Configuration

Docker Manager is set up with settings in its compose.yaml. Most people only need the two in .env from the Quickstart. Every other setting is optional.

Change a setting

Settings that start with DOCKER_MANAGER_ go under environment: of the docker-manager service; those that start with DOCKER_AGENT_ (and DOCKER_HOST) go under docker-agent. For example:

compose.yaml

services:
  docker-manager:
    environment:
      # ...keep the existing lines...
      DOCKER_MANAGER_LOG_LEVEL: debug

If Docker Manager manages its own stack (see Upgrade), open that stack, edit compose.yaml on its Files tab and press Deploy.
Otherwise, edit compose.yaml on the server and run docker compose up -d in its folder.

If a setting is wrong, the container doesn't start, and its log says why. Durations are written like 30m, 8h or 720h; switches are true or false.

Docker Manager settings

Basics

Setting	Default	What it does
`DOCKER_MANAGER_PUBLIC_URL`	(required)	The address you open Docker Manager at, for example `https://docker.example.com`. Must start with `https://` (`http://` only for `localhost`) and have no path.
`DOCKER_MANAGER_TRUSTED_PROXIES`	(none)	IP addresses or networks of your reverse proxy, separated by commas. Only these may tell Docker Manager that a visitor used HTTPS, and who the visitor is.
`DOCKER_MANAGER_LOG_LEVEL`	`info`	How much the log says: `debug`, `info`, `warn` or `error`.
`DOCKER_MANAGER_LOG_FORMAT`	`json`	The log's format: `json` or `text`.
`DOCKER_MANAGER_STREAM_HEARTBEAT`	`15s`	How often live views send a keep-alive (`1s` to `55s`). Must be shorter than your proxy's idle timeout.

Setting	Default	What it does
`DOCKER_MANAGER_SESSION_IDLE_TIMEOUT`	`8h`	Sign out after this long without activity (`5m` to `168h`).
`DOCKER_MANAGER_SESSION_LIFETIME`	`24h`	Sign out this long after signing in, whatever you do (`15m` to `720h`).
`DOCKER_MANAGER_SESSION_STAY_IDLE_TIMEOUT`	`720h` (30 days)	The idle timeout for devices with Stay Signed In (`1h` to `8760h`).
`DOCKER_MANAGER_SESSION_STAY_LIFETIME`	`8760h` (1 year)	The lifetime for devices with Stay Signed In (`24h` to `17520h`).
`DOCKER_MANAGER_OIDC_ISSUER`	(none)	The issuer URL of your identity provider for single sign-on, for example `https://id.example.com`. Set it together with the client ID; the app then can't change the identity provider.
`DOCKER_MANAGER_OIDC_CLIENT_ID`	(none)	Docker Manager's client ID at the identity provider.
`DOCKER_MANAGER_OIDC_CLIENT_SECRET`	(none)	The client's secret; leave it out for a public client. `DOCKER_MANAGER_OIDC_CLIENT_SECRET_FILE` reads it from a file instead.
`DOCKER_MANAGER_OIDC_PROVIDER_NAME`	(none)	The name on the sign-in button, like `Pocket ID` (at most 64 characters).

Each idle timeout must be no longer than its lifetime, and each setting no longer than its Stay Signed In counterpart.

File Manager

Setting	Default	What it does
`DOCKER_MANAGER_FILES_MAX_EDIT_KB`	`4096` (4.19 MB)	The largest file you can edit, in KiB (1 KiB = 1,024 bytes; `64` to `16384`). Larger files open read-only.
`DOCKER_MANAGER_FILES_MAX_UPLOAD_MB`	`51200` (53.69 GB)	The largest file you can upload, in MiB (1 MiB = 1,048,576 bytes; `1` to `1048576`). Your reverse proxy must allow it too.
`DOCKER_MANAGER_FILES_MAX_DOWNLOAD_MB`	`51200` (53.69 GB)	The largest download, and the largest archive you can create, in MiB (1 MiB = 1,048,576 bytes; `1` to `1048576`).
`DOCKER_MANAGER_FILES_MAX_EXTRACT_MB`	`51200` (53.69 GB)	The most one archive may unpack to, in MiB (1 MiB = 1,048,576 bytes; `1` to `1048576`).
`DOCKER_MANAGER_FILES_MAX_EXTRACT_RATIO`	`100`	An archive may unpack to at most this many times its own size (`10` to `10000`).
`DOCKER_MANAGER_FILES_MAX_ARCHIVE_ENTRIES`	`100000`	The most files and folders in one archive (`100` to `1000000`).

Templates, migrations and backups

Setting	Default	What it does
`DOCKER_MANAGER_TEMPLATE_MAX_SIZE_MB`	`32` (33.55 MB)	The largest template, in MiB (1 MiB = 1,048,576 bytes; `1` to `1024`).
`DOCKER_MANAGER_TEMPLATE_REGISTRY_ENABLED`	`true`	Set to `false` to stop sharing your public templates.
`DOCKER_MANAGER_TEMPLATE_REGISTRY_SYNC_INTERVAL`	`30m`	How often template sources are read again (at least `5m`; `0` turns it off).
`DOCKER_MANAGER_MIGRATION_BANDWIDTH_LIMIT`	`0` (no limit)	Limit the speed of migrations and stack archives, per second, for example `50MB` (at least 1,024 bytes per second).
`DOCKER_MANAGER_STACK_ARCHIVE_MAX_MB`	`51200` (53.69 GB)	The largest stack archive you can export or upload, in MiB (1 MiB = 1,048,576 bytes; `1` to `1048576`). Your reverse proxy must allow uploads this large.

History and monitoring

Setting	Default	What it does
`DOCKER_MANAGER_JOB_HISTORY_RETENTION`	`720h` (30 days)	How long finished jobs are kept (`1h` to `87600h`).
`DOCKER_MANAGER_JOB_HISTORY_MAX`	`10000`	The most finished jobs kept; the oldest go first (`100` to `10000000`).
`DOCKER_MANAGER_JOB_EVENTS_MAX`	`500`	The most progress lines kept per job (`10` to `100000`).
`DOCKER_MANAGER_JOB_MAX_CONCURRENT_PULLS`	`2`	How many image downloads and updates run at once on each server (`1` to `64`).
`DOCKER_MANAGER_JOB_MAX_CONCURRENT_BUILDS`	`1`	How many image builds run at once on each server (`1` to `64`).
`DOCKER_MANAGER_AUDIT_RETENTION_DAYS`	`365`	How many days audit records are kept (`1` to `36500`).
`DOCKER_MANAGER_AUDIT_MAX_SIZE_MB`	`1024` (1.07 GB)	The most space audit records may take, in MiB (1 MiB = 1,048,576 bytes); the oldest go first (`16` to `1048576`).
`DOCKER_MANAGER_AUDIT_LOG_MIRROR`	`false`	Set to `true` to also write every audit record to the log.
`DOCKER_MANAGER_METRICS_RETENTION_RAW`	`2160h` (90 days)	How long every reading is kept for the charts (`1h` to `2160h`).
`DOCKER_MANAGER_METRICS_RETENTION_1M`	`2160h` (90 days)	How long per-minute chart data is kept (`24h` to `2160h`).
`DOCKER_MANAGER_METRICS_RETENTION_15M`	`2160h` (90 days)	How long 15-minute chart data is kept (`168h` to `43800h`).
`DOCKER_MANAGER_METRICS_ENABLED`	`false`	Set to `true` for Prometheus monitoring.
`DOCKER_MANAGER_ALERT_OFFLINE_GRACE`	`5m`	How long a server may be offline before it raises an alert (`1m` to `24h`).

Chart data is limited by time only. With a reading every second, each running container takes about 4.2 MB a day, about 380 MB over the default 90 days (about 0.6 MB a day while an agent reads every 10 seconds); a container that ran for an hour takes an hour's worth, however many containers come and go.

Moving Docker Manager

Setting	Default	What it does
`DOCKER_MANAGER_MOVE_FROM`	(none)	Only in the setup files for moving Docker Manager: the old server's address.
`DOCKER_MANAGER_MOVE_CODE`	(none)	Only in the same setup files: the pairing code. Keep it private. You can remove both after the move.

Advanced

Leave these as they are unless you know you need them.

Setting	Default	What it does
`DOCKER_MANAGER_LISTEN_ADDR`	`:8080`	The address and port Docker Manager listens on inside its container.
`DOCKER_MANAGER_DATA_DIR`	`/var/lib/docker-manager`	Where Docker Manager keeps its data inside its container.
`DOCKER_MANAGER_SECRET_KEY_FILE`	`<data folder>/secret.key`	The key file that encrypts saved passwords and access keys. Created on first start.
`DOCKER_MANAGER_RESTIC_BINARY`	`/app/bin/restic`	The backup program inside the image.

Agent settings

Setting	Default	What it does
`DOCKER_AGENT_MANAGER_URL`	(required)	Your Docker Manager address. On Docker Manager's own server, keep `http://docker-manager:8080`.
`DOCKER_AGENT_MANAGER_ALLOW_HTTP`	`false`	Must be `true` for an `http://` address. Only for the agent on Docker Manager's own server.
`DOCKER_AGENT_ENROLLMENT_TOKEN`	(none)	The one-time code from Add Environment. Remove it once the server is connected. `DOCKER_AGENT_ENROLLMENT_TOKEN_FILE` reads it from a file instead.
`DOCKER_AGENT_ENVIRONMENT_NAME`	the server's name	The name the server gets when it first connects, if the install command gave it none (up to 63 characters; fewer with accents or non-Latin letters).
`DOCKER_AGENT_MANAGER_CA_FILE`	(none)	A certificate file to trust, if your HTTPS certificate comes from your own certificate authority.
`DOCKER_AGENT_BACKUP_EXTERNAL_ALLOWLIST`	(none)	Folders outside a stack's folder that backups may include (bind mounts, secret and config files, and the folders of `o=bind` volumes outside the stacks folder), as absolute paths separated by commas, at most 32 (see Backups).
`DOCKER_AGENT_WATCH_MAX`	half the server's file-watch limit	How many folders the agent watches for live file changes (`0` to `4194304`; `0` uses the default). Beyond it, folders are checked every 30 seconds.
`DOCKER_AGENT_SMART_ENABLED`	`true`	Reads the health of the server's disks (see Monitoring). `false` turns it off; RAID arrays are still shown.
`DOCKER_AGENT_SMART_INTERVAL`	`30m`	How often the agent reads every disk's health (`5m` to `24h`). A sleeping disk is skipped (see `DOCKER_AGENT_SMART_WAKE_AFTER`).
`DOCKER_AGENT_SMART_WAKE_AFTER`	`24h`	How long a sleeping disk may go without a check before the agent wakes it for one (`1h` to `720h`). `0` never wakes a disk.
`DOCKER_AGENT_LOG_LEVEL`	`info`	How much the log says: `debug`, `info`, `warn` or `error`.
`DOCKER_AGENT_LOG_FORMAT`	`json`	The log's format: `json` or `text`.

Advanced

Leave these as they are unless you know you need them.

Setting	Default	What it does
`DOCKER_HOST`	`unix:///var/run/docker.sock`	How the agent reaches Docker: `unix://` or `tcp://`.
`DOCKER_AGENT_STACKS_VOLUME`	`docker-manager_stacks`	The volume that holds your stacks' folders.
`DOCKER_AGENT_STATE_DIR`	`/var/lib/docker-agent`	Where the agent keeps its identity inside its container.
`DOCKER_AGENT_HOST_PROC`	`/proc`	Where the agent reads the server's CPU, memory, disk, network, load and RAID state.
`DOCKER_AGENT_HOST_SYS`	`/sys`	Where the agent reads the server's temperature sensors.
`DOCKER_AGENT_RESTIC_BINARY`	`/app/bin/restic`	The backup program inside the image.
`DOCKER_AGENT_RESTART_WAIT`	`10m`	When a backup or restore starts a stack's containers again, how long it waits for a service to be ready before starting the services that depend on it (`30s` to `2h`).
`DOCKER_AGENT_SMARTCTL_BINARY`	`/app/bin/smartctl`	The disk health program inside the image.

Docker's data folder

The agent must see Docker's volume folder at the same path as the server. If your Docker keeps its data somewhere other than /var/lib/docker, find the folder with:

docker info -f '{{.DockerRootDir}}'

Then replace /var/lib/docker with it in both agent lines. For example, with /data/docker:

      - /data/docker/volumes:/data/docker/volumes
      - stacks:/data/docker/volumes/docker-manager_stacks/_data

Your own certificate authority

If your HTTPS certificate comes from your own certificate authority, agents on other servers must trust it. Put the authority's certificate next to the agent's compose.yaml as ca.pem, and add:

compose.yaml

services:
  docker-agent:
    environment:
      # ...keep the existing lines...
      DOCKER_AGENT_MANAGER_CA_FILE: /etc/docker-manager/ca.pem
    volumes:
      # ...keep the existing lines...
      - ./ca.pem:/etc/docker-manager/ca.pem:ro

SELinux

On servers with SELinux turned on, add this to the agent. Don't add :z or :Z to the Docker socket or /var/lib/docker/volumes.

    security_opt:
      - label=disable

Monitoring with Prometheus

Docker Manager can report its own health (jobs, agent connections, database size) to Prometheus.

Set DOCKER_MANAGER_METRICS_ENABLED: "true" on the docker-manager service.
Create an API token that may only Scrape Internal Metrics.
Settings → General shows the address to scrape with that token under Internal Metrics.

Your data

Everything Docker Manager stores is in Docker volumes:

docker-manager_data: Docker Manager's database and its key file. Never delete it, and back it up.
docker-manager_agent: the agent's identity.
docker-manager_stacks: your stacks' folders.

Configuration

Change a settingCopy Anchor Link

Docker Manager settingsCopy Anchor Link

BasicsCopy Anchor Link

Sign-inCopy Anchor Link

File ManagerCopy Anchor Link

Templates, migrations and backupsCopy Anchor Link

History and monitoringCopy Anchor Link

Moving Docker ManagerCopy Anchor Link

AdvancedCopy Anchor Link

Agent settingsCopy Anchor Link

AdvancedCopy Anchor Link

Docker's data folderCopy Anchor Link

Your own certificate authorityCopy Anchor Link

SELinuxCopy Anchor Link

Monitoring with PrometheusCopy Anchor Link

Your dataCopy Anchor Link

On this page

Change a setting

Docker Manager settings

Basics

Sign-in

File Manager

Templates, migrations and backups

History and monitoring

Moving Docker Manager

Advanced

Agent settings

Advanced

Docker's data folder

Your own certificate authority

SELinux

Monitoring with Prometheus

Your data