Install

Install Dockify

One command on a fresh Ubuntu server. It asks for your dashboard's domain, sets up HTTPS and prints a one-time setup link.

curl -fsSL https://dockify.sh/install.sh | sh

Want to see the plan first? This dry run changes nothing on the server. It still reads your Cloudflare account and needs jq and openssl already installed, so on a fresh server it can stop early.

curl -fsSL https://dockify.sh/install.sh | sh -s -- --dry-run

Dockify 1.0.1 is released. The command installs the newest signed release: it checks the feed’s signature against the pinned key, then pulls the images by digest. See the signed release.

You need

Server: A fresh Ubuntu 22.04 or 24.04 server, amd64 or arm64.
Access: Root or sudo over SSH. The installer turns the ufw firewall on with incoming traffic denied. If SSH listens on a port other than 22, allow it first with sudo ufw allow <port>/tcp, or pass --no-ufw.
Hostname: A hostname for the dashboard, for example dockify.example.com.
Ingress: Your own domain for real use. To try it first: ports 80 and 443 free, and the dashboard starts on a temporary sslip.io address. For a Cloudflare tunnel, a domain and an API token with Zone DNS Edit and Cloudflare Tunnel Edit.
Size: Tested on 2 vCPU, 4 GB of memory and 49 GB of disk (Ubuntu 22.04). Leave room for your apps and their builds: BuildKit alone may use up to 4 GB while building.

What the script does, in order

Each step names the files and services it adds to your server.

Step 1. Checks the OS, your access, the architecture and free ports.
It also stops if Dockify is already installed.
02
Step 2. Turns on automatic security updates and sets up the firewall.
The firewall denies incoming traffic and allows SSH, plus 80 and 443 in direct mode. Skip it with --no-ufw.
- /etc/apt/apt.conf.d/20auto-upgrades
- /etc/apt/apt.conf.d/52dockify-docker
- ufw
03
Step 3. Installs Docker from Docker's signed repository if it is missing.
- /etc/apt/keyrings/docker.asc
- /etc/apt/sources.list.d/docker.list
Step 4. Refuses a container runtime with known escape bugs.
An old runc or containerd stops the install until it is updated.
05
Step 5. Blocks containers from cloud metadata addresses and from reaching the host.
The rules come back after every reboot.
- /usr/local/sbin/dockify-firewall
- dockify-firewall.service
06
Step 6. Creates a new Cloudflare tunnel just for Dockify. It never reuses or deletes yours.
The dashboard record is a CNAME with the comment "managed by Dockify". An existing record is only replaced with --replace-dns.
- tunnel dockify-<host>-<id>
- CNAME for --domain
Step 7. Verifies the signed release and pulls images by digest.
The manifest is checked with minisign against a pinned public key.
08
Step 8. Writes secrets with generated values and starts the stack.
- /opt/dockify/.env
- /opt/dockify/secrets/
- /opt/dockify/release/
- /opt/dockify/uninstall.sh
- /usr/local/bin/dockify
Step 9. Prints your setup link and a one-time setup token.
It waits until the API answers its readiness check first.

Then

Open the link, paste the token, create your account. The dashboard is on HTTPS from the first minute, and in tunnel mode Dockify opens no inbound port; only SSH stays open. Nobody who finds your server first can claim it.

Back up the master key. It is at /opt/dockify/secrets/master_key. Without it, every stored secret and backup is unreadable.

Flags

Every flag in the header of install.sh. Pass them through the pipe after sh -s --.

--domain HOST: Dashboard hostname. Omitted: asked for on the terminal; Enter, or no terminal, starts on a temporary sslip.io address.
--ingress tunnel|direct: How traffic reaches the server. Default tunnel with --domain, direct on sslip.io.
--cf-token-file PATH: Cloudflare API token. Asked for when omitted and a terminal is attached.
--cf-account-id ID: Required when the token sees more than one account.
--replace-dns: Allow replacing an existing CNAME for --domain. Never other record types.
--acme-email EMAIL: Let's Encrypt account in direct mode. Omitted: asked for on the terminal; Enter, or no terminal, registers dockify@ the dashboard host.
--dir PATH: Install folder. Default /opt/dockify.
--release-feed URL: Signed feed base, https only. The manifest is URL/releases/stable.json.
--release-pubkey KEY: minisign public key, if not the pinned one.
--control-image REF --web-image REF: Run these digest-pinned images instead of the feed. Self-update then needs a feed and key too.
--no-ufw: Leave the host firewall alone.
--allow-vulnerable-runtime: Warn instead of refusing on an old runc or containerd.
--from-checkout: Take docker-compose.yml and the socket proxy config from the repository this script sits in, which must be root's alone.
--dry-run: Print the plan and change nothing. See the note under the command above.
--upgrade: Upgrade the install in --dir in place instead of installing. See Upgrade in the install docs.

Uninstall

One command removes everything the installer wrote. It shows the plan first and asks you to type your dashboard domain.

curl -fsSL https://dockify.sh/uninstall.sh | sh

On the server itself, sudo dockify uninstall runs the same script. Add --dry-run to see the plan without changing anything. The uninstall guide has the details.

--dry-run: Print the plan and change nothing.
--yes: Skip the confirmation prompts, for automation.
--keep-data: The default. Keeps Dockify's volumes and your apps' volumes and networks.
--purge: Also delete every Dockify volume, network and image. Asks a second time.
--no-backup: With --purge, skip the backup of the master key and secrets.
--reboot: Reboot when done, so no firewall rule stays loaded.
--dir PATH: Install folder, if not /opt/dockify.
--cf-token-file PATH: Cloudflare token used to delete the tunnel and its DNS records. Asked for when omitted.

It stops the stack, removes the apps Dockify deployed, the firewall service and its rules, the dockify command, the apt rule and /opt/dockify. In tunnel mode it deletes the dockify-<host>-<id> tunnel and the CNAME records pointing at it, with a Cloudflare token. Without one it prints exactly what to delete in the Cloudflare dashboard.

Kept by default: Dockify's data volumes and your apps' volumes and networks, each listed in the plan. Docker, ufw and automatic security updates always stay.

Your master key is backed up. Before /opt/dockify goes, the master key, the secrets folder and .env are copied to /root/dockify-backup-<time>/, readable by root only. With --purge the backup still runs unless you pass --no-backup.

Reboot afterwards, or pass --reboot, so no firewall rule stays loaded.

Uninstall by hand

If the script cannot run, these commands remove the same files and keep your data. Delete the tunnel and its CNAME in Cloudflare yourself.

bash

sudo dockify down
sudo docker ps -aq --filter label=dockify.managed=true | xargs -r sudo docker rm -f
sudo docker ps -aq --filter label=dockify.app | xargs -r sudo docker rm -f
sudo systemctl disable --now dockify-firewall.service
sudo rm -f /etc/systemd/system/dockify-firewall.service /usr/local/sbin/dockify-firewall
sudo systemctl daemon-reload
sudo rm -f /usr/local/bin/dockify /etc/apt/apt.conf.d/52dockify-docker
sudo mkdir -m 700 /root/dockify-backup
sudo cp -a /opt/dockify/secrets /opt/dockify/.env /root/dockify-backup/
sudo rm -rf /opt/dockify
sudo reboot

Want to read it first? The installer is one file.

Read the install guide View install.sh