מפת פורטים
על אילו פורטים כל אפליקציית self-hosted מאזינה, איך לחשוף אותם, ואילו מהם משותפים לשתי אפליקציות.
כל שורה מגיעה מפרופיל אפליקציה בקטלוג של אנרוק, והמקורות שלה מופיעים בעמוד האפליקציה. פורטים ציבוריים נועדו לגישה מחוץ ל-stack, בדרך כלל דרך reverse proxy; פורטים פנימיים נשארים ברשת ה-Docker של ה-stack עצמו.
שתי אפליקציות על אותו שרת יכולות להחזיק כל אחת פורט פנימי באותו מספר: ל-stacks נפרדים של Compose יש רשתות נפרדות. התנגשות קורית כששתי אפליקציות רוצות את אותו פורט על המארח, וזה מה שקורה כשמפרסמים פורט ציבורי ישירות.
כל הפורטים
מוצגים 139 מתוך 139 פורטים.
| פורט | אפליקציה | רכיב | חשיפה | שימוש | משותף עם |
|---|---|---|---|---|---|
| 5678/tcp | n8n | n8n (main) | ציבורי, דרך proxy | Editor UI, REST API and webhooks (HTTP; put behind a TLS reverse proxy) | — |
| 5679/tcp | n8n | n8n (main) | פנימי בלבד | Task broker that the external task-runner sidecar connects to | — |
| 5432/tcp | n8n | PostgreSQL | פנימי בלבד | PostgreSQL connections from n8n main and workers | PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 6379/tcp | n8n | Redis (queue broker) | פנימי בלבד | Queue-mode job broker (Bull queue) between main and workers | Dify, WordPress, Nextcloud, Immich, Paperless-ngx, Outline, Valkey, Activepieces |
| 5678/tcp | n8n | n8n worker | פנימי בלבד | Worker server: /healthz, readiness and /metrics endpoints | — |
| 5679/tcp | n8n | n8n worker | פנימי בלבד | Worker task broker for its own task-runner sidecar | — |
| 5432/tcp | PostgreSQL | PostgreSQL | פנימי בלבד | PostgreSQL client connections (keep on the internal Docker network) | n8n, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 8080/tcp | Coolify | Coolify (app, Reverb realtime, terminal) | ציבורי, דרך proxy | Dashboard and API; published on host port 8000 (close after a proxy domain is set) | Dify, Open WebUI, SearXNG, LocalAI, Keycloak |
| 6001/tcp | Coolify | Coolify (app, Reverb realtime, terminal) | ציבורי, דרך proxy | Realtime (Laravel Reverb) for direct-IP access; close after a proxy domain is set | — |
| 6002/tcp | Coolify | Coolify (app, Reverb realtime, terminal) | ציבורי, דרך proxy | Web terminal for direct-IP access; close after a proxy domain is set | — |
| 80/tcp | Coolify | Traefik (coolify-proxy) | ציבורי, דרך proxy | HTTP traffic and certificate generation via Traefik | Dify, WordPress, Nextcloud, Vaultwarden, BookStack, Activepieces, AdGuard Home |
| 443/tcp | Coolify | Traefik (coolify-proxy) | ציבורי, דרך proxy | HTTPS traffic via Traefik | Dify, BookStack, AdGuard Home |
| 443/udp | Coolify | Traefik (coolify-proxy) | ציבורי, דרך proxy | HTTP/3 (QUIC) via Traefik | BookStack, AdGuard Home |
| 8080/tcp | Coolify | Traefik (coolify-proxy) | פנימי בלבד | Traefik dashboard/API; not in the firewall's required list, keep closed | Dify, Open WebUI, SearXNG, LocalAI, Keycloak |
| 80/tcp | Dify | nginx reverse proxy | ציבורי, דרך proxy | HTTP entry point for the web app, console and API | Coolify, WordPress, Nextcloud, Vaultwarden, BookStack, Activepieces, AdGuard Home |
| 443/tcp | Dify | nginx reverse proxy | ציבורי, דרך proxy | HTTPS entry point (when NGINX_HTTPS_ENABLED=true) | Coolify, BookStack, AdGuard Home |
| 5003/tcp | Dify | Dify plugin daemon | פנימי בלבד | Plugin remote debugging; published on the host by default, firewall it | — |
| 5002/tcp | Dify | Dify plugin daemon | פנימי בלבד | Plugin daemon API (also serves /e/ webhooks via nginx) | — |
| 5001/tcp | Dify | Dify API | פנימי בלבד | Dify API (behind nginx) | — |
| 3000/tcp | Dify | Dify Web (Next.js) | פנימי בלבד | Next.js web frontend (behind nginx) | Gitea, Paperless-ngx, Outline, Linkwarden, Grafana, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 8194/tcp | Dify | DifySandbox (code execution) | פנימי בלבד | Code execution sandbox API | — |
| 8080/tcp | Dify | Vector database (Weaviate by default) | פנימי בלבד | Weaviate HTTP API | Coolify, Open WebUI, SearXNG, LocalAI, Keycloak |
| 6379/tcp | Dify | Redis | פנימי בלבד | Redis cache and Celery broker | n8n, WordPress, Nextcloud, Immich, Paperless-ngx, Outline, Valkey, Activepieces |
| 5432/tcp | Dify | PostgreSQL | פנימי בלבד | PostgreSQL metadata database | n8n, PostgreSQL, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 3128/tcp | Dify | SSRF proxy (Squid) | פנימי בלבד | Squid forward proxy for outbound requests from api and sandbox | — |
| 8080/tcp | Open WebUI | Open WebUI | ציבורי, דרך proxy | Web UI and API (HTTP), published behind a reverse proxy | Coolify, Dify, SearXNG, LocalAI, Keycloak |
| 11434/tcp | Open WebUI | Ollama | פנימי בלבד | Ollama API used by Open WebUI (OLLAMA_BASE_URL), unauthenticated | — |
| 80/tcp | WordPress | WordPress (Apache + PHP 8.4) | ציבורי, דרך proxy | HTTP site and wp-admin (Apache), behind a TLS reverse proxy | Coolify, Dify, Nextcloud, Vaultwarden, BookStack, Activepieces, AdGuard Home |
| 3306/tcp | WordPress | MariaDB | פנימי בלבד | MariaDB client protocol for WordPress | BookStack, Ghost |
| 6379/tcp | WordPress | Redis (object cache) | פנימי בלבד | Redis protocol for the object cache (only with the option enabled) | n8n, Dify, Nextcloud, Immich, Paperless-ngx, Outline, Valkey, Activepieces |
| 3001/tcp | Uptime Kuma | Uptime Kuma | ציבורי, דרך proxy | Web UI, status pages and WebSocket API; publish only behind an HTTPS reverse proxy | AnythingLLM |
| 3000/tcp | Gitea | Gitea server | ציבורי, דרך proxy | Web UI, API and Git over HTTP(S) (behind a reverse proxy) | Dify, Paperless-ngx, Outline, Linkwarden, Grafana, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 22/tcp | Gitea | Gitea server | ציבורי, דרך proxy | Git over SSH (rootful image; usually published on host port 222 or 2222) | — |
| 5432/tcp | Gitea | PostgreSQL | פנימי בלבד | PostgreSQL for Gitea (db:5432 on the Compose network) | n8n, PostgreSQL, Dify, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 80/tcp | Nextcloud | Nextcloud (Apache, PHP and cron) | ציבורי, דרך proxy | Web UI, WebDAV/CalDAV/CardDAV and sync clients (HTTP; serve only behind TLS) | Coolify, Dify, WordPress, Vaultwarden, BookStack, Activepieces, AdGuard Home |
| 5432/tcp | Nextcloud | PostgreSQL | פנימי בלבד | PostgreSQL connections from Nextcloud | n8n, PostgreSQL, Dify, Gitea, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 6379/tcp | Nextcloud | Redis (file locking, distributed cache, sessions) | פנימי בלבד | Redis for file locking, distributed cache and PHP sessions | n8n, Dify, WordPress, Immich, Paperless-ngx, Outline, Valkey, Activepieces |
| 2283/tcp | Immich | Immich server (API, web UI, jobs) | ציבורי, דרך proxy | Web UI, REST API and mobile-app uploads (HTTP with WebSockets; put behind TLS) | — |
| 3003/tcp | Immich | Immich machine learning (CPU) | פנימי בלבד | Machine-learning API called by the server; unauthenticated | — |
| 6379/tcp | Immich | Valkey (job queue) | פנימי בלבד | Job queue between the server's workers (no password) | n8n, Dify, WordPress, Nextcloud, Paperless-ngx, Outline, Valkey, Activepieces |
| 5432/tcp | Immich | PostgreSQL 14 with VectorChord (Immich image) | פנימי בלבד | PostgreSQL connections from the server | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 8000/tcp | Paperless-ngx | Paperless-ngx (web server, task worker, consumer) | ציבורי, דרך proxy | Web UI, REST API and WebSocket status updates (HTTP; put behind TLS) | Portainer CE, Woodpecker CI, LibreChat, Plausible Community Edition |
| 5432/tcp | Paperless-ngx | PostgreSQL | פנימי בלבד | PostgreSQL connections from Paperless | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 6379/tcp | Paperless-ngx | Valkey (Celery task broker) | פנימי בלבד | Celery task broker and result backend (Redis protocol) | n8n, Dify, WordPress, Nextcloud, Immich, Outline, Valkey, Activepieces |
| 3000/tcp | Paperless-ngx | Gotenberg (Office and e-mail to PDF) | פנימי בלבד | Gotenberg conversion API used by Paperless (office-documents option) | Dify, Gitea, Outline, Linkwarden, Grafana, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 9998/tcp | Paperless-ngx | Apache Tika (Office text extraction) | פנימי בלבד | Tika Server parsing API used by Paperless (office-documents option) | — |
| 80/tcp | Vaultwarden | Vaultwarden | ציבורי, דרך proxy | Web vault, client API and WebSocket notifications (Rocket HTTP); serve only through an HTTPS reverse proxy | Coolify, Dify, WordPress, Nextcloud, BookStack, Activepieces, AdGuard Home |
| 80/tcp | BookStack | BookStack (linuxserver.io image: nginx + PHP-FPM 8.5) | ציבורי, דרך proxy | Web UI and REST API (nginx + PHP-FPM), behind a TLS reverse proxy | Coolify, Dify, WordPress, Nextcloud, Vaultwarden, Activepieces, AdGuard Home |
| 443/tcp | BookStack | BookStack (linuxserver.io image: nginx + PHP-FPM 8.5) | פנימי בלבד | nginx HTTPS with the image's self-signed certificate; unused, TLS ends at the proxy | Coolify, Dify, AdGuard Home |
| 443/udp | BookStack | BookStack (linuxserver.io image: nginx + PHP-FPM 8.5) | פנימי בלבד | nginx HTTP/3 (QUIC) listener of the image; unused | Coolify, AdGuard Home |
| 11211/tcp | BookStack | BookStack (linuxserver.io image: nginx + PHP-FPM 8.5) | פנימי בלבד | memcached started by the image; BookStack's default CACHE_DRIVER is file | — |
| 3306/tcp | BookStack | MariaDB | פנימי בלבד | MariaDB client protocol for BookStack | WordPress, Ghost |
| 3000/tcp | Outline | Outline (web, API, collaboration, worker) | ציבורי, דרך proxy | Web UI, API and WebSockets (collaboration); HTTP, put behind TLS | Dify, Gitea, Paperless-ngx, Linkwarden, Grafana, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 5432/tcp | Outline | PostgreSQL | פנימי בלבד | PostgreSQL connections from Outline | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 6379/tcp | Outline | Redis (queues, cache, rate limiter) | פנימי בלבד | Redis for Outline's queues, cache and rate limiter | n8n, Dify, WordPress, Nextcloud, Immich, Paperless-ngx, Valkey, Activepieces |
| 9000/tcp | Mealie | Mealie (web UI and API) | ציבורי, דרך proxy | Web UI and REST API (HTTP; put behind a TLS reverse proxy) | Portainer CE, Woodpecker CI, authentik, Keycloak, Plausible Community Edition |
| 5432/tcp | Mealie | PostgreSQL | פנימי בלבד | PostgreSQL connections from Mealie (database=postgres only) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 3000/tcp | Linkwarden | Linkwarden (web, worker and headless Chromium) | ציבורי, דרך proxy | Web UI, REST API, browser extension and mobile app (HTTP; put behind TLS) | Dify, Gitea, Paperless-ngx, Outline, Grafana, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 5432/tcp | Linkwarden | PostgreSQL | פנימי בלבד | PostgreSQL connections from the web and worker processes | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 7700/tcp | Linkwarden | Meilisearch (full-text search) | פנימי בלבד | Meilisearch API (indexing by the worker, searches by the web app) | LibreChat |
| 3000/tcp | Grafana | Grafana (UI, data source proxy and alerting) | ציבורי, דרך proxy | Web UI and HTTP API (HTTP; put behind a TLS reverse proxy) | Dify, Gitea, Paperless-ngx, Outline, Linkwarden, Woodpecker CI, Flowise, AdGuard Home, Umami |
| 5432/tcp | Grafana | PostgreSQL | פנימי בלבד | PostgreSQL connections from Grafana (database=postgres only) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 9090/tcp | Prometheus | Prometheus | פנימי בלבד | Web UI, PromQL HTTP API and /metrics; no login, so keep it on the internal network | — |
| 3100/tcp | Grafana Loki | Loki | פנימי בלבד | HTTP API: push (/loki/api/v1/push, /otlp/v1/logs), LogQL queries, /ready; no authentication | — |
| 9095/tcp | Grafana Loki | Loki | פנימי בלבד | gRPC between Loki components (default grpc_listen_port); unused from outside | — |
| 9443/tcp | Portainer CE | Portainer Server (CE) | ציבורי, דרך proxy | UI and API over HTTPS (self-signed certificate by default); keep it on a VPN or a restricted network | authentik |
| 8000/tcp | Portainer CE | Portainer Server (CE) | ציבורי, דרך proxy | TCP tunnel server for Edge Agents; publish only when Edge Agents are used | Paperless-ngx, Woodpecker CI, LibreChat, Plausible Community Edition |
| 9000/tcp | Portainer CE | Portainer Server (CE) | פנימי בלבד | Legacy plain-HTTP UI and API; listens by default but is not published; turn off with --http-disabled | Mealie, Woodpecker CI, authentik, Keycloak, Plausible Community Edition |
| 8333/tcp | SeaweedFS | SeaweedFS (weed mini) | ציבורי, דרך proxy | S3 API (SigV4, path-style) and the /healthz probe; serve only through an HTTPS reverse proxy | — |
| 9333/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Master HTTP API and UI (volume assignment); no authentication | — |
| 19333/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Master gRPC (HTTP port + 10000); mutual TLS only when configured | — |
| 9340/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Volume server HTTP (object data); writes unprotected without a JWT signing key | — |
| 19340/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Volume server gRPC (HTTP port + 10000) | — |
| 8888/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Filer HTTP API and UI; reads and writes every file without auth unless JWT keys are set | — |
| 18888/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Filer gRPC (HTTP port + 10000), used by the S3 gateway | — |
| 18333/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | S3 gateway gRPC (HTTP port + 10000) | — |
| 23646/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Admin server; with -admin.ui=false only /health and /metrics | — |
| 33646/tcp | SeaweedFS | SeaweedFS (weed mini) | פנימי בלבד | Admin worker gRPC (HTTP port + 10000) for the maintenance worker; no password auth | — |
| 6379/tcp | Valkey | Valkey | פנימי בלבד | Valkey client connections (RESP); keep on the internal Docker network or on loopback | n8n, Dify, WordPress, Nextcloud, Immich, Paperless-ngx, Outline, Activepieces |
| 8065/tcp | Mattermost | Mattermost Team Edition (web app, API, WebSockets, jobs) | ציבורי, דרך proxy | Web app, REST API and WebSockets (HTTP); put behind TLS | — |
| 5432/tcp | Mattermost | PostgreSQL | פנימי בלבד | PostgreSQL connections from Mattermost | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 8000/tcp | Woodpecker CI | Woodpecker server (web UI, API, webhooks, scheduler) | ציבורי, דרך proxy | Web UI, API and forge webhooks (HTTP); serve through an HTTPS reverse proxy | Paperless-ngx, Portainer CE, LibreChat, Plausible Community Edition |
| 9000/tcp | Woodpecker CI | Woodpecker server (web UI, API, webhooks, scheduler) | פנימי בלבד | gRPC for agents; plain text by default, put TLS in front (h2c proxy) before remote agents use it | Mealie, Portainer CE, authentik, Keycloak, Plausible Community Edition |
| 3000/tcp | Woodpecker CI | Woodpecker agent with its pipeline containers (Docker backend) | פנימי בלבד | Agent health endpoint (/healthz) used by the image's HEALTHCHECK | Dify, Gitea, Paperless-ngx, Outline, Linkwarden, Grafana, Flowise, AdGuard Home, Umami |
| 3000/tcp | Flowise | Flowise | ציבורי, דרך proxy | Web UI, REST and prediction API, embed widget (HTTP; behind a TLS reverse proxy) | Dify, Gitea, Paperless-ngx, Outline, Linkwarden, Grafana, Woodpecker CI, AdGuard Home, Umami |
| 5432/tcp | Flowise | PostgreSQL | פנימי בלבד | PostgreSQL connections from Flowise (database option postgres) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 7860/tcp | Langflow | Langflow (editor and API) | ציבורי, דרך proxy | Visual editor, REST API and MCP endpoints (HTTP; put behind a TLS reverse proxy) | — |
| 5432/tcp | Langflow | PostgreSQL | פנימי בלבד | PostgreSQL connections from Langflow (LANGFLOW_DATABASE_URL) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 3080/tcp | LibreChat | LibreChat (API and web client) | ציבורי, דרך proxy | Web client and API (HTTP), published behind a reverse proxy | — |
| 27017/tcp | LibreChat | MongoDB | פנימי בלבד | MongoDB used by LibreChat (MONGO_URI) | — |
| 7700/tcp | LibreChat | Meilisearch | פנימי בלבד | Meilisearch API for conversation search; never published | Linkwarden |
| 5432/tcp | LibreChat | PostgreSQL with pgvector | פנימי בלבד | PostgreSQL with pgvector, used only by rag_api | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, Activepieces, authentik, Keycloak, Plausible Community Edition, Umami |
| 8000/tcp | LibreChat | rag_api (lite) | פנימי בלבד | rag_api file indexing and retrieval (RAG_API_URL), called by LibreChat | Paperless-ngx, Portainer CE, Woodpecker CI, Plausible Community Edition |
| 3001/tcp | AnythingLLM | AnythingLLM | ציבורי, דרך proxy | Web UI, REST API and agent WebSocket; publish only behind an HTTPS reverse proxy | Uptime Kuma |
| 8080/tcp | SearXNG | SearXNG | ציבורי, דרך proxy | Web UI and search API (Granian HTTP); serve through an HTTPS reverse proxy | Coolify, Dify, Open WebUI, LocalAI, Keycloak |
| 6333/tcp | Qdrant | Qdrant | ציבורי, דרך proxy | REST API, Web UI (/dashboard) and health/metrics; only with an API key and HTTPS | — |
| 6334/tcp | Qdrant | Qdrant | פנימי בלבד | gRPC API for clients on the internal Docker network | — |
| 8080/tcp | LocalAI | LocalAI | ציבורי, דרך proxy | OpenAI-compatible API and web UI (HTTP), behind a reverse proxy, API key required | Coolify, Dify, Open WebUI, SearXNG, Keycloak |
| 80/tcp | Activepieces | Activepieces (app: API and UI) | ציבורי, דרך proxy | UI, REST API, webhooks and the worker's API/Socket.IO endpoint (HTTP; put behind TLS) | Coolify, Dify, WordPress, Nextcloud, Vaultwarden, BookStack, AdGuard Home |
| 5432/tcp | Activepieces | PostgreSQL | פנימי בלבד | PostgreSQL connections from the app | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, authentik, Keycloak, Plausible Community Edition, Umami |
| 6379/tcp | Activepieces | Redis (BullMQ job queue) | פנימי בלבד | BullMQ job queue between the app and the workers | n8n, Dify, WordPress, Nextcloud, Immich, Paperless-ngx, Outline, Valkey |
| 8096/tcp | Jellyfin | Jellyfin (server, web client and FFmpeg) | ציבורי, דרך proxy | Web client, HTTP API and streaming for every client app (HTTP; put behind TLS) | — |
| 8123/tcp | Home Assistant | Home Assistant Core (with go2rtc and SQLite recorder) | ציבורי, דרך proxy | Web UI, REST and WebSocket API, companion apps; on the host network (put behind TLS) | Plausible Community Edition |
| 53/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | Plain DNS on the host's interfaces; allow only your own networks | — |
| 53/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | Plain DNS over TCP (large answers, TCP fallback); same audience as 53/udp | — |
| 67/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DHCP server (off by default; LAN only, needs host networking in Docker) | — |
| 68/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DHCP client side of the optional DHCP server (LAN only) | — |
| 80/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | Web UI and API after setup (port chosen in the wizard; keep it off the public internet) | Coolify, Dify, WordPress, Nextcloud, Vaultwarden, BookStack, Activepieces |
| 443/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | HTTPS web UI and DNS-over-HTTPS once encryption is on (collides with a host proxy) | Coolify, Dify, BookStack |
| 443/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DNS-over-HTTPS over HTTP/3 once encryption is on | Coolify, BookStack |
| 853/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DNS-over-TLS once encryption is on | — |
| 853/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DNS-over-QUIC once encryption is on | — |
| 3000/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | פנימי בלבד | First-start setup wizard on 0.0.0.0:3000, open to anyone until finished; reach via SSH tunnel | Dify, Gitea, Paperless-ngx, Outline, Linkwarden, Grafana, Woodpecker CI, Flowise, Umami |
| 3000/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | פנימי בלבד | HTTP/3 on the alternative web port (exposed by the image, not needed by default) | — |
| 5443/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DNSCrypt (optional) | — |
| 5443/udp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | ציבורי, דרך proxy | DNSCrypt (optional) | — |
| 6060/tcp | AdGuard Home | AdGuard Home (DNS server, web UI, optional DHCP) | פנימי בלבד | pprof debug API (off by default); never publish | — |
| 9000/tcp | authentik | authentik server (web UI, API, flows, embedded outpost) | ציבורי, דרך proxy | Web UI, API, SSO endpoints and embedded proxy outpost (HTTP; put behind TLS) | Mealie, Portainer CE, Woodpecker CI, Keycloak, Plausible Community Edition |
| 9443/tcp | authentik | authentik server (web UI, API, flows, embedded outpost) | פנימי בלבד | HTTPS listener with a self-signed certificate; unused when TLS ends at the proxy | Portainer CE |
| 9300/tcp | authentik | authentik server (web UI, API, flows, embedded outpost) | פנימי בלבד | Prometheus metrics of the server, without authentication | — |
| 9000/tcp | authentik | authentik worker (background tasks) | פנימי בלבד | Worker health endpoint (/-/health/ready/) | Mealie, Portainer CE, Woodpecker CI, Keycloak, Plausible Community Edition |
| 9300/tcp | authentik | authentik worker (background tasks) | פנימי בלבד | Prometheus metrics of the worker (task counts and durations) | — |
| 5432/tcp | authentik | PostgreSQL | פנימי בלבד | PostgreSQL connections, task queue and LISTEN/NOTIFY of server and worker | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, Keycloak, Plausible Community Edition, Umami |
| 8080/tcp | Keycloak | Keycloak server | ציבורי, דרך proxy | Login pages, OIDC/SAML endpoints, Admin Console and Admin API (HTTP; TLS at the proxy) | Coolify, Dify, Open WebUI, SearXNG, LocalAI |
| 9000/tcp | Keycloak | Keycloak server | פנימי בלבד | Management interface: /health and /metrics; never expose it | Mealie, Portainer CE, Woodpecker CI, authentik, Plausible Community Edition |
| 7800/tcp | Keycloak | Keycloak server | פנימי בלבד | JGroups unicast transport of the ispn caches (jdbc-ping stack) | — |
| 57800/tcp | Keycloak | Keycloak server | פנימי בלבד | JGroups failure detection (FD_SOCK2, bind port + 50000) | — |
| 5432/tcp | Keycloak | PostgreSQL | פנימי בלבד | PostgreSQL connections from Keycloak (also its jdbc-ping node registry) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Plausible Community Edition, Umami |
| 8000/tcp | Plausible Community Edition | Plausible (web app and event ingestion) | ציבורי, דרך proxy | Dashboard, tracking script, event API (/api/event) and Stats API (HTTP; put behind TLS) | Paperless-ngx, Portainer CE, Woodpecker CI, LibreChat |
| 5432/tcp | Plausible Community Edition | PostgreSQL | פנימי בלבד | PostgreSQL connections from Plausible (accounts, sites, job queue) | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Umami |
| 8123/tcp | Plausible Community Edition | ClickHouse (analytics events) | פנימי בלבד | ClickHouse HTTP interface: Plausible writes and queries events here | Home Assistant |
| 9000/tcp | Plausible Community Edition | ClickHouse (analytics events) | פנימי בלבד | ClickHouse native protocol (clickhouse-client); not used by Plausible | Mealie, Portainer CE, Woodpecker CI, authentik, Keycloak |
| 9004/tcp | Plausible Community Edition | ClickHouse (analytics events) | פנימי בלבד | ClickHouse MySQL wire protocol, on by default; not used by Plausible | — |
| 9005/tcp | Plausible Community Edition | ClickHouse (analytics events) | פנימי בלבד | ClickHouse PostgreSQL wire protocol, on by default; not used by Plausible | — |
| 9009/tcp | Plausible Community Edition | ClickHouse (analytics events) | פנימי בלבד | ClickHouse interserver replication port; unused on a single node | — |
| 3000/tcp | Umami | Umami (dashboard, API, tracker and collector) | ציבורי, דרך proxy | Dashboard, API, tracker script and the /api/send collector (HTTP; put behind TLS) | Dify, Gitea, Paperless-ngx, Outline, Linkwarden, Grafana, Woodpecker CI, Flowise, AdGuard Home |
| 5432/tcp | Umami | PostgreSQL | פנימי בלבד | PostgreSQL connections from Umami | n8n, PostgreSQL, Dify, Gitea, Nextcloud, Immich, Paperless-ngx, Outline, Mealie, Linkwarden, Grafana, Mattermost, Flowise, Langflow, LibreChat, Activepieces, authentik, Keycloak, Plausible Community Edition |
| 2368/tcp | Ghost | Ghost (web, Admin and APIs) | ציבורי, דרך proxy | Site, members area, Admin (/ghost) and the Content and Admin APIs (HTTP; put behind TLS) | — |
| 3306/tcp | Ghost | MySQL | פנימי בלבד | MySQL client protocol for Ghost | WordPress, BookStack |
בעמוד של כל אפליקציה מופיעים המקורות של הפורטים שלה.
פורטים שיותר מאפליקציה אחת משתמשת בהם
אותו מספר פורט ופרוטוקול בשתי אפליקציות או יותר. עדיין אפשר להריץ אותן על אותו שרת; כאן כתוב מה לשנות.
80/tcp מתנגש אם מפרסמים ישירות
Coolify (ציבורי, דרך proxy), Dify (ציבורי, דרך proxy), WordPress (ציבורי, דרך proxy), Nextcloud (ציבורי, דרך proxy), Vaultwarden (ציבורי, דרך proxy), BookStack (ציבורי, דרך proxy), Activepieces (ציבורי, דרך proxy), AdGuard Home (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
443/tcp מתנגש אם מפרסמים ישירות
Coolify (ציבורי, דרך proxy), Dify (ציבורי, דרך proxy), BookStack (פנימי בלבד), AdGuard Home (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
443/udp מתנגש אם מפרסמים ישירות
Coolify (ציבורי, דרך proxy), BookStack (פנימי בלבד), AdGuard Home (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
3000/tcp מתנגש אם מפרסמים ישירות
Dify (פנימי בלבד), Gitea (ציבורי, דרך proxy), Paperless-ngx (פנימי בלבד), Outline (ציבורי, דרך proxy), Linkwarden (ציבורי, דרך proxy), Grafana (ציבורי, דרך proxy), Woodpecker CI (פנימי בלבד), Flowise (ציבורי, דרך proxy), AdGuard Home (פנימי בלבד), Umami (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
3001/tcp מתנגש אם מפרסמים ישירות
Uptime Kuma (ציבורי, דרך proxy), AnythingLLM (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
3306/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
WordPress (פנימי בלבד), BookStack (פנימי בלבד), Ghost (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
5432/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
n8n (פנימי בלבד), PostgreSQL (פנימי בלבד), Dify (פנימי בלבד), Gitea (פנימי בלבד), Nextcloud (פנימי בלבד), Immich (פנימי בלבד), Paperless-ngx (פנימי בלבד), Outline (פנימי בלבד), Mealie (פנימי בלבד), Linkwarden (פנימי בלבד), Grafana (פנימי בלבד), Mattermost (פנימי בלבד), Flowise (פנימי בלבד), Langflow (פנימי בלבד), LibreChat (פנימי בלבד), Activepieces (פנימי בלבד), authentik (פנימי בלבד), Keycloak (פנימי בלבד), Plausible Community Edition (פנימי בלבד), Umami (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
6379/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
n8n (פנימי בלבד), Dify (פנימי בלבד), WordPress (פנימי בלבד), Nextcloud (פנימי בלבד), Immich (פנימי בלבד), Paperless-ngx (פנימי בלבד), Outline (פנימי בלבד), Valkey (פנימי בלבד), Activepieces (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
7700/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
Linkwarden (פנימי בלבד), LibreChat (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
8000/tcp מתנגש אם מפרסמים ישירות
Paperless-ngx (ציבורי, דרך proxy), Portainer CE (ציבורי, דרך proxy), Woodpecker CI (ציבורי, דרך proxy), LibreChat (פנימי בלבד), Plausible Community Edition (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
8080/tcp מתנגש אם מפרסמים ישירות
Coolify (ציבורי, דרך proxy), Dify (פנימי בלבד), Open WebUI (ציבורי, דרך proxy), SearXNG (ציבורי, דרך proxy), LocalAI (ציבורי, דרך proxy), Keycloak (ציבורי, דרך proxy)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
8123/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
Home Assistant (ציבורי, דרך proxy), Plausible Community Edition (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
9000/tcp מתנגש אם מפרסמים ישירות
Mealie (ציבורי, דרך proxy), Portainer CE (פנימי בלבד), Woodpecker CI (פנימי בלבד), authentik (ציבורי, דרך proxy), Keycloak (פנימי בלבד), Plausible Community Edition (פנימי בלבד)
לפחות שתיים מהאפליקציות האלה חושפות את הפורט לציבור. רק אחת יכולה לתפוס אותו על המארח: שימו את האפליקציות מאחורי reverse proxy אחד, או פרסמו אחת מהן על פורט אחר במארח.
9443/tcp אותו מספר, בלי התנגשות כל עוד הוא פנימי
Portainer CE (ציבורי, דרך proxy), authentik (פנימי בלבד)
לכל היותר אחת מהאפליקציות האלה חושפת את הפורט; האחרות שומרות אותו בתוך ה-stack שלהן. אל תפרסמו את הפנימיים למארח.
מקורות
- n8n Docs: Install with Docker (current stable 2.42.6, port 5678, .n8n volume)
- n8n-hosting: docker-compose/withPostgres (n8n + postgres + n8nio/runners)
- n8n-hosting: docker-compose/withPostgresAndWorker (queue mode with Redis and worker)
- n8n Docs: Enable queue mode (Redis, workers, concurrency 10, relay size 64 MiB)
- n8n Docs: Queue mode environment variables (QUEUE_HEALTH_CHECK_PORT)
- n8n Docs: Choose n8n's database (SQLite default, PostgreSQL 16-18)
- n8n Docs: Task runner environment variables (broker port 5679, max concurrency 5)
- n8n Docs: Deployment environment variables (N8N_PORT, N8N_ENCRYPTION_KEY)
- n8n Docs: Set up SSL (reverse proxy recommended)
- PostgreSQL 18 documentation: 19.3 Connections and Authentication
- docker-library/postgres: 18/trixie Dockerfile (PGDATA, VOLUME, EXPOSE 5432)
- coollabsio/coolify docker-compose.prod.yml (main)
- coollabsio/coolify bootstrap/helpers/proxy.php (coolify-proxy Traefik definition)
- Coolify Docs: Migrate realtime services to Reverb
- Coolify Docs: Firewall
- Dify docs: Environment Variables
- Dify 1.17.1 docker/docker-compose.yaml
- Dify 1.17.1 docker/.env.example (default COMPOSE_PROFILES, workers, passwords)
- Dify 1.17.1 docker/nginx/conf.d/default.conf.template (upstream ports)
- Open WebUI docker-compose.yaml (open-webui + ollama, volumes, ports)
- Open WebUI README: Docker install, port 8080, /app/backend/data volume
- Ollama Docker: CPU-only run command, /root/.ollama volume, port 11434
- Ollama API authentication: the local API on port 11434 requires none
- Docker Official Image wordpress: documentation
- Docker Official Image wordpress: example compose.yaml
- Docker Official Image mariadb: documentation
- redis/docker-library-redis v8.10.2: debian Dockerfile
- Uptime Kuma README (install, NFS warning, features incl. 2FA)
- Official compose.yaml at tag 2.5.6
- docker/dockerfile at tag 2.5.6 (EXPOSE 3001, healthcheck)
- Uptime Kuma wiki: Reverse Proxy (WebSocket headers, HTTPS, no subdirectory)
- Gitea docs: Installation with Docker (docker-compose.yml, SQLite/PostgreSQL)
- nextcloud/docker README: volumes, auto configuration (POSTGRES_*, NEXTCLOUD_ADMIN_*, NEXTCLOUD_DATA_DIR, NEXTCLOUD_TRUSTED_DOMAINS, NEXTCLOUD_UPDATE), Redis, proxy, upgrades
- nextcloud/docker .examples insecure/postgres/apache compose.yaml (postgres, redis, nextcloud:apache on 127.0.0.1:8080:80, cron service running /cron.sh on the same html volume)
- nextcloud/docker 35/apache Dockerfile (php:8.5-apache-trixie, 35.0.1, crontab */5 cron.php, remoteip X-Real-IP from private ranges, /var/www/data, VOLUME /var/www/html, no HEALTHCHECK)
- nextcloud/docker 35/apache config/redis.config.php (REDIS_HOST sets memcache.distributed and memcache.locking to Redis)
- Docker Official Image postgres: documentation (docker-library/docs)
- immich repository: docker/docker-compose.yml at v3.3.3 (server 2283:2283, machine-learning, valkey/valkey:9, ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0, shm_size 128mb)
- immich repository: server/Dockerfile at v3.3.3 (no USER, VOLUME /data, EXPOSE 2283, HEALTHCHECK immich-healthcheck)
- valkey-io/valkey-container: 9.1/debian Dockerfile (VALKEY_VERSION 9.1.2, valkey uid/gid 999, WORKDIR /data, EXPOSE 6379, valkey-cli)
- Immich Docs: Environment variables (DB_* and REDIS_* defaults, IMMICH_PORT 2283 / 3003, MACHINE_LEARNING_MODEL_TTL 300 s, DB_STORAGE_TYPE)
- Immich Docs: Remote machine learning (the ML container has no security measures; it receives image previews and keeps nothing)
- Immich Docs: Config file (default ML URL http://immich-machine-learning:3003, CLIP ViT-B-32__openai, faces buffalo_l, OCR PP-OCRv5_mobile, database dump daily 02:00, keep 14)
- docker-library/postgres: 14/bookworm Dockerfile (postgres uid/gid 999, PGDATA and VOLUME /var/lib/postgresql/data)
- paperless-ngx repository: docker/compose/docker-compose.postgres.yml at v3.3.1 (webserver 8000:8000, postgres:18, valkey/valkey:9-alpine, data/media volumes, ./export and ./consume)
- paperless-ngx repository: docker/compose/docker-compose.postgres-tika.yml at v3.3.1 (adds gotenberg:8.37 with JavaScript disabled and apache/tika:3.3.1.0)
- paperless-ngx repository: s6 svc-webserver run script at v3.3.1 (granian on port 8000, 1 worker, s6-setuidgid paperless)
- Paperless-ngx docs (v3.3.1): Configuration (TASK_WORKERS 1, THREADS_PER_WORKER, WEBSERVER_WORKERS 1, SECRET_KEY required, ADMIN_USER, Tika, OCR languages)
- paperless-ngx repository: Dockerfile at v3.3.1 (user paperless 1000:1000, VOLUME data/media/consume/export, EXPOSE 8000, HEALTHCHECK curl localhost:8000 every 30 s)
- valkey-io/valkey-container: 9.1/alpine Dockerfile (9.1.2; user valkey uid 999 gid 1000; WORKDIR /data; EXPOSE 6379; valkey-cli)
- Gotenberg Docs: Installation (port 3000; non-root user gotenberg 1001; demo on 512 MB / 0.5 CPU; allocate at least 1Gi of memory on Cloud Run)
- apache/tika-docker README (Tika Server on port 9998; minimal and full images; bind to localhost)
- Vaultwarden README at 1.37.4: web vault needs HTTPS (secure context), docker run and compose examples (DOMAIN, /data, 127.0.0.1:8000:80), disclaimer
- docker/Dockerfile.debian at 1.37.4: ROCKET_ADDRESS 0.0.0.0, ROCKET_PORT 80, VOLUME /data, EXPOSE 80, no USER, HEALTHCHECK --interval=60s --timeout=10s CMD /healthcheck.sh
- Vaultwarden wiki: Enabling WebSocket notifications (on the main HTTP port since 1.29/1.31; mobile apps use push instead)
- BookStack devops: lsio-docker/docker-compose.yml (linuxserver bookstack + mariadb, APP_URL, APP_KEY, DB_*, /config volume, 6875:80)
- linuxserver/docker-bookstack README at e6221fc (default admin login, env vars, /config path mapping, QUEUE_CONNECTION, changelog)
- linuxserver/docker-bookstack Dockerfile at e6221fc (alpine-nginx base, PHP 8.5, memcached, /config symlinks, EXPOSE 80 443, VOLUME /config, no HEALTHCHECK)
- linuxserver/docker-baseimage-alpine-nginx 3.24: default site conf (listen 80, 443 ssl and 443 quic)
- linuxserver/docker-baseimage-alpine-nginx 3.24 init-keygen/run: self-signed certificate in /config/keys
- linuxserver/docker-bookstack svc-memcached/run: memcached -u abc with default options
- memcached(1) man page: -m default 64 MB, -p TCP port default 11211, -l default INADDR_ANY
- BookStack v26.09.1 .env.example.complete (CACHE_DRIVER file, QUEUE_CONNECTION sync, REVISION_LIMIT 100, RECYCLE_BIN_LIFETIME 30, FILE_UPLOAD_SIZE_LIMIT 50, ALLOWED_SSR_HOSTS *)
- Outline hosting docs: Docker (Compose example with outline, redis, postgres:18 at /var/lib/postgresql, https-portal; migrations run on start)
- outline repository: .env.sample at v1.11.0 (URL, PORT 3000, SECRET_KEY hex 32 bytes, UTILS_SECRET, FILE_STORAGE=local, upload max 262144000, PGSSLMODE)
- outline repository: server/env.ts at v1.11.0 (SECRET_KEY 64 hex chars; DATABASE_HOST/PORT/NAME/USER/PASSWORD; SERVICES default; FORCE_HTTPS; SMTP_*; upload max default 1,000,000 B)
- outline repository: Dockerfile at v1.11.0 (node:26.3.0-slim, USER nodejs uid 1001, VOLUME /var/lib/outline/data, wget, HEALTHCHECK /_health every 1m, EXPOSE 3000)
- Outline hosting docs: Redis (a single Redis server via REDIS_URL, e.g. redis://redis:6379)
- redis/docker-library-redis v7.4.11: debian Dockerfile (redis uid/gid 999, VOLUME /data, EXPOSE 6379, redis-cli)
- Mealie Docs: Installing with SQLite (compose: v3.28.0, 9925:9000, memory limit 1000M, /app/data, ALLOW_SIGNUP false, PUID/PGID, TZ, BASE_URL; 1-20 users)
- Mealie Docs: Installing with PostgreSQL (compose with postgres:17, DB_ENGINE and POSTGRES_* variables, many concurrent users)
- Mealie Docs: Backend Configuration (PUID/PGID 911, BASE_URL, TZ, ALLOW_SIGNUP, DB_ENGINE, UVICORN_WORKERS 1, API_PORT 9000)
- mealie v3.28.0 docker/Dockerfile (user abc uid 911, VOLUME /app/data, APP_PORT 9000, HEALTHCHECK healthcheck.sh, curl and gosu installed)
- linkwarden repository: docker-compose.yml at v2.16.3 (postgres:16-alpine, linkwarden:latest on 3000 with ./data:/data/data, getmeili/meilisearch:v1.13.3; env_file .env for all three)
- linkwarden repository: Dockerfile at v2.16.3 (node:22.23-bookworm-slim, no USER, Chromium headless shell, prisma migrate deploy at start, HEALTHCHECK curl http://127.0.0.1:3000/, EXPOSE 3000)
- linkwarden repository: packages/lib/meilisearchClient.ts at v2.16.3 (client only when MEILI_MASTER_KEY is set; MEILI_HOST default http://meilisearch:7700)
- meilisearch repository: Dockerfile at v1.13.3 (alpine:3.20 with curl, no USER, WORKDIR /meili_data, EXPOSE 7700, no HEALTHCHECK)
- Grafana docs at v13.2.4: Run Grafana Docker image (compose: restart unless-stopped, '3000:3000', named volume at /var/lib/grafana, GF_SERVER_ROOT_URL, GF_PLUGINS_PREINSTALL)
- Grafana docs at v13.2.4: Configure Grafana (GF_<SECTION>_<KEY> overrides; root_url, database, max_open_conn, reporting_enabled, admin_password set once on first run, secret_key, cookie_secure)
- conf/defaults.ini at v13.2.4: http_port 3000, sqlite3 grafana.db, max_open_conn unset, reporting_enabled true, sign-up and anonymous off, public default secret_key, annotations kept forever
- Dockerfile at v13.2.4: Alpine image with curl, GF_UID 472 and GF_GID 0, /var/lib/grafana owned by grafana and mode 777, EXPOSE 3000, USER 472, no HEALTHCHECK, no VOLUME
- Dockerfile at v3.13.4 (busybox): prometheus.yml in /etc/prometheus, both dirs chowned to nobody, USER nobody, EXPOSE 9090, VOLUME /prometheus, CMD --config.file --storage.tsdb.path, no HEALTHCHECK
- Registry config and layers of prom/prometheus:v3.13.4 (linux/amd64): User nobody (65534:65534), ExposedPorts 9090/tcp, Volumes /prometheus, no Healthcheck; busybox wget, sh and vi present
- Prometheus docs: Security model (HTTP endpoints must not face the internet; anyone with HTTP access reads all series; admin API and lifecycle off by default)
- Prometheus 3.13 docs: prometheus command line (--web.listen-address 0.0.0.0:9090, retention flags deprecated in favour of the config file, --query.max-samples 50000000, --query.max-concurrency 20)
- cmd/loki/loki-docker-config.yaml at v3.7.8 (the image's default config): auth_enabled false, http 3100, path_prefix /loki, filesystem chunks, tsdb v13 with 24h index
- Loki configuration reference at v3.7.8: grpc_listen_port 9095, retention_enabled false, retention_period 0s (-store.retention), reporting_enabled true, ingestion and chunk defaults
- Loki HTTP API reference at v3.7.8: POST /loki/api/v1/push, POST /otlp/v1/logs, GET /ready (HTTP 200 when ready for traffic)
- Loki docs at v3.7.8: Manage authentication (no built-in authentication layer; run an authenticating reverse proxy in front)
- Portainer docs: Install Portainer CE with Docker on Linux (docker.sock and portainer_data mounts, 9443 HTTPS self-signed, 8000 only for Edge, 9000 legacy HTTP)
- Portainer docs: Requirements and prerequisites (Community 2.45.2 LTS tested with Docker 28.5.1 and 29.8.1; ports 9443, 8000, agent 9001; Git stacks cloned to the data volume)
- Portainer docs: CLI configuration options (--bind default :9000, --bind-https :9443, --http-disabled, --tunnel-port, --snapshot-interval, --data /data)
- portainer/portainer api/cli/defaults.go at 2.45.2 (bind :9000, bind-https :9443, tunnel port 8000, data /data)
- portainer/portainer api/datastore/init.go at 2.45.2 (new database: SSL settings with HTTPEnabled true, so HTTP on 9000 listens until disabled)
- SeaweedFS wiki: Quick Start with weed mini (docker run with /data, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, S3_BUCKET; no keys = Allow All; -s3.externalUrl behind a proxy)
- weed/command/mini.go at 4.48: ports 8333/9333/9340/8888/23646 (gRPC +10000), -webdav, -admin.ui, -s3.port.iceberg/lance, -master.telemetry (on), auto volume size
- weed/s3api/s3api_server.go at 4.48: /status, /healthz and /readyz probes; -domainName for virtual-host style; a host-less path-style route always registered
- weed/admin/handlers/admin_handlers.go at 4.48: /health and /metrics without auth; with the UI disabled no other route; without a password every UI and /api route is public
- SeaweedFS wiki: Security Overview (master HTTP unsecured; filer HTTP and volume writes secured only with JWT keys; gRPC with mutual TLS)
- SeaweedFS wiki: Admin UI (adminPassword enables login; worker gRPC has no password auth; WEED_ADMIN_* env vars)
- Docker Hub valkey/valkey description: protected mode off (set a password before exposing 6379), /data for persistence, start flags through VALKEY_EXTRA_FLAGS
- Registry config of valkey/valkey:9.1.2 (linux/amd64): no User, ExposedPorts 6379/tcp, no Volumes, no Healthcheck, Entrypoint tini -- docker-entrypoint.sh, Cmd valkey-server, WorkingDir /data
- mattermost/docker docker-compose.without-nginx.yml: publishes APP_PORT:8065 and the Calls port 8443 over udp and tcp
- mattermost/docker env.example: postgres 18-alpine, mmuser/mattermost, DATASOURCE with sslmode=disable&connect_timeout=10, SITEURL https://${DOMAIN}, uid 2000, tag 11.7.0 (latest ESR)
- Registry config of mattermost-team-edition:11.7.12 (amd64): User mattermost, ports 8065 8067 8074 8075, 5 Volumes, Healthcheck mmctl system status --local 30 s; dirs owned 2000:2000
- mattermost repository: model/config.go at v11.7.12 (ListenAddress :8065, SiteURL http://localhost:8065, MaxOpenConns 100, MaxUsersPerTeam 50, EnableOpenServer false, socket in /var/tmp)
- Woodpecker docs 3.19.x: Docker Compose installation (server and agent, /var/run/docker.sock on the agent, shared WOODPECKER_AGENT_SECRET, example with WOODPECKER_OPEN=true)
- Woodpecker docs 3.19.x: Server configuration (WOODPECKER_OPEN default false, ADMIN, ORGS, PLUGINS_PRIVILEGED, LOG_STORE=database, no data archival and no backups, ports 8000 and 9000)
- Woodpecker docs 3.19.x: Agent configuration (WOODPECKER_MAX_WORKFLOWS default 1, agent.conf in /etc/woodpecker, healthcheck on :3000, gRPC without TLS by default)
- cmd/agent/core/health.go at v3.19.0 (ping requests /healthz on WOODPECKER_HEALTHCHECK_ADDR, default :3000)
- Registry config of woodpecker-server:v3.19.0 (linux/amd64): User woodpecker, ExposedPorts 80, 443, 8000, 9000, no Volumes, Healthcheck CMD woodpecker-server ping
- Registry config of woodpecker-agent:v3.19.0 (linux/amd64): no User (root), ExposedPorts 3000, no Volumes, Healthcheck CMD woodpecker-agent ping
- Flowise docker/docker-compose.yml at [email protected] (flowiseai/flowise:latest, /home/node/.flowise volume, curl /api/v1/ping healthcheck 10s/5s/5 retries/30s)
- Flowise Docs: Databases (SQLite default in ~/.flowise; PostgreSQL via DATABASE_TYPE=postgres; backup steps)
- Flowise Docs: Environment Variables (PORT default 3000, FLOWISE_SECRETKEY_OVERWRITE, storage, security settings)
- Langflow docker_example/docker-compose.yml at v1.12.6 (langflow + postgres:16-trixie, port 7860, /app/langflow volume)
- langflow v1.12.6 docker/build_and_push.Dockerfile: user uid 1000 gid 0, LANGFLOW_PORT 7860, AUTO_LOGIN=false, curl installed, no HEALTHCHECK
- Langflow Docs: Configure an external PostgreSQL database (PostgreSQL 15 or later, LANGFLOW_DATABASE_URL)
- Langflow Docs: Security (code execution platform, no isolation between users or tenants)
- LibreChat v0.8.8 docker-compose.yml: api on 3080 (librechat-data at /app/data), mongo:8.0.20 --noauth, meilisearch v1.35.1, pgvector 0.8.0-pg15-trixie, rag_api lite, admin-panel
- LibreChat v0.8.8 api/server/index.js: GET /health returns 200 OK; PORT defaults to 3080; TRUST_PROXY defaults to 1
- LibreChat docs: Meilisearch (SEARCH=true plus a master key of 16+ bytes shared with the meilisearch service; keep port 7700 internal; reset-meili-sync)
- LibreChat docs: RAG API (lite image = remote embeddings only; OpenAI embeddings by default; RAG_OPENAI_API_KEY needed when OPENAI_API_KEY is user_provided)
- rag_api v0.9.0 app/config.py: RAG_PORT 8000, DB_HOST/DB_PORT/POSTGRES_* settings, RAG_OPENAI_API_KEY falls back to OPENAI_API_KEY, text-embedding-3-small, CHUNK_SIZE 1500, CHUNK_OVERLAP 100
- Docker Official Image mongo: no authentication by default; MONGO_INITDB_ROOT_USERNAME/PASSWORD create a root user and start mongod --auth; mongosh is in the image; data in /data/db
- Meilisearch v1.35.1 Dockerfile: alpine:3.22 with curl and tini, no USER, WORKDIR /meili_data, EXPOSE 7700
- LibreChat v0.8.8 Dockerfile: node:24.16.0-alpine, USER node, creates /app/client/public/images, /app/logs, /app/uploads, /app/data, EXPOSE 3080, CMD npm run backend
- docker/HOW_TO_USE_DOCKER.md at v1.18.0: docker run and Compose example (port 3001, cap_add SYS_ADMIN, STORAGE_DIR, storage volume; at least 2GB RAM, 10GB disk)
- docker/Dockerfile at v1.18.0: USER anythingllm (1000:1000), HEALTHCHECK every 1m (timeout 10s, start period 1m) via docker-healthcheck.sh
- AnythingLLM docs: Deploy to Cloud VM (SYS_ADMIN needed to scrape web pages, SQLite not for horizontal scaling, reverse proxy with WebSocket for agents)
- container/docker-compose.yml at 22c64b8d3: core (searxng, port 8080, /etc/searxng bind mount, /var/cache/searxng volume) + valkey:9-alpine
- container/dist.dockerfile at 22c64b8d3: EXPOSE 8080, GRANIAN_PORT 8080, GRANIAN_BLOCKING_THREADS 4, VOLUME /etc/searxng and /var/cache/searxng, no USER, no HEALTHCHECK
- Qdrant docs: Installation (ports 6333 HTTP / 6334 gRPC / 6335 cluster, example compose with qdrant/qdrant:latest and ./qdrant_data:/qdrant/storage, no NFS or S3)
- Dockerfile at v1.19.2 (debian:13-slim, ARG USER_ID=0 creates /qdrant/storage and /qdrant/snapshots owned by it, EXPOSE 6333 6334, no HEALTHCHECK)
- config/config.yaml at v1.19.2 (storage_path ./storage, snapshots_path ./snapshots, http_port 6333, grpc_port 6334, api_key unset, cluster disabled, telemetry_disabled false)
- Qdrant docs: Security (no authentication and all interfaces by default; QDRANT__SERVICE__API_KEY; TLS; -unprivileged image; /qdrant/storage and /qdrant/snapshots volumes)
- Qdrant docs: Web UI (served by the instance at :6333/dashboard)
- LocalAI v4.11.0 docker-compose.yaml: port 8080, MODELS_PATH=/models, LOCALAI_VRAM_WARM_LIMIT=0, volumes models/backends/configuration/data, command phi-2-chat
- LocalAI docs, Authentication: LOCALAI_API_KEY (full admin access), routes private by default with keys set, /healthz and /readyz anonymous, no restriction without auth
- LocalAI docs, CLI reference: --address :8080, --api-keys ($LOCALAI_API_KEY), --max-active-backends 0 = unlimited, --threads (physical cores suggested)
- activepieces repository: docker-compose.yml at 0.92.3 (app + worker replicas 5 + pgvector/pgvector:0.8.0-pg14 + redis:7.0.7; app 8080:80)
- activepieces repository: .env.example at 0.92.3 (AP_POSTGRES_HOST=postgres, AP_REDIS_HOST=redis, AP_EXECUTION_MODE=UNSANDBOXED)
- Activepieces Docs: Environment variables (AP_ENCRYPTION_KEY 32 hex chars; AP_WORKER_CONCURRENCY 5; retention 30 days; file storage DB)
- activepieces repository: Dockerfile at 0.92.3 (node:24.14.0-bullseye-slim, no USER, HEALTHCHECK curl /api/v1/health, EXPOSE 80)
- jellyfin-packaging: docker/Dockerfile at v12.2-202610051851 (curl, no USER, /config and /cache mode 777, EXPOSE 8096, HEALTHCHECK curl http://localhost:8096/health)
- Jellyfin Docs: Networking (8096/tcp HTTP, 8920/tcp HTTPS off by default, 7359/udp client discovery on the local subnet only; HTTPS best terminated at a reverse proxy)
- Home Assistant Docs: Linux, Install HA Container (Docker Engine 23.0.0+; compose: network_mode: host, privileged: true, /run/dbus:ro, stop_grace_period 60s; UI on 8123; --device mapping)
- Home Assistant Docs: HTTP (Container port stays 8123; UI settings since 2026.8; behind a proxy set Trust X-Forwarded-For and Trusted proxies or requests are blocked; IP banning)
- AdGuard Home KB: Docker (volumes /opt/adguardhome/work and conf; ports 53, 67/68, 80, 443, 3000, 853, 5443, 6060; --network host for client IPs and DHCP; DNSStubListener=no)
- AdGuard Home KB: Getting started (needs 3000/TCP setup, 80/TCP web UI, 53/UDP DNS; wizard on 0.0.0.0:3000; Docker auto-update disabled; setcap; mmap limitation)
- AdguardTeam/AdGuardHome docker/build.Dockerfile at v0.107.79 (alpine:3.23, setcap cap_net_bind_service, dirs owned by nobody, no USER, no HEALTHCHECK, EXPOSE 53…6060)
- AdguardTeam/AdGuardHome internal/home/config.go at v0.107.79 (defaults: web 0.0.0.0:3000, ratelimit 20, cache 4 MiB, query log 90 days, statistics 1 day, AdGuard DNS filter)
- AdGuard Home KB: Encryption (DoH, DoT, DoQ, DNSCrypt; behind a reverse proxy set trusted_proxies to the proxy address)
- authentik repository: compose.yml at version/2026.8.3 (postgres:16-alpine; server and worker on server:2026.8.3, 9000/9443 published, shm_size 512mb, ./data; worker as root with docker.sock)
- authentik Docs: Configuration (PostgreSQL 14 - 18; AUTHENTIK_POSTGRESQL__*; listen 9000, 9443, metrics 9300; trusted proxy CIDRs default to private ranges; storage in /data; secret key signs cookies)
- authentik Docs: Monitoring (/-/health/live/ returns 200 while the server runs, /-/health/ready/ checks PostgreSQL; ak healthcheck in the worker; metrics on 9300)
- Keycloak Docs: Health checks (/health/ready on management port 9000 with health-enabled; no curl in the image; bash /dev/tcp HEALTHCHECK example)
- Keycloak Docs: Management interface (/health and /metrics on port 9000, kept off the main HTTP port)
- Keycloak Docs: Configuring the hostname v2 (hostname as a full URL, http-enabled for edge TLS on 8080, proxy-headers xforwarded)
- Keycloak Docs: Configuring the database (PostgreSQL 18.x to 14.x supported, tested with 18; db-url, db-username, db-password; connection pool)
- Keycloak Docs: Configuring distributed caches (start uses ispn with the jdbc-ping stack; ports 7800 and 57800; local cache only for development)
- keycloak repository: quarkus/container/Dockerfile at 26.8.1 (ubi9-micro, /opt/keycloak owned 1000:0, USER 1000, EXPOSE 8080 8443 9000, ENTRYPOINT kc.sh, no HEALTHCHECK)
- plausible/analytics repository: Dockerfile at v3.2.1 (alpine:3.22.2, user plausible uid 999 in nogroup, /var/lib/plausible world-writable VOLUME, LISTEN_IP 0.0.0.0, EXPOSE 8000, no HEALTHCHECK)
- Plausible CE wiki: Configuration (BASE_URL, SECRET_KEY_BASE ≥ 64 bytes; TOTP_VAULT_KEY optional; DISABLE_REGISTRATION invite_only; HTTP_PORT 8000; database URLs; SMTP)
- ClickHouse repository: Dockerfile.alpine at v24.12.6.70-stable (alpine, busybox wget; clickhouse uid/gid 101; VOLUME /var/lib/clickhouse; EXPOSE 9000 8123 9009; no HEALTHCHECK)
- ClickHouse repository: config.xml at v24.12.6.70-stable (logger trace, 10 × 1000M files; ports 8123, 9000, 9004, 9005, 9009; most system log tables without TTL)
- umami repository: docker-compose.yml at v3.4.0 (umami:latest on 3000, init: true, curl /api/heartbeat healthcheck every 5s; postgres:15-alpine with umami/umami and /var/lib/postgresql/data)
- umami repository: Dockerfile at v3.4.0 (node:22-alpine, apk add curl, user nextjs uid 1001, USER nextjs, EXPOSE 3000, HOSTNAME 0.0.0.0, CMD sh scripts/start-docker.sh, no HEALTHCHECK)
- TryGhost/ghost-docker compose.yml at 5109c70 (caddy on 80/443, ghost:${GHOST_VERSION:-6-alpine} with env_file .env, mysql:8.0.44 with mysqladmin ping healthcheck, analytics and activitypub profiles)
- TryGhost/ghost-docker caddy/Caddyfile.example at 5109c70 (reverse_proxy ghost:2368, imports the ActivityPub, TrafficAnalytics and SecurityHeaders snippets)
- TryGhost/docker-library-ghost 6/alpine3.23 Dockerfile at f3d7eab (node:22-alpine3.23, GHOST_VERSION 6.70.0, content in /var/lib/ghost/content, EXPOSE 2368, no HEALTHCHECK, no USER)
- docker-library/mysql 8.4 Dockerfile.oracle at 01f90d8 (MYSQL_VERSION 8.4.11, mysql uid/gid 999, gosu, VOLUME /var/lib/mysql, EXPOSE 3306 33060, no HEALTHCHECK)