You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/images/docker-sealskin.md
+21-17Lines changed: 21 additions & 17 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -39,14 +39,25 @@ The architectures supported by this image are:
39
39
40
40
## Application Setup
41
41
42
-
This image hosts the server component for the SealSkin platform. Two ports are used to access the platform from the SealSkin browser extension 8000 the api port and 8443 for app sessions.
42
+
This image hosts the server component for the SealSkin platform.
43
43
44
-
Download the browser extension from [HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk) or land on port 8000 and download the zip bundled with this server and install unpacked.
45
-
In the options for the extension enter manual configuration and using the "admin" user fill out the endpoint for the server and the keys obtained via first run container logs or generated yourself.
44
+
Download the browser extension from [for Chrome HERE](https://chromewebstore.google.com/detail/sealskin-isolation/lclgfmnljgacfdpmmmjmfpdelndbbfhk), [for Firefox HERE](https://addons.mozilla.org/en-US/firefox/addon/sealskin-isolation/).
46
45
47
-
## Basic requirements
46
+
On first init a file will be created `/config/admin.json` if you set `HOST_URL` you can use this file for credentials as is, if you did not you will need to edit it and change the URL/IP set in the file to use it. Once authenticated in the extension you can generate users and new config files to distribute or use.
48
47
49
-
Every variable listed in the run example is required in this current version including the container name, the only backend provider to launch containers is Docker. This container is designed to work on the default bridge network for the server and launch containers into that network and proxy their internal traffic. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths. Make note of your admin private key and server public key on first container init logs you will need that to configure the browser extension and administrate the server.
48
+
>[!NOTE]
49
+
>If you are not using a legitimate ssl certificate (default self signed in `/config/ssl`) than you can only use the Chrome extension and must forward whatever port mapped to 8000 to the internet. Firefox enforces https in the extension space and Chrome allows us to fall back to E2EE over http.
50
+
51
+
>[!NOTE]
52
+
>Please remember to copy and delete the default `/config/admin.json` file from your server for security, keep it somewhere safe!
53
+
54
+
## Basic Requirements
55
+
56
+
It is important to use the container name `sealskin` as this is how the container identifies itself and determines its ports, volumes, and network. The only backend provider to launch containers is Docker. The storage paths are required for key and storage management while their mount paths are adapted from within the container to be run on the host for launched sessions. Everyting in the stack runs as the PUID and PGID down to the container desktop sessions, it is important that the user you use has access to the `/config` and `/storage` paths.
57
+
58
+
### NVIDIA Support
59
+
60
+
Nvidia support only works on 580 and up full proprietary drivers (no MIT/GPL) with `nvidia-drm.modeset=1` kernel parameter set. You must ensure the card is initialized before running a container so on headless systems run `nvidia-modprobe --modeset` from the host even with this kernel parameter set, this only needs to be run once per boot on headless systems.
50
61
51
62
## Key & Certificate Management
52
63
@@ -99,7 +110,6 @@ services:
99
110
sealskin:
100
111
image: lscr.io/linuxserver/sealskin:latest
101
112
container_name: sealskin
102
-
network_mode: bridge
103
113
environment:
104
114
- PUID=1000
105
115
- PGID=1000
@@ -110,8 +120,8 @@ services:
110
120
- /path/to/sealskin/storage:/storage
111
121
- /var/run/docker.sock:/var/run/docker.sock
112
122
ports:
113
-
- 8000:8000
114
123
- 8443:8443
124
+
- 8000:8000#optional
115
125
restart: unless-stopped
116
126
```
117
127
@@ -120,13 +130,12 @@ services:
120
130
```bash
121
131
docker run -d \
122
132
--name=sealskin \
123
-
--net=bridge \
124
133
-e PUID=1000 \
125
134
-e PGID=1000 \
126
135
-e TZ=Etc/UTC \
127
136
-e HOST_URL=IP|subdomain.doman.com `#optional` \
128
-
-p 8000:8000 \
129
137
-p 8443:8443 \
138
+
-p 8000:8000 `#optional` \
130
139
-v /path/to/sealskin/config:/config \
131
140
-v /path/to/sealskin/storage:/storage \
132
141
-v /var/run/docker.sock:/var/run/docker.sock \
@@ -142,14 +151,8 @@ Containers are configured using parameters passed at runtime (such as those abov
142
151
143
152
| Parameter | Function |
144
153
| :----: | --- |
145
-
|`8000:8000`| API communication port. |
146
-
|`8443:8443`| App session port. |
147
-
148
-
#### Networking (`--net`)
149
-
150
-
| Parameter | Function |
151
-
| :-----: | --- |
152
-
|`--net=bridge`| Use default bridge network |
154
+
|`8443:8443`| HTTPS Sessions and API communication port. |
155
+
|`8000:8000`| HTTP Fallback API communication port. |
153
156
154
157
### Environment Variables (`-e`)
155
158
@@ -382,5 +385,6 @@ To help with development, we generate this dependency graph.
382
385
383
386
## Versions
384
387
388
+
***17.01.26:** - Update docs to remove network and port requirement, add link to Firefox add on.
0 commit comments