---
title: "DoveRunner DRM CLI Packager Guide"
description: "This document describes the basic concepts and how to use the command line interface (CLI) based content packaging tool used for the DoveRunner multi-DRM cloud service."
---
> For the complete documentation index, see [llms.txt](https://docs.doverunner.com/llms.txt).

This document describes the basic concepts and how to use the command line interface (CLI) based content packaging tool used for the DoveRunner multi-DRM cloud service.

There are five types of content packaging:

1. `DASH`: A method of applying PlayReady, Widevine Modular, or Huawei WisePlay DRM by packaging streaming contents with MPEG-DASH CENC standard.
2. `HLS`: A method of applying FPS (FairPlay Streaming) DRM by packaging HLS-AES streaming contents.
3. `CMAF`: Applying PlayReady, Widevine, and FairPlay DRM by packaging contents with CMAF(Common Media Application Format) type.
4. `NCG`: Content encryption by DoveRunner's proprietary NCG (Netsync Content Guard) DRM for downloading or progressive download scenario.
5. `HLS-NCG`: HLS content packaging with SAMPLE-AES clear key protected by NCG DRM.

:::caution[FairPlay prerequisite]
If you plan to package content for FairPlay Streaming DRM (`--hls` or `--cmaf`), you must first obtain and register an FPS certificate with DoveRunner — this requires Apple Developer **Account Holder** access and can take significant time to process. Complete [FairPlay Cert Registration](https://docs.doverunner.com/content-security/multi-drm/license/fps-cert-tutorial/) before starting packaging.

FairPlay also requires **CBCS** encryption mode, not CENC. `--dash` packaging (DASH-CENC) does not support FairPlay — use `--hls` or `--cmaf`, which apply CBCS automatically. Packaging for FairPlay under CENC will not produce a usable result.
:::

> This guide is based on the 4.3.0 version of CLI packager. You can download the latest CLI packager from the [Github repository](https://github.com/doverunner/drm-cli-packager).

:::note 

DoveRunner DRM CLI Packager is a file-based, on-demand (VOD) content-only packager. If you need DRM packaging for live stream content, you can use various third-party live solutions such as Wowza and AWS Elemental in conjunction with the DoveRunner key server.

:::

## Shaka Packager vs. DRM CLI Packager

Based on Shaka Packager, DoveRunner provides two packaging options. Choose based on your needs:

| Feature | [Shaka Packager Integration](https://docs.doverunner.com/content-security/multi-drm/packaging/shaka-packager-integration/) | DRM CLI Packager |
|---------|---------------------------|------------------|
| **Best for** | Developers with existing Shaka workflows | Quick setup without additional configuration |
| **Flexibility** | Full access to all Shaka Packager features | Pre-configured for common use cases |
| **Setup** | Requires Python environment and manual configuration | Standalone executable, minimal setup |
| **Customization** | Maximum control over packaging parameters | Simplified options for standard scenarios |
| **Updates** | Use latest Shaka Packager versions independently | Managed releases tested for DoveRunner compatibility |

:::tip[Which should I use?]
Use **DRM CLI Packager** in this document if you want a turnkey solution that works immediately with DoveRunner Multi-DRM.
Use [**Shaka Packager Integration**](https://docs.doverunner.com/content-security/multi-drm/packaging/shaka-packager-integration/) if you need advanced Shaka features or have existing encoding pipelines. 
:::

## Tutorial Video

This is a tutorial video about explaining the DoveRunner DRM CLI Packager and how to use it in Windows OS.

[Video: YouTube Video Player](https://www.youtube.com/watch?v=6ND1Oaaqrhw)

> **Learn it in DoveRunner Lab**: Step-by-step lesson [Packaging content with the DRM CLI Packager](https://lab.doverunner.com/academy/courses/getting-started-multi-drm/package-with-cli-packager)

## Integration architecture and supported environments

![Packaging Flow](https://docs.doverunner.com/img/content-security/cli-packager-flow1.png)

DoveRunner DRM CLI Packager works in conjunction with DoveRunner Multi DRM Cloud Server. DoveRunner cloud server manages the content key information for each service site, and when a client requests DRM license information, it finds the key (CEK) information associated with the CID and issues a license.

- Supported OS: Support 64 bit Windows, Linux (Ubuntu, CentOS), macOS (Intel, Apple Silicon)
- For Linux environment, gcc and g ++ library version 9.0 or later must be installed.
- macOS environment is supported by running Ubuntu builds using Docker or Apple Container.
- Available disk space should be at least twice the size of the contents for packaging.
- Only alphanumeric characters are allowed for input / output filenames.

DoveRunner DRM CLI Packager v4.3.0 is based on [Shaka Packager v3.7.0](https://github.com/shaka-project/shaka-packager/releases/tag/v3.7.0). Please refer to [Github page](https://github.com/shaka-project/shaka-packager) for details, documentation and source code of Shaka Packager.

### Running CLI Packager on Linux

In Linux environments, specific versions of libraries may be required depending on the OS distribution and version.

#### Ubuntu environment

For Ubuntu 18.04 and earlier, because it requires a higher version of the glibc library, install `gcc/g++` version 9 as below:

```sh
$ sudo apt install software-properties-common
$ sudo add-apt-repository ppa:ubuntu-toolchain-r/test
$ sudo apt update
$ sudo apt install gcc-9 g++-9
$ sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-7 700 --slave /usr/bin/g++ g++ /usr/bin/g++-7
$ sudo update-alternatives --install /usr/bin/gcc gcc /usr/bin/gcc-9 900 --slave /usr/bin/g++ g++ /usr/bin/g++-9
```

For Ubuntu version 22.04 or later, because only `OpenSSL` version 3.x is installed by default, install version 1.1.x as below:

```sh
$ sudo apt-get update
$ sudo apt-get install -y gcc make perl wget
$ wget https://www.openssl.org/source/openssl-1.1.1o.tar.gz
$ sudo tar -zxvf openssl-1.1.1o.tar.gz
$ cd openssl-1.1.1o
$ ./config && make
$ export LD_LIBRARY_PATH=<installed_directory_path>:$LD_LIBRARY_PATH
```

#### CentOS environment

Install the `c-ares` library with version 1.16.0 or later as below:

```sh
$ sudo yum c -y "Development Tools"
$ wget https://c-ares.haxx.se/download/c-ares-1.16.1.tar.gz
$ sudo tar -zxvf c-ares-1.16.1.tar.gz
$ cd c-ares-1.16.1
$ ./configure && make
$ sudo make install
$ sudo ldconfig
$ export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH
```

### Running CLI Packager on macOS

DRM CLI Packager v3.9.0 or later supports macOS environment in the following ways.

Choose between Docker and Apple Container based on your Mac and environment.

| | Docker Desktop | Apple Container |
|---|---|---|
| Supported Macs | Intel and Apple Silicon | Apple Silicon only |
| Supported macOS | Wide range of versions | macOS 26 or later |
| Installation | Installer or Homebrew | Signed `.pkg` from GitHub Releases (no Homebrew cask) |
| Cost | Paid subscription required for larger companies | Free, open source |
| Ecosystem | Mature (Compose, Docker Hub integration, GUI) | Newer, smaller CLI-only feature set |
| Dockerfile and options | Standard | Same Dockerfile, same `build`/`run` options |
| Non-interactive setup | Works | First `container system start` needs an interactive terminal |

- **Use Docker Desktop** if you have an Intel Mac, run an older macOS, or already use Docker in your workflow.
- **Use Apple Container** if you have an Apple Silicon Mac on macOS 26 or later and want a free, lightweight setup without installing Docker Desktop.


1. `Create Dockerfile`: Create Dockerfile with the following script.
  ```dockerfile
  FROM ubuntu:20.04
  
  RUN apt-get update -y && apt-get install -y --no-install-recommends \
      git ca-certificates libc-ares2 \
      && rm -rf /var/lib/apt/lists/*

  RUN git clone --depth 1 https://github.com/doverunner/drm-cli-packager /drm-cli-packager

  # Select the binary that matches the build architecture (Intel: amd64, Apple Silicon: arm64)
  ARG TARGETARCH
  RUN case "$TARGETARCH" in \
        amd64) ARCH=x86_64 ;; \
        arm64) ARCH=aarch64 ;; \
        *) echo "unsupported arch: $TARGETARCH" >&2; exit 1 ;; \
      esac \
      && chmod 755 "/drm-cli-packager/bin/Ubuntu/${ARCH}/doverunner-drm-packager" \
      && ln -s "/drm-cli-packager/bin/Ubuntu/${ARCH}/doverunner-drm-packager" /usr/local/bin/doverunner-drm-packager

  ENTRYPOINT ["doverunner-drm-packager"]
  ```

2. `Build Ubuntu Image`: Build an Ubuntu image using the Dockerfile you created.
```sh
docker build -t <user-name>/ubuntu-packager .
```

3. `Run packager command`: Run the packager with the following example command in the Ubuntu container.
```sh
docker run \
	-v /Users/my/workspace/contents:/contents \
	-v /Users/my/workspace/packaging-output:/packaging-output \
	-it \
	--rm \
	<user-name>/ubuntu-packager \
	-o /packaging-output -i /contents/sintel/Sintel.2010.480P.mp4 --disable_encryption --dash
```

:::note 

The Dockerfile above selects the `x86_64` or `aarch64` Ubuntu binary automatically to match your Mac (Intel or Apple Silicon). `libc-ares2` is required at runtime; without it the packager fails with `libcares.so.2: cannot open shared object file`.

:::

#### Using Apple Container instead of Docker

On Apple Silicon Macs running macOS 26 or later, you can use [Apple Container](https://github.com/apple/container) instead of Docker Desktop. It reads the same Dockerfile, and `container build` and `container run` accept the same options as their `docker` counterparts, so steps 1 to 3 above work as they are.

1. `Install Apple Container`: Download the signed installer package (`.pkg`) from the [GitHub Releases page](https://github.com/apple/container/releases) and install it. There is no Homebrew cask.

2. `Start the container service`: Run the following command. On the first run, it asks whether to install the recommended default kernel. Enter `Y`.
```sh
container system start
```

3. `Build the image and run the packager`: Use the same Dockerfile and arguments as the Docker steps, replacing `docker` with `container`.
```sh
container build -t <user-name>/ubuntu-packager .

container run \
	-v /Users/my/workspace/contents:/contents \
	-v /Users/my/workspace/packaging-output:/packaging-output \
	--rm \
	<user-name>/ubuntu-packager \
	-o /packaging-output -i /contents/sintel/Sintel.2010.480P.mp4 --disable_encryption --dash
```

:::note

`container system start` fails with `failed to read user input` in a non-interactive shell (CI, scripts) because it cannot answer the kernel prompt. Run it once in an interactive terminal first.

:::

## Parameters and error codes

The command format, every command parameter, the external-key options and the error codes are listed in [DRM CLI Packager Parameters and Error Codes](https://docs.doverunner.com/content-security/multi-drm/packaging/cli-packager-reference/).

## Example

:::note 

Among the input values, the `--enc_token` (KMS token) parameter can be replaced with a combination of `--site_id` and `--access_key`. (Backward compatibility support) You can find these values on the console site after signing up for the DoveRunner service, and the input values in the example below must be changed to the values issued to your DoveRunner account.

:::

### DASH packaging

PlayReady, Widevine DRM-protected DASH stream packaging. Usually run with HLS packaging. (type `--dash --hls`)

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --dash -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### HLS packaging

FairPlay Streaming DRM-protected HLS stream packaging. Usually run with DASH packaging. (type `--dash --hls`)

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --hls -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### CMAF packaging

PlayReady, Widevine, FPS DRM-protected CMAF stream packaging.

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --cmaf -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### HLS-NCG packaging

HLS stream packaging that protects clear keys of SAMPLE-AES with NCG DRM. This cannot be done along with other types of packaging such as DASH or HLS(FPS).

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --hls_ncg -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### NCG packaging

NCG DRM-encoded MP4 file packaging used for download or progressive download scenarios. (creates `.ncg` extension file)

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --ncg -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### WisePlay packaging

You can use the below command to package DASH content protected by WisePlay DRM for support on Huawei devices.

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --dash --wiseplay_drm -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### Adaptive-Streaming packaging

For DASH or HLS packaging, you can enter content with multiple resolutions and package it for adaptive streaming.

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 --dash --hls -i ./input/test-content-1-480p.mp4 ./input/test-content-1-720p.mp4 ./input/test-content-1-1080p.mp4 -o ./output/test-content-1
```

### Using external key (DASH, HLS)

This is a method of multi DRM packaging using the key managed by the service site instead of the encryption key generated by DoveRunner key server.

```sh
./doverunner-drm-packager --content_id test-content-1 --dash --hls --enable_raw_key_encryption --keys label=:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519 -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### Using external key (NCG, HLS-NCG)

This is a method of packaging NCG DRM using the key managed by the service site instead of the encryption key generated by DoveRunner key server.

```sh
./doverunner-drm-packager --site_id SITE --content_id test-content-1 --enable_raw_key_encryption --ncg_cek a4631a153a443df9eed0593043db7519f3c5e0361e6654b28f8049c778b23946 --ncg --hls_ncg -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

### Using configuration file

It is a method to save fixed setting values among input parameters as a separate config file.

```sh
./doverunner-drm-packager --config_file ./config.txt --content_id test-content-1 -i ./input/test-content-1.mp4 -o ./output/test-content-1
```

#### Example of config file

-  config.txt (Default = Json)
    ```json
    {
        "site_id": "SITE",
        "access_key": "DgBluIlxajZpPPjSIuqS6NcknqqG7RCt"
    }
    ```

- config.xml 
    ```xml
    <?xml version="1.0" encoding="UTF-8"?>
    <config> 
      <site_id>SITE</site_id> 
      <access_key>DgBluIlxajZpPPjSIuqS6NcknqqG7RCt</access_key>
    </config>
    ```

### Packaging subtitles

> Supports external subtitles in VTT format only.

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 -i ./input/test-content-1.mp4 -o ./output/test-content-1 --dash --hls --subtitle ./input/test-content-1-en.vtt:lang=en:name=English ./input/test-content-1-ko.vtt:lang=ko:name=Korean ./input/test-content-1-fr.vtt:lang=fr:name=French ... 
```

### Multi-key Packaging

```sh
./doverunner-drm-packager --enc_token YOUR-KMS-TOKEN-VALUE --content_id test-content-1 -i ./input/test-content-1-720p.mp4 ./input/test-content-1-1080p.mp4 -o ./output/test-content-1 --dash --multi_key
```

### Multi-key Packaging with external keys

```sh
./doverunner-drm-packager --content_id test-content-1 --dash --enable_raw_key_encryption --keys label=SD:key_id=f3c5e0361e6654b28f8049c778b23946:key=a4631a153a443df9eed0593043db7519, label=HD:key_id=8f8049c778b23946f3c5e0361e6654b2:key=eed0593043db7519a4631a153a443df9, label=AUDIO:key_id=e0361e6654b28f80f3c549c778b23946:key=1a153a443df9eed0a463593043db7519 -i ./input/test-content-1-480p.mp4 ./input/test-content-1-720p.mp4 ./input/test-content-1-audio.m4a -o ./output/test-content-1
```

### Multiple manifests for allowed track types

```sh
./doverunner-drm-packager --site_id <site id> --access_key <access key> --content_id <content id> -o <output directory> --dash --multi_key -i <input file1> <input file2> ... --generate_tracktype_manifests
```