diff --git a/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xroot-ssi-cta.cfg b/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xroot-ssi-cta.cfg
new file mode 100644
index 0000000000000000000000000000000000000000..253def873edc42580c2370638e9f7bf5459751d8
--- /dev/null
+++ b/continuousintegration/docker/ctafrontend/cc7/config/ctafrontend/etc/xrootd/xroot-ssi-cta.cfg
@@ -0,0 +1,41 @@
+# Load the CTA SSI and OFS plugins
+xrootd.fslib libXrdSsi.so libXrdCtaOfs.so
+
+# Specify which paths are handled by the OFS plugin
+#
+# Y3Rh is the Base64 encoding of cta, so this string appears at the beginning
+# of all cta admin commands
+ssi.fspath /Y3Rh
+
+# Load the SSI module
+ssi.svclib libXrdSsiCta.so
+
+# Use the security module
+xrootd.seclib libXrdSec.so
+
+# Protocol specification
+# The xroot server process needs to be able to read the keytab file
+#sec.protocol krb5 /etc/krb5.keytab.cta host/<host>@CERN.CH
+#sec.protocol sss -s /var/spool/xrootd/.xrd/sss.keytab -c /tmp/sss.keytab
+sec.protocol unix
+
+# Only Kerberos 5 and sss are allowed
+#sec.protbind * only sss
+sec.protbind 172.17.0* only unix
+
+# Turn off asynchronous i/o
+xrootd.async off
+
+# Use a port other than 1094, already used by EOS xroot server
+xrd.port 10955
+
+# Export the SSI resource
+all.export /ctafrontend nolock r/w
+
+# Export the OFS resource, specified in ssi.fspath above.
+#
+# There can be more than one of these; anything that starts with the prefix
+# will go to the the underlying file system. Note that this prefix cannot be
+# a substring of '/ctafrontend', so it is not possible to simply export '/'.
+all.export /Y3Rh
+