Hi,
I'm setting up an automated walk-forward research process using the cTrader CLI and Codex.
The intention is to run repeatable backtests, save the reports and trade logs, and later use those outputs for controlled out-of-sample research.
Before beginning the formal walk-forward testing, I used an existing cBot and a previously verified parameter set to check that the CLI process could reproduce a known backtest.
That initial reproduction worked correctly and the exported trades matched the existing backtest evidence.
The problem started when I moved towards running further CLI backtests.
Windows CLI problem
The local Windows cTrader CLI can connect when using the normal run command, but the backtest command repeatedly enters a:
Connection lost
Reconnecting
loop.
It never begins the backtest and does not create the requested HTML or JSON report.
I have already tried:
- A very short one-day test period.
- The normal server historical-data mode.
- A local M1 CSV using
m1-csv data mode.
- Confirming that the cBot and parameter file are accepted.
- Checking the symbol, period, dates and report paths.
- Repairing/reinstalling cTrader using the signed Spotware installer.
- Closing cTrader and the Algo host before the repair.
- Rerunning the probe after the repair.
The CLI successfully reads the cBot and prints the parameter table, but the backtest still enters the reconnect loop, even when local M1 data is supplied.
This suggests that the issue is not only related to downloading historical price data.
The local Windows CLI version is:
5.7.14.51420
There also appears to be some difference between the options described in current cTrader documentation and the options shown by our local Windows CLI help output. For example, newer documentation mentions a --data-dir option, but it is not visible in our installed CLI help.
Docker test option
As a separate diagnostic route, I installed:
Docker itself is now working correctly.
The next possible test would be to pull and run the official Spotware cTrader console image:
ghcr.io/spotware/ctrader-console
However, this introduces a security question.
The Docker container requires access to the cTrader ID credentials. The documented approach appears to be mounting a password file into the container and then providing its location through --pwd-file.
The file can be mounted read-only, but read-only only prevents the container from modifying it. The container still has to read the plaintext password to authenticate.
Using --rm also removes the stopped container, but it does not change the fact that the running container had access to the password.
I do not want to place my main cTrader ID password:
- directly in a Docker command;
- in PowerShell history;
- in an environment variable;
- in a project file;
- in OneDrive;
- in Git;
- or in a folder broadly mounted into the container.
Another concern is that my main cTrader ID may be linked to more than one cTrader account. Passing a demo account number to the backtest command limits which account the command is intended to use, but it does not necessarily limit the potential consequences if the underlying cTrader ID credentials were compromised.
Possible safer approach
The safer route I am considering is:
- Create a completely separate cTrader ID.
- Link it only to a disposable demo account.
- Use a unique password that is not used anywhere else.
- Store the password in a local file outside the project, OneDrive and Git.
- Restrict the Windows file permissions to the local user.
- Mount only that individual password file into Docker as read-only.
- Mount the cBot/data directory separately as read-only.
- Mount only the report directory as writable.
- Run a one-day non-OOS backtest.
- Change or revoke the temporary password after the probe.
This would avoid exposing the credentials connected to my normal cTrader accounts.
Questions
I would appreciate feedback from anyone experienced with the cTrader CLI or Docker version:
- Has anyone encountered the Windows CLI
backtest command repeatedly showing "Connection lost / Reconnecting" while the normal run command still connects?
- Is this likely to be a Windows CLI build issue, authentication-route issue, or something associated with the historical backtest service?
- Has anyone successfully used the official Spotware Docker image for repeated automated backtesting?
- Is mounting a password file read-only into the official container the expected and accepted authentication method?
- Is there a more secure method supported by cTrader, such as a restricted token, scoped credential, device authentication, or demo-account-only authentication?
- Would creating a separate cTrader ID linked only to a demo account be the recommended way to isolate the research environment?
- Are there any additional Docker restrictions you would recommend, such as disabling networking after authentication, limiting filesystem mounts, running as a non-root user, or pinning the image digest?
At the moment, I have paused the formal out-of-sample walk-forward batch. I would prefer to solve the Windows CLI problem or establish a properly isolated Docker setup before allowing an automated agent to run the full research process.
Thanks in advance for any advice or experience you can share.
