Your PACS is down?
Urgent patients cannot wait.

Carino DICOM sits between your imaging equipment and your archive, and keeps studies moving when something breaks — on your own hardware, with no cloud.

Checking for the latest version… · Windows · macOS · Linux · Docker · AGPL-3.0

📖 Read the manual

All versions and changelogs →

This page runs in your browser and sends nothing anywhere. It asks api.github.com for the latest release.

Intel Mac or ARM64 Linux? Use the second build named on that button.

No installer for these — all three run the same application. Pick the one your machine already speaks.

🐳 Docker

Compose file, everything on loopback. The first boot prints an access token — open http://127.0.0.1:8042/ and paste it when the dashboard asks.

$ git clone https://github.com/MiguelCarino/Carino-DICOM $ cd Carino-DICOM $ mkdir -p data $ echo "PACS_UID=$(id -u)" >> .env $ echo "PACS_GID=$(id -g)" >> .env $ docker compose up -d --build $ docker compose logs -f pacs
Details →

🦭 Podman

Rootless, and systemd owns it. Needs no compose provider, and the token prints to the journal on first boot.

$ git clone https://github.com/MiguelCarino/Carino-DICOM $ cd Carino-DICOM $ [ -d ~/CarinoPACS ] && [ ! -d ~/CarinoDICOM ] && mv ~/CarinoPACS ~/CarinoDICOM $ mkdir -p ~/CarinoDICOM $ podman build --format docker -t carino-dicom:local . $ install -Dm644 packaging/podman/carino-dicom.container \ ~/.config/containers/systemd/carino-dicom.container $ systemctl --user daemon-reload $ systemctl --user start carino-dicom $ journalctl --user -u carino-dicom -f
Details →

🐧 systemd

From source, as a system service with an account of its own. The installer stops before starting it — opening listeners that accept patient data stays your decision.

$ git clone https://github.com/MiguelCarino/Carino-DICOM $ cd Carino-DICOM $ sudo packaging/systemd/install.sh # then edit /var/lib/carino-pacs/config.json and: $ sudo systemctl enable --now carino-pacs
Details →

Full deployment guide →

What it is

  • A gateway between your equipment and your archive. Studies arrive, get routed by rules you write, and are retried until every destination has taken them.
  • A continuity appliance. When the primary PACS stops answering, it serves the worklist itself, holds what arrives, and back-fills once the primary returns.
  • A translator for equipment nothing else will talk to. Print-only modalities, consoles with no RIS feed, readers that speak nothing but DIMSE.
  • Yours, on your hardware. One config file, one process, no cloud, no telemetry, no licence server. AGPL-3.0.

What it is not

  • Not a medical device. It is not certified, cleared or registered anywhere, and nothing in it has been validated for clinical use by anyone. Whoever deploys it owns that validation.
  • Not for primary diagnosis. There is no diagnostic viewer here: no windowing, no measurements, no rendering pipeline. Read studies on the validated workstation you already have.
  • Not an enterprise archive. No high availability, no clustering, no retention policies, and no encryption at rest — put it on an encrypted disk. It has its own profiles and audit trail, but no LDAP, no Active Directory and no single sign-on, so accounts live on the appliance rather than with your identity provider.
  • Not a replacement for your PACS or your RIS. It is the gateway between them, and the thing that keeps a department working through an outage until they come back.

If a patient's care depends on it, the responsibility for that is yours, not this software's.

Every service is off until you turn it on. The tag on each card is the release it ships in.

📥 Receive and filev1.0

A Storage SCP that accepts C-STORE and C-ECHO and files each study to disk by patient, study and series. Compressed objects are stored exactly as they arrived — never transcoded.

📤 Route and forwardv1.0 · rules v1.1

Forwards to as many nodes as you like, with rules: CT from the ER to the archive, ultrasound to the reading room. Each destination is retried until it accepts. A file that matches no rule goes everywhere rather than nowhere.

🕶️ De-identify on the way outv1.1

A rule can de-identify the copy it sends (PS3.15 Basic profile) while the archived original stays untouched. It does not clean burned-in pixel text — a human still has to look at the images.

🔎 Query/Retrievev1.1

C-FIND, C-MOVE and C-GET over an indexed view of what is actually on disk, so a twelve-year-old ultrasound or CR reader can ask what you hold and pull it back.

🌐 DICOMwebv1.1

QIDO-RS, WADO-RS and STOW-RS, so OHIF, Weasis and other modern viewers can read the archive over HTTP without negotiating a DICOM association.

📋 Worklist and emergency RISv1.1

Takes HL7 orders over MLLP or hand-keyed ones, and serves them to modalities as a Modality Worklist. If your primary PACS stops answering, it can take over, hold what arrives, and forward it once the primary is back.

🖨️ Virtual printv1.1

Captures print-only modalities as PDF, so a machine whose only output is film still produces something you can file.

🔑 Token authenticationv1.1

The dashboard and the DICOMweb API take a single shared token. Bind them to anything other than localhost without one and the server refuses to start — the refusal is the feature.

👥 People and permissionsv1.1

Optional per-person sign-in with four editable presets. Permissions are checked at every endpoint, not hidden in the browser, and you choose per profile which patient identifiers each person may see — so IT can trace a study by accession number without reading anyone's chart.

🔒 Audit trailv1.1

Append-only, hash-chained records of who did what, to which study, from where, and whether it worked — refusals included. Any edit or deletion inside the file breaks the chain and the dashboard says which record and why.
  • Windows: More info → Run anyway.
  • macOS: open the app once and dismiss the warning, then go to System Settings → Privacy & Security and click Open Anyway. If that option is not there, or macOS says the app is "damaged", run this in Terminal instead:
    $ xattr -dr com.apple.quarantine /Applications/Carino-DICOM.app
  • Linux: easiest is the .rpm (Fedora/RHEL) or .deb (Debian/Ubuntu) from the releases. The .AppImage needs FUSE: install it with the line for your distribution, or run the AppImage with --appimage-extract-and-run.
    # Fedora $ sudo dnf install fuse-libs # Debian / Ubuntu $ sudo apt install libfuse2

The warning appears because the app isn't code-signed yet — it's safe.

— DICOM details, CLI & source

Built on pynetdicom/pydicom with a Flask dashboard; the desktop app is an Electron tray shell around the same engine.

  • Storage SCP — C-STORE + C-ECHO, files by Patient/Study/Series, all transfer syntaxes (compressed stored as-is), allowed_aets filtering.
  • Storage SCU — folder-watch auto-forward to N nodes, conditional routing rules, per-destination retry, keep/move/delete on success.
  • Query/Retrieve SCP — C-FIND / C-MOVE / C-GET, Patient and Study Root, answered from a sqlite index of what is on disk; failed sub-operations are named, never dropped.
  • DICOMweb — QIDO-RS, WADO-RS, STOW-RS under /dicom-web, exact-match CORS allow-list, no wildcard. Rendered/thumbnail/transcoding answer 406 rather than fake it.
  • MWL + HL7 — Modality Worklist C-FIND SCP, HL7 ORM^O01 over MLLP, accession-number reconciliation. Image delivery is never gated on an order match.
  • De-identification — PS3.15 Annex E Basic profile on forward, with the retain options declared in (0012,0064). Pixels are not touched.
  • DICOM-TLS both sides (optional), incl. mutual TLS. Bearer-token auth on the HTTP API; non-loopback web.host with an empty token is a startup error.
  • Web dashboard, headless CLI (pacs serve|receive|send|print|echo|ris|mwl|qr|init), tray app, Docker image, or systemd unit. DICOM port 11112; dashboard 127.0.0.1:8042.
$ git clone https://github.com/MiguelCarino/Carino-DICOM $ cd Carino-DICOM && ./setup.sh # Windows: .\setup.ps1 $ ./run.sh init # scaffold config.json + folders $ ./run.sh serve # dashboard → http://127.0.0.1:8042
GitHub README Security policy Build & release