• regular and timely application updates
• easy user mappings (PGID, PUID)
• custom base image with s6 overlay
• weekly base OS updates with common layers across the entire LinuxServer.io ecosystem to minimise space usage, down time and bandwidth
• regular security updates

• Blog - all the things you can do with our containers including How-To guides, opinions and much more!
• Discord - realtime support / chat with the community and the team.
• Discussions - post on our community forum.
• GitHub - view the source for all of our repositories.
• Open Collective - please consider helping us by either donating or contributing to our budget

linuxserver/sealskin

Supported Architectures

Application Setup

Clients

First run

• /config/root_key is an application key for the web app. Open https://<server>:8443/ and paste it in to sign in.
• /config/admin.json is the key file for the browser extension and mobile apps. If HOST_URL was set it can be imported as is, otherwise edit it and replace the string HOST_URL with your server's IP or hostname.

Scripted installation

mkdir sealskin
cd sealskin
bash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)

cd sealskin
bash <(curl -sSL https://raw.githubusercontent.com/linuxserver/docker-sealskin/refs/heads/master/install.sh)

Basic Requirements

• The container must be named sealskin. The server inspects its own container to learn the host paths behind /config and /storage, the externally mapped ports, and the Docker network. The name is also the server's identity in its own records, so a container recreated under another name is another node. If you cannot keep the name, set hostname: sealskin or SEALSKIN_NODE_NAME.
• The Docker socket is required. Every session is a container the server starts through it. If launches fail with a permission error, make the socket group writable on the host with sudo chmod g+rw /var/run/docker.sock.
• PUID and PGID own everything. The server, its files and every session container run as that user, so /config and /storage on the host must be writable by it.
• Ports. 8443 carries the web app, the API and the streamed sessions. 8000 is only needed for the Chrome self-signed fallback. 8444 is the peer listener, only publish it to join several servers into a cluster.

NVIDIA Support

Key & Certificate Management

Automatic First-Run Setup (Recommended)

1. An init process generates the mandatory server key (ssl/server_key.pem) and a self-signed SSL certificate for the proxy (ssl/proxy_key.pem, ssl/proxy_cert.pem).
2. The server detects that no administrator exists, creates the default user admin, and writes /config/admin.json and /config/root_key as described above.

Manual Pre-Configuration (Advanced)

• To use a custom Admin Key:

1.  Generate your own RSA keypair.
2.  Create a file containing only your **public key** PEM data at `/path/to/config/.config/sealskin/keys/admins/admin`.
3.  The server will detect this file and write no `admin.json`. You use your private key to log in from the extension, and `admin` signs in to the web app with the root key alone.

• To use a custom SSL Certificate:

*   Place your certificate and private key at `/path/to/config/ssl/proxy_cert.pem` and `/path/to/config/ssl/proxy_key.pem`. This overrides the self-signed certificate and can be replaced later with a restart.

• To use a custom Server E2EE Key:

*   Place your RSA private key at `/path/to/config/ssl/server_key.pem`. This is the core key for the API's end-to-end encryption and validates the server when a client is configured with its public key.
    *   **Generation Command:** `openssl genpkey -algorithm RSA -out /path/to/config/ssl/server_key.pem -pkeyopt rsa_keygen_bits:4096`
    *   **Extraction Command (public key for clients):** `openssl rsa -in server_key.pem -pubout`

Upgrading from 0.3

Usage

docker-compose (recommended, click here for more info)

---
services:
  sealskin:
    image: lscr.io/linuxserver/sealskin:latest
    container_name: sealskin
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=Etc/UTC
      - "HOST_URL=IP or subdomain.domain.com" #optional
    volumes:
      - /path/to/sealskin/config:/config
      - /path/to/sealskin/storage:/storage
      - /var/run/docker.sock:/var/run/docker.sock
    ports:
      - 8443:8443
      - 8000:8000 #optional
      - 8444:8444 #optional
    restart: unless-stopped

docker cli (click here for more info)

docker run -d \
  --name=sealskin \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=Etc/UTC \
  -e HOST_URL="IP or subdomain.domain.com" `#optional` \
  -p 8443:8443 \
  -p 8000:8000 `#optional` \
  -p 8444:8444 `#optional` \
  -v /path/to/sealskin/config:/config \
  -v /path/to/sealskin/storage:/storage \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --restart unless-stopped \
  lscr.io/linuxserver/sealskin:latest

Parameters

Environment variables from files (Docker secrets)

-e FILE__MYVAR=/run/secrets/mysecretvariable

Umask for running applications

User / Group Identifiers

id your_user

uid=1000(your_user) gid=1000(your_user) groups=1000(your_user)

Docker Mods

Support Info

• Shell access whilst the container is running:

```bash
docker exec -it sealskin /bin/bash
```

• To monitor the logs of the container in realtime:

```bash
docker logs -f sealskin
```

• Container version number:

```bash
docker inspect -f '{{ index .Config.Labels "build_version" }}' sealskin
```

• Image version number:

```bash
docker inspect -f '{{ index .Config.Labels "build_version" }}' lscr.io/linuxserver/sealskin:latest
```

Updating Info

Via Docker Compose

• Update images:

* All images:

    ```bash
    docker-compose pull
    ```

* Single image:

    ```bash
    docker-compose pull sealskin
    ```

• Update containers:

* All containers:

    ```bash
    docker-compose up -d
    ```

* Single container:

    ```bash
    docker-compose up -d sealskin
    ```

• You can also remove the old dangling images:

```bash
docker image prune
```

Via Docker Run

• Update the image:

```bash
docker pull lscr.io/linuxserver/sealskin:latest
```

• Stop the running container:

```bash
docker stop sealskin
```

• Delete the container:

```bash
docker rm sealskin
```

• Recreate a new container with the same docker run parameters as instructed above (if mapped correctly to a host folder, your /config folder and settings will be preserved)
• You can also remove the old dangling images:

```bash
docker image prune
```

Image Update Notifications - Diun (Docker Image Update Notifier)

Building locally

git clone https://github.com/linuxserver/docker-sealskin.git
cd docker-sealskin
docker build \
  --no-cache \
  --pull \
  -t lscr.io/linuxserver/sealskin:latest .

docker run --rm --privileged lscr.io/linuxserver/qemu-static --reset