Requirements
To get started with Image Portability, you must meet the following requirements.
Source Platforms
Image portability supports porting images from the following platforms to one of the supported destination platforms:
- VMware vSphere 8.0 and 9.0
- XenServer 8
- Nutanix AHV (Prism Element)
- Microsoft Azure
Destination Platforms
Image portability supports porting images to the following platforms:
- Microsoft Azure
A Citrix Machine Catalog image
IPS requires using images that have the following tested configurations:
- A supported Windows operating system
- Windows Server 2016, 2019, 2022H2, or 2025
- Windows 10 or 11
- Provisioned using Machine Creation Services or Citrix Provisioning
- Citrix Virtual Delivery Agent
App Layering appliance
Image Portability is available starting with version 25.11 of the App Layering appliance. It is recommended that you have an App Layering appliance in each location that hosts images you plan to export or prepare using Image Portability.
Refer to the Install appliance documentation for additional information on setup.
An SMB (Windows) file share
You need a Windows SMB file share for storage of the output of export and publish tasks. This share must be accessible to the Compositing Engine VM, which is created in the environment where the image being exported resides. While this may be a Citrix Cloud Resource Location, with the new Image Portability feature (IPS), the file share may also reside in a customer-managed data center or cloud tenant, independent of Citrix Cloud.
Refer to the Windows File Share connector documentation for additional information on setup.
An IPS-compatible Connector
Both export and prepare tasks require an IPS-compatible connector configured on the App Layering appliance. Refer to Connector documentation for your specific platform for additional information on setup. For example, our Image Portability for Azure Connector documentation outlines the requirements for configuring a connector needed to start a prepare task in your Azure environment.
A machine for running PowerShell scripts
The machine used to run the PowerShell cmdlets of the Citrix.AppLayering or Citrix.Image.Uploader PowerShell module must meet the following requirements:
- Must have Windows PowerShell version 5.1 (PowerShell 6 and above not supported)
- A Windows machine with .Net framework, minimum version 4.6.2
- Can connect to the Microsoft PowerShell Gallery to download the required PowerShell libraries
The machine will also have to meet additional requirements specific to the module being used:
Citrix.AppLayering
- A network connection must exist to the App Layering appliance in the environment where the image(s) reside
Citrix.Image.Uploader
- A fast network connection to the SMB file share
- Can be the same machine that hosts the file share
- A fast network connection to the destination platform
Additional considerations
Depending on your version of Windows, you might need to disable TLS 1.0/1.1 support. Refer to the Microsoft PowerShell Gallery TLS support documentation for more information.
By default, PowerShell does not automatically authenticate through a proxy server. Make sure you’ve configured your PowerShell session to use your proxy server, per Microsoft, and your proxy vendor best practices.
Required platform permissions
Refer to your specific Connector configuration for additional requirements.
Networking
The App Layering appliance creates a worker VM called the compositing engine (CE) to perform image operations. Both the App Layering appliance and CE must be able to communicate with each other over port 443.
For tasks that involve files on an SMB share (for example, export tasks), the CE must be on a network with connectivity to the SMB share.
For prepare tasks, the operating system contained in the image is booted (on the CE) to do specialization and other tasks. If the image contains management or security agents that phone-in to a control server, these processes can interfere with the preparation process.
If the domain unjoin option is specified, network connectivity can affect the results. If the compositing engine VM can reach the Active Directory domain controller over the network, unjoin removes the computer account from the domain. This breaks the domain membership for the source VM from which the image was extracted.
It is recommended to isolate the network provided for the operation of other network resources. This can be done by selecting ‘Network isolation’ in the connector configuration. For an example, refer to our Image Portability for Azure documentation.