Port Map

Every row comes from an app profile in the ANAROQ catalog, with its sources on the app's page. Public ports are meant to be reached from outside the stack, usually through a reverse proxy; internal ones stay on the stack's own Docker network.

Two apps on one server can each keep an internal port of the same number: separate Compose stacks have separate networks. A clash happens when two apps want the same port on the host, which is what publishing a public port directly does.

Ports that more than one app uses

The same port number and protocol in two or more apps. Running those apps on one server is still possible; this says what to change.

• 80/tcp Clash if published directly

  Coolify (Public, through a proxy), Dify (Public, through a proxy), WordPress (Public, through a proxy), Nextcloud (Public, through a proxy), Vaultwarden (Public, through a proxy), BookStack (Public, through a proxy), Activepieces (Public, through a proxy), AdGuard Home (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 443/tcp Clash if published directly

  Coolify (Public, through a proxy), Dify (Public, through a proxy), BookStack (Internal only), AdGuard Home (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 443/udp Clash if published directly

  Coolify (Public, through a proxy), BookStack (Internal only), AdGuard Home (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 3000/tcp Clash if published directly

  Dify (Internal only), Gitea (Public, through a proxy), Paperless-ngx (Internal only), Outline (Public, through a proxy), Linkwarden (Public, through a proxy), Grafana (Public, through a proxy), Woodpecker CI (Internal only), Flowise (Public, through a proxy), AdGuard Home (Internal only), Umami (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 3001/tcp Clash if published directly

  Uptime Kuma (Public, through a proxy), AnythingLLM (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 3306/tcp Same number, no clash while internal

  WordPress (Internal only), BookStack (Internal only), Ghost (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

• 5432/tcp Same number, no clash while internal

  n8n (Internal only), PostgreSQL (Internal only), Dify (Internal only), Gitea (Internal only), Nextcloud (Internal only), Immich (Internal only), Paperless-ngx (Internal only), Outline (Internal only), Mealie (Internal only), Linkwarden (Internal only), Grafana (Internal only), Mattermost (Internal only), Flowise (Internal only), Langflow (Internal only), LibreChat (Internal only), Activepieces (Internal only), authentik (Internal only), Keycloak (Internal only), Plausible Community Edition (Internal only), Umami (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

• 6379/tcp Same number, no clash while internal

  n8n (Internal only), Dify (Internal only), WordPress (Internal only), Nextcloud (Internal only), Immich (Internal only), Paperless-ngx (Internal only), Outline (Internal only), Valkey (Internal only), Activepieces (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

• 7700/tcp Same number, no clash while internal

  Linkwarden (Internal only), LibreChat (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

• 8000/tcp Clash if published directly

  Paperless-ngx (Public, through a proxy), Portainer CE (Public, through a proxy), Woodpecker CI (Public, through a proxy), LibreChat (Internal only), Plausible Community Edition (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 8080/tcp Clash if published directly

  Coolify (Public, through a proxy), Dify (Internal only), Open WebUI (Public, through a proxy), SearXNG (Public, through a proxy), LocalAI (Public, through a proxy), Keycloak (Public, through a proxy)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 8123/tcp Same number, no clash while internal

  Home Assistant (Public, through a proxy), Plausible Community Edition (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

• 9000/tcp Clash if published directly

  Mealie (Public, through a proxy), Portainer CE (Internal only), Woodpecker CI (Internal only), authentik (Public, through a proxy), Keycloak (Internal only), Plausible Community Edition (Internal only)

  At least two of these apps expose the port publicly. Only one can bind it on the host: put the apps behind one reverse proxy, or publish one of them on a different host port.

• 9443/tcp Same number, no clash while internal

  Portainer CE (Public, through a proxy), authentik (Internal only)

  At most one of these apps exposes the port; the others keep it inside their own stack. Don't publish the internal ones to the host.

Sources

• n8n Docs: Install with Docker (current stable 2.42.6, port 5678, .n8n volume)
• n8n-hosting: docker-compose/withPostgres (n8n + postgres + n8nio/runners)
• n8n-hosting: docker-compose/withPostgresAndWorker (queue mode with Redis and worker)
• n8n Docs: Enable queue mode (Redis, workers, concurrency 10, relay size 64 MiB)
• n8n Docs: Queue mode environment variables (QUEUE_HEALTH_CHECK_PORT)
• n8n Docs: Choose n8n's database (SQLite default, PostgreSQL 16-18)
• n8n Docs: Task runner environment variables (broker port 5679, max concurrency 5)
• n8n Docs: Deployment environment variables (N8N_PORT, N8N_ENCRYPTION_KEY)
• n8n Docs: Set up SSL (reverse proxy recommended)
• PostgreSQL 18 documentation: 19.3 Connections and Authentication
• docker-library/postgres: 18/trixie Dockerfile (PGDATA, VOLUME, EXPOSE 5432)
• coollabsio/coolify docker-compose.prod.yml (main)
• coollabsio/coolify bootstrap/helpers/proxy.php (coolify-proxy Traefik definition)
• Coolify Docs: Migrate realtime services to Reverb
• Coolify Docs: Firewall
• Dify docs: Environment Variables
• Dify 1.17.1 docker/docker-compose.yaml
• Dify 1.17.1 docker/.env.example (default COMPOSE_PROFILES, workers, passwords)
• Dify 1.17.1 docker/nginx/conf.d/default.conf.template (upstream ports)
• Open WebUI docker-compose.yaml (open-webui + ollama, volumes, ports)
• Open WebUI README: Docker install, port 8080, /app/backend/data volume
• Ollama Docker: CPU-only run command, /root/.ollama volume, port 11434
• Ollama API authentication: the local API on port 11434 requires none
• Docker Official Image wordpress: documentation
• Docker Official Image wordpress: example compose.yaml
• Docker Official Image mariadb: documentation
• redis/docker-library-redis v8.10.2: debian Dockerfile
• Uptime Kuma README (install, NFS warning, features incl. 2FA)
• Official compose.yaml at tag 2.5.6
• docker/dockerfile at tag 2.5.6 (EXPOSE 3001, healthcheck)
• Uptime Kuma wiki: Reverse Proxy (WebSocket headers, HTTPS, no subdirectory)
• Gitea docs: Installation with Docker (docker-compose.yml, SQLite/PostgreSQL)
• nextcloud/docker README: volumes, auto configuration (POSTGRES_*, NEXTCLOUD_ADMIN_*, NEXTCLOUD_DATA_DIR, NEXTCLOUD_TRUSTED_DOMAINS, NEXTCLOUD_UPDATE), Redis, proxy, upgrades
• nextcloud/docker .examples insecure/postgres/apache compose.yaml (postgres, redis, nextcloud:apache on 127.0.0.1:8080:80, cron service running /cron.sh on the same html volume)
• nextcloud/docker 35/apache Dockerfile (php:8.5-apache-trixie, 35.0.1, crontab */5 cron.php, remoteip X-Real-IP from private ranges, /var/www/data, VOLUME /var/www/html, no HEALTHCHECK)
• nextcloud/docker 35/apache config/redis.config.php (REDIS_HOST sets memcache.distributed and memcache.locking to Redis)
• Docker Official Image postgres: documentation (docker-library/docs)
• immich repository: docker/docker-compose.yml at v3.3.3 (server 2283:2283, machine-learning, valkey/valkey:9, ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0, shm_size 128mb)
• immich repository: server/Dockerfile at v3.3.3 (no USER, VOLUME /data, EXPOSE 2283, HEALTHCHECK immich-healthcheck)
• valkey-io/valkey-container: 9.1/debian Dockerfile (VALKEY_VERSION 9.1.2, valkey uid/gid 999, WORKDIR /data, EXPOSE 6379, valkey-cli)
• Immich Docs: Environment variables (DB_* and REDIS_* defaults, IMMICH_PORT 2283 / 3003, MACHINE_LEARNING_MODEL_TTL 300 s, DB_STORAGE_TYPE)
• Immich Docs: Remote machine learning (the ML container has no security measures; it receives image previews and keeps nothing)
• Immich Docs: Config file (default ML URL http://immich-machine-learning:3003, CLIP ViT-B-32__openai, faces buffalo_l, OCR PP-OCRv5_mobile, database dump daily 02:00, keep 14)
• docker-library/postgres: 14/bookworm Dockerfile (postgres uid/gid 999, PGDATA and VOLUME /var/lib/postgresql/data)
• paperless-ngx repository: docker/compose/docker-compose.postgres.yml at v3.3.1 (webserver 8000:8000, postgres:18, valkey/valkey:9-alpine, data/media volumes, ./export and ./consume)
• paperless-ngx repository: docker/compose/docker-compose.postgres-tika.yml at v3.3.1 (adds gotenberg:8.37 with JavaScript disabled and apache/tika:3.3.1.0)
• paperless-ngx repository: s6 svc-webserver run script at v3.3.1 (granian on port 8000, 1 worker, s6-setuidgid paperless)
• Paperless-ngx docs (v3.3.1): Configuration (TASK_WORKERS 1, THREADS_PER_WORKER, WEBSERVER_WORKERS 1, SECRET_KEY required, ADMIN_USER, Tika, OCR languages)
• paperless-ngx repository: Dockerfile at v3.3.1 (user paperless 1000:1000, VOLUME data/media/consume/export, EXPOSE 8000, HEALTHCHECK curl localhost:8000 every 30 s)
• valkey-io/valkey-container: 9.1/alpine Dockerfile (9.1.2; user valkey uid 999 gid 1000; WORKDIR /data; EXPOSE 6379; valkey-cli)
• Gotenberg Docs: Installation (port 3000; non-root user gotenberg 1001; demo on 512 MB / 0.5 CPU; allocate at least 1Gi of memory on Cloud Run)
• apache/tika-docker README (Tika Server on port 9998; minimal and full images; bind to localhost)
• Vaultwarden README at 1.37.4: web vault needs HTTPS (secure context), docker run and compose examples (DOMAIN, /data, 127.0.0.1:8000:80), disclaimer
• docker/Dockerfile.debian at 1.37.4: ROCKET_ADDRESS 0.0.0.0, ROCKET_PORT 80, VOLUME /data, EXPOSE 80, no USER, HEALTHCHECK --interval=60s --timeout=10s CMD /healthcheck.sh
• Vaultwarden wiki: Enabling WebSocket notifications (on the main HTTP port since 1.29/1.31; mobile apps use push instead)
• BookStack devops: lsio-docker/docker-compose.yml (linuxserver bookstack + mariadb, APP_URL, APP_KEY, DB_*, /config volume, 6875:80)
• linuxserver/docker-bookstack README at e6221fc (default admin login, env vars, /config path mapping, QUEUE_CONNECTION, changelog)
• linuxserver/docker-bookstack Dockerfile at e6221fc (alpine-nginx base, PHP 8.5, memcached, /config symlinks, EXPOSE 80 443, VOLUME /config, no HEALTHCHECK)
• linuxserver/docker-baseimage-alpine-nginx 3.24: default site conf (listen 80, 443 ssl and 443 quic)
• linuxserver/docker-baseimage-alpine-nginx 3.24 init-keygen/run: self-signed certificate in /config/keys
• linuxserver/docker-bookstack svc-memcached/run: memcached -u abc with default options
• memcached(1) man page: -m default 64 MB, -p TCP port default 11211, -l default INADDR_ANY
• BookStack v26.09.1 .env.example.complete (CACHE_DRIVER file, QUEUE_CONNECTION sync, REVISION_LIMIT 100, RECYCLE_BIN_LIFETIME 30, FILE_UPLOAD_SIZE_LIMIT 50, ALLOWED_SSR_HOSTS *)
• Outline hosting docs: Docker (Compose example with outline, redis, postgres:18 at /var/lib/postgresql, https-portal; migrations run on start)
• outline repository: .env.sample at v1.11.0 (URL, PORT 3000, SECRET_KEY hex 32 bytes, UTILS_SECRET, FILE_STORAGE=local, upload max 262144000, PGSSLMODE)
• outline repository: server/env.ts at v1.11.0 (SECRET_KEY 64 hex chars; DATABASE_HOST/PORT/NAME/USER/PASSWORD; SERVICES default; FORCE_HTTPS; SMTP_*; upload max default 1,000,000 B)
• outline repository: Dockerfile at v1.11.0 (node:26.3.0-slim, USER nodejs uid 1001, VOLUME /var/lib/outline/data, wget, HEALTHCHECK /_health every 1m, EXPOSE 3000)
• Outline hosting docs: Redis (a single Redis server via REDIS_URL, e.g. redis://redis:6379)
• redis/docker-library-redis v7.4.11: debian Dockerfile (redis uid/gid 999, VOLUME /data, EXPOSE 6379, redis-cli)
• Mealie Docs: Installing with SQLite (compose: v3.28.0, 9925:9000, memory limit 1000M, /app/data, ALLOW_SIGNUP false, PUID/PGID, TZ, BASE_URL; 1-20 users)
• Mealie Docs: Installing with PostgreSQL (compose with postgres:17, DB_ENGINE and POSTGRES_* variables, many concurrent users)
• Mealie Docs: Backend Configuration (PUID/PGID 911, BASE_URL, TZ, ALLOW_SIGNUP, DB_ENGINE, UVICORN_WORKERS 1, API_PORT 9000)
• mealie v3.28.0 docker/Dockerfile (user abc uid 911, VOLUME /app/data, APP_PORT 9000, HEALTHCHECK healthcheck.sh, curl and gosu installed)
• linkwarden repository: docker-compose.yml at v2.16.3 (postgres:16-alpine, linkwarden:latest on 3000 with ./data:/data/data, getmeili/meilisearch:v1.13.3; env_file .env for all three)
• linkwarden repository: Dockerfile at v2.16.3 (node:22.23-bookworm-slim, no USER, Chromium headless shell, prisma migrate deploy at start, HEALTHCHECK curl http://127.0.0.1:3000/, EXPOSE 3000)
• linkwarden repository: packages/lib/meilisearchClient.ts at v2.16.3 (client only when MEILI_MASTER_KEY is set; MEILI_HOST default http://meilisearch:7700)
• meilisearch repository: Dockerfile at v1.13.3 (alpine:3.20 with curl, no USER, WORKDIR /meili_data, EXPOSE 7700, no HEALTHCHECK)
• Grafana docs at v13.2.4: Run Grafana Docker image (compose: restart unless-stopped, '3000:3000', named volume at /var/lib/grafana, GF_SERVER_ROOT_URL, GF_PLUGINS_PREINSTALL)
• Grafana docs at v13.2.4: Configure Grafana (GF_<SECTION>_<KEY> overrides; root_url, database, max_open_conn, reporting_enabled, admin_password set once on first run, secret_key, cookie_secure)
• conf/defaults.ini at v13.2.4: http_port 3000, sqlite3 grafana.db, max_open_conn unset, reporting_enabled true, sign-up and anonymous off, public default secret_key, annotations kept forever
• Dockerfile at v13.2.4: Alpine image with curl, GF_UID 472 and GF_GID 0, /var/lib/grafana owned by grafana and mode 777, EXPOSE 3000, USER 472, no HEALTHCHECK, no VOLUME
• Dockerfile at v3.13.4 (busybox): prometheus.yml in /etc/prometheus, both dirs chowned to nobody, USER nobody, EXPOSE 9090, VOLUME /prometheus, CMD --config.file --storage.tsdb.path, no HEALTHCHECK
• Registry config and layers of prom/prometheus:v3.13.4 (linux/amd64): User nobody (65534:65534), ExposedPorts 9090/tcp, Volumes /prometheus, no Healthcheck; busybox wget, sh and vi present
• Prometheus docs: Security model (HTTP endpoints must not face the internet; anyone with HTTP access reads all series; admin API and lifecycle off by default)
• Prometheus 3.13 docs: prometheus command line (--web.listen-address 0.0.0.0:9090, retention flags deprecated in favour of the config file, --query.max-samples 50000000, --query.max-concurrency 20)
• cmd/loki/loki-docker-config.yaml at v3.7.8 (the image's default config): auth_enabled false, http 3100, path_prefix /loki, filesystem chunks, tsdb v13 with 24h index
• Loki configuration reference at v3.7.8: grpc_listen_port 9095, retention_enabled false, retention_period 0s (-store.retention), reporting_enabled true, ingestion and chunk defaults
• Loki HTTP API reference at v3.7.8: POST /loki/api/v1/push, POST /otlp/v1/logs, GET /ready (HTTP 200 when ready for traffic)
• Loki docs at v3.7.8: Manage authentication (no built-in authentication layer; run an authenticating reverse proxy in front)
• Portainer docs: Install Portainer CE with Docker on Linux (docker.sock and portainer_data mounts, 9443 HTTPS self-signed, 8000 only for Edge, 9000 legacy HTTP)
• Portainer docs: Requirements and prerequisites (Community 2.45.2 LTS tested with Docker 28.5.1 and 29.8.1; ports 9443, 8000, agent 9001; Git stacks cloned to the data volume)
• Portainer docs: CLI configuration options (--bind default :9000, --bind-https :9443, --http-disabled, --tunnel-port, --snapshot-interval, --data /data)
• portainer/portainer api/cli/defaults.go at 2.45.2 (bind :9000, bind-https :9443, tunnel port 8000, data /data)
• portainer/portainer api/datastore/init.go at 2.45.2 (new database: SSL settings with HTTPEnabled true, so HTTP on 9000 listens until disabled)
• SeaweedFS wiki: Quick Start with weed mini (docker run with /data, AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, S3_BUCKET; no keys = Allow All; -s3.externalUrl behind a proxy)
• weed/command/mini.go at 4.48: ports 8333/9333/9340/8888/23646 (gRPC +10000), -webdav, -admin.ui, -s3.port.iceberg/lance, -master.telemetry (on), auto volume size
• weed/s3api/s3api_server.go at 4.48: /status, /healthz and /readyz probes; -domainName for virtual-host style; a host-less path-style route always registered
• weed/admin/handlers/admin_handlers.go at 4.48: /health and /metrics without auth; with the UI disabled no other route; without a password every UI and /api route is public
• SeaweedFS wiki: Security Overview (master HTTP unsecured; filer HTTP and volume writes secured only with JWT keys; gRPC with mutual TLS)
• SeaweedFS wiki: Admin UI (adminPassword enables login; worker gRPC has no password auth; WEED_ADMIN_* env vars)
• Docker Hub valkey/valkey description: protected mode off (set a password before exposing 6379), /data for persistence, start flags through VALKEY_EXTRA_FLAGS
• Registry config of valkey/valkey:9.1.2 (linux/amd64): no User, ExposedPorts 6379/tcp, no Volumes, no Healthcheck, Entrypoint tini -- docker-entrypoint.sh, Cmd valkey-server, WorkingDir /data
• mattermost/docker docker-compose.without-nginx.yml: publishes APP_PORT:8065 and the Calls port 8443 over udp and tcp
• mattermost/docker env.example: postgres 18-alpine, mmuser/mattermost, DATASOURCE with sslmode=disable&connect_timeout=10, SITEURL https://${DOMAIN}, uid 2000, tag 11.7.0 (latest ESR)
• Registry config of mattermost-team-edition:11.7.12 (amd64): User mattermost, ports 8065 8067 8074 8075, 5 Volumes, Healthcheck mmctl system status --local 30 s; dirs owned 2000:2000
• mattermost repository: model/config.go at v11.7.12 (ListenAddress :8065, SiteURL http://localhost:8065, MaxOpenConns 100, MaxUsersPerTeam 50, EnableOpenServer false, socket in /var/tmp)
• Woodpecker docs 3.19.x: Docker Compose installation (server and agent, /var/run/docker.sock on the agent, shared WOODPECKER_AGENT_SECRET, example with WOODPECKER_OPEN=true)
• Woodpecker docs 3.19.x: Server configuration (WOODPECKER_OPEN default false, ADMIN, ORGS, PLUGINS_PRIVILEGED, LOG_STORE=database, no data archival and no backups, ports 8000 and 9000)
• Woodpecker docs 3.19.x: Agent configuration (WOODPECKER_MAX_WORKFLOWS default 1, agent.conf in /etc/woodpecker, healthcheck on :3000, gRPC without TLS by default)
• cmd/agent/core/health.go at v3.19.0 (ping requests /healthz on WOODPECKER_HEALTHCHECK_ADDR, default :3000)
• Registry config of woodpecker-server:v3.19.0 (linux/amd64): User woodpecker, ExposedPorts 80, 443, 8000, 9000, no Volumes, Healthcheck CMD woodpecker-server ping
• Registry config of woodpecker-agent:v3.19.0 (linux/amd64): no User (root), ExposedPorts 3000, no Volumes, Healthcheck CMD woodpecker-agent ping
• Flowise docker/docker-compose.yml at [email protected] (flowiseai/flowise:latest, /home/node/.flowise volume, curl /api/v1/ping healthcheck 10s/5s/5 retries/30s)
• Flowise Docs: Databases (SQLite default in ~/.flowise; PostgreSQL via DATABASE_TYPE=postgres; backup steps)
• Flowise Docs: Environment Variables (PORT default 3000, FLOWISE_SECRETKEY_OVERWRITE, storage, security settings)
• Langflow docker_example/docker-compose.yml at v1.12.6 (langflow + postgres:16-trixie, port 7860, /app/langflow volume)
• langflow v1.12.6 docker/build_and_push.Dockerfile: user uid 1000 gid 0, LANGFLOW_PORT 7860, AUTO_LOGIN=false, curl installed, no HEALTHCHECK
• Langflow Docs: Configure an external PostgreSQL database (PostgreSQL 15 or later, LANGFLOW_DATABASE_URL)
• Langflow Docs: Security (code execution platform, no isolation between users or tenants)
• LibreChat v0.8.8 docker-compose.yml: api on 3080 (librechat-data at /app/data), mongo:8.0.20 --noauth, meilisearch v1.35.1, pgvector 0.8.0-pg15-trixie, rag_api lite, admin-panel
• LibreChat v0.8.8 api/server/index.js: GET /health returns 200 OK; PORT defaults to 3080; TRUST_PROXY defaults to 1
• LibreChat docs: Meilisearch (SEARCH=true plus a master key of 16+ bytes shared with the meilisearch service; keep port 7700 internal; reset-meili-sync)
• LibreChat docs: RAG API (lite image = remote embeddings only; OpenAI embeddings by default; RAG_OPENAI_API_KEY needed when OPENAI_API_KEY is user_provided)
• rag_api v0.9.0 app/config.py: RAG_PORT 8000, DB_HOST/DB_PORT/POSTGRES_* settings, RAG_OPENAI_API_KEY falls back to OPENAI_API_KEY, text-embedding-3-small, CHUNK_SIZE 1500, CHUNK_OVERLAP 100
• Docker Official Image mongo: no authentication by default; MONGO_INITDB_ROOT_USERNAME/PASSWORD create a root user and start mongod --auth; mongosh is in the image; data in /data/db
• Meilisearch v1.35.1 Dockerfile: alpine:3.22 with curl and tini, no USER, WORKDIR /meili_data, EXPOSE 7700
• LibreChat v0.8.8 Dockerfile: node:24.16.0-alpine, USER node, creates /app/client/public/images, /app/logs, /app/uploads, /app/data, EXPOSE 3080, CMD npm run backend
• docker/HOW_TO_USE_DOCKER.md at v1.18.0: docker run and Compose example (port 3001, cap_add SYS_ADMIN, STORAGE_DIR, storage volume; at least 2GB RAM, 10GB disk)
• docker/Dockerfile at v1.18.0: USER anythingllm (1000:1000), HEALTHCHECK every 1m (timeout 10s, start period 1m) via docker-healthcheck.sh
• AnythingLLM docs: Deploy to Cloud VM (SYS_ADMIN needed to scrape web pages, SQLite not for horizontal scaling, reverse proxy with WebSocket for agents)
• container/docker-compose.yml at 22c64b8d3: core (searxng, port 8080, /etc/searxng bind mount, /var/cache/searxng volume) + valkey:9-alpine
• container/dist.dockerfile at 22c64b8d3: EXPOSE 8080, GRANIAN_PORT 8080, GRANIAN_BLOCKING_THREADS 4, VOLUME /etc/searxng and /var/cache/searxng, no USER, no HEALTHCHECK
• Qdrant docs: Installation (ports 6333 HTTP / 6334 gRPC / 6335 cluster, example compose with qdrant/qdrant:latest and ./qdrant_data:/qdrant/storage, no NFS or S3)
• Dockerfile at v1.19.2 (debian:13-slim, ARG USER_ID=0 creates /qdrant/storage and /qdrant/snapshots owned by it, EXPOSE 6333 6334, no HEALTHCHECK)
• config/config.yaml at v1.19.2 (storage_path ./storage, snapshots_path ./snapshots, http_port 6333, grpc_port 6334, api_key unset, cluster disabled, telemetry_disabled false)
• Qdrant docs: Security (no authentication and all interfaces by default; QDRANT__SERVICE__API_KEY; TLS; -unprivileged image; /qdrant/storage and /qdrant/snapshots volumes)
• Qdrant docs: Web UI (served by the instance at :6333/dashboard)
• LocalAI v4.11.0 docker-compose.yaml: port 8080, MODELS_PATH=/models, LOCALAI_VRAM_WARM_LIMIT=0, volumes models/backends/configuration/data, command phi-2-chat
• LocalAI docs, Authentication: LOCALAI_API_KEY (full admin access), routes private by default with keys set, /healthz and /readyz anonymous, no restriction without auth
• LocalAI docs, CLI reference: --address :8080, --api-keys ($LOCALAI_API_KEY), --max-active-backends 0 = unlimited, --threads (physical cores suggested)
• activepieces repository: docker-compose.yml at 0.92.3 (app + worker replicas 5 + pgvector/pgvector:0.8.0-pg14 + redis:7.0.7; app 8080:80)
• activepieces repository: .env.example at 0.92.3 (AP_POSTGRES_HOST=postgres, AP_REDIS_HOST=redis, AP_EXECUTION_MODE=UNSANDBOXED)
• Activepieces Docs: Environment variables (AP_ENCRYPTION_KEY 32 hex chars; AP_WORKER_CONCURRENCY 5; retention 30 days; file storage DB)
• activepieces repository: Dockerfile at 0.92.3 (node:24.14.0-bullseye-slim, no USER, HEALTHCHECK curl /api/v1/health, EXPOSE 80)
• jellyfin-packaging: docker/Dockerfile at v12.2-202610051851 (curl, no USER, /config and /cache mode 777, EXPOSE 8096, HEALTHCHECK curl http://localhost:8096/health)
• Jellyfin Docs: Networking (8096/tcp HTTP, 8920/tcp HTTPS off by default, 7359/udp client discovery on the local subnet only; HTTPS best terminated at a reverse proxy)
• Home Assistant Docs: Linux, Install HA Container (Docker Engine 23.0.0+; compose: network_mode: host, privileged: true, /run/dbus:ro, stop_grace_period 60s; UI on 8123; --device mapping)
• Home Assistant Docs: HTTP (Container port stays 8123; UI settings since 2026.8; behind a proxy set Trust X-Forwarded-For and Trusted proxies or requests are blocked; IP banning)
• AdGuard Home KB: Docker (volumes /opt/adguardhome/work and conf; ports 53, 67/68, 80, 443, 3000, 853, 5443, 6060; --network host for client IPs and DHCP; DNSStubListener=no)
• AdGuard Home KB: Getting started (needs 3000/TCP setup, 80/TCP web UI, 53/UDP DNS; wizard on 0.0.0.0:3000; Docker auto-update disabled; setcap; mmap limitation)
• AdguardTeam/AdGuardHome docker/build.Dockerfile at v0.107.79 (alpine:3.23, setcap cap_net_bind_service, dirs owned by nobody, no USER, no HEALTHCHECK, EXPOSE 53…6060)
• AdguardTeam/AdGuardHome internal/home/config.go at v0.107.79 (defaults: web 0.0.0.0:3000, ratelimit 20, cache 4 MiB, query log 90 days, statistics 1 day, AdGuard DNS filter)
• AdGuard Home KB: Encryption (DoH, DoT, DoQ, DNSCrypt; behind a reverse proxy set trusted_proxies to the proxy address)
• authentik repository: compose.yml at version/2026.8.3 (postgres:16-alpine; server and worker on server:2026.8.3, 9000/9443 published, shm_size 512mb, ./data; worker as root with docker.sock)
• authentik Docs: Configuration (PostgreSQL 14 - 18; AUTHENTIK_POSTGRESQL__*; listen 9000, 9443, metrics 9300; trusted proxy CIDRs default to private ranges; storage in /data; secret key signs cookies)
• authentik Docs: Monitoring (/-/health/live/ returns 200 while the server runs, /-/health/ready/ checks PostgreSQL; ak healthcheck in the worker; metrics on 9300)
• Keycloak Docs: Health checks (/health/ready on management port 9000 with health-enabled; no curl in the image; bash /dev/tcp HEALTHCHECK example)
• Keycloak Docs: Management interface (/health and /metrics on port 9000, kept off the main HTTP port)
• Keycloak Docs: Configuring the hostname v2 (hostname as a full URL, http-enabled for edge TLS on 8080, proxy-headers xforwarded)
• Keycloak Docs: Configuring the database (PostgreSQL 18.x to 14.x supported, tested with 18; db-url, db-username, db-password; connection pool)
• Keycloak Docs: Configuring distributed caches (start uses ispn with the jdbc-ping stack; ports 7800 and 57800; local cache only for development)
• keycloak repository: quarkus/container/Dockerfile at 26.8.1 (ubi9-micro, /opt/keycloak owned 1000:0, USER 1000, EXPOSE 8080 8443 9000, ENTRYPOINT kc.sh, no HEALTHCHECK)
• plausible/analytics repository: Dockerfile at v3.2.1 (alpine:3.22.2, user plausible uid 999 in nogroup, /var/lib/plausible world-writable VOLUME, LISTEN_IP 0.0.0.0, EXPOSE 8000, no HEALTHCHECK)
• Plausible CE wiki: Configuration (BASE_URL, SECRET_KEY_BASE ≥ 64 bytes; TOTP_VAULT_KEY optional; DISABLE_REGISTRATION invite_only; HTTP_PORT 8000; database URLs; SMTP)
• ClickHouse repository: Dockerfile.alpine at v24.12.6.70-stable (alpine, busybox wget; clickhouse uid/gid 101; VOLUME /var/lib/clickhouse; EXPOSE 9000 8123 9009; no HEALTHCHECK)
• ClickHouse repository: config.xml at v24.12.6.70-stable (logger trace, 10 × 1000M files; ports 8123, 9000, 9004, 9005, 9009; most system log tables without TTL)
• umami repository: docker-compose.yml at v3.4.0 (umami:latest on 3000, init: true, curl /api/heartbeat healthcheck every 5s; postgres:15-alpine with umami/umami and /var/lib/postgresql/data)
• umami repository: Dockerfile at v3.4.0 (node:22-alpine, apk add curl, user nextjs uid 1001, USER nextjs, EXPOSE 3000, HOSTNAME 0.0.0.0, CMD sh scripts/start-docker.sh, no HEALTHCHECK)
• TryGhost/ghost-docker compose.yml at 5109c70 (caddy on 80/443, ghost:${GHOST_VERSION:-6-alpine} with env_file .env, mysql:8.0.44 with mysqladmin ping healthcheck, analytics and activitypub profiles)
• TryGhost/ghost-docker caddy/Caddyfile.example at 5109c70 (reverse_proxy ghost:2368, imports the ActivityPub, TrafficAnalytics and SecurityHeaders snippets)
• TryGhost/docker-library-ghost 6/alpine3.23 Dockerfile at f3d7eab (node:22-alpine3.23, GHOST_VERSION 6.70.0, content in /var/lib/ghost/content, EXPOSE 2368, no HEALTHCHECK, no USER)
• docker-library/mysql 8.4 Dockerfile.oracle at 01f90d8 (MYSQL_VERSION 8.4.11, mysql uid/gid 999, gosu, VOLUME /var/lib/mysql, EXPOSE 3306 33060, no HEALTHCHECK)