage=percent

instead of via -Xmx and -Xms (documentation).

3 Likes