mirrors/headscale
1
0
Fork 0
mirror of https://github.com/juanfont/headscale.git synced 2025-11-17 16:31:16 +01:00
Code Issues Packages Projects Releases Wiki Activity

Containers should be read-only

Browse Source 
This improves security and explicitly fails on startup when a user picks
the wrong directory to store its data.

- Run in read-only mode
- Make /var/run/headscale a read-write tmpfs
- Mount the config volume read-only
- Use the /health endpoint to check if Headscale is up
This commit is contained in:
Florian Preinstorfer 2025-11-14 09:53:32 +01:00 committed by nblock
parent 7fb0f9a501
commit 21af106f68
1 changed files with 10 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/setup/install/container.md
View File

@ -18,10 +18,10 @@ Registry](https://github.com/juanfont/headscale/pkgs/container/headscale). The c
## Configure and run headscale ## Configure and run headscale
1. Create a directory on the Docker host to store headscale's [configuration](../../ref/configuration.md) and the [SQLite](https://www.sqlite.org/) database: 1. Create a directory on the container host to store headscale's [configuration](../../ref/configuration.md) and the [SQLite](https://www.sqlite.org/) database:
```shell ```shell
mkdir -p ./headscale/{config,lib,run} mkdir -p ./headscale/{config,lib}
cd ./headscale cd ./headscale
``` ```
@ -34,9 +34,10 @@ Registry](https://github.com/juanfont/headscale/pkgs/container/headscale). The c
docker run \ docker run \
--name headscale \ --name headscale \
--detach \ --detach \
--volume "$(pwd)/config:/etc/headscale" \ --read-only \
--tmpfs /var/run/headscale \
--volume "$(pwd)/config:/etc/headscale:ro" \
--volume "$(pwd)/lib:/var/lib/headscale" \ --volume "$(pwd)/lib:/var/lib/headscale" \
--volume "$(pwd)/run:/var/run/headscale" \
--publish 127.0.0.1:8080:8080 \ --publish 127.0.0.1:8080:8080 \
--publish 127.0.0.1:9090:9090 \ --publish 127.0.0.1:9090:9090 \
--health-cmd "CMD headscale health" \ --health-cmd "CMD headscale health" \
@ -57,15 +58,17 @@ Registry](https://github.com/juanfont/headscale/pkgs/container/headscale). The c
image: docker.io/headscale/headscale:<VERSION> image: docker.io/headscale/headscale:<VERSION>
restart: unless-stopped restart: unless-stopped
container_name: headscale container_name: headscale
read_only: true
tmpfs:
- /var/run/headscale
ports: ports:
- "127.0.0.1:8080:8080" - "127.0.0.1:8080:8080"
- "127.0.0.1:9090:9090" - "127.0.0.1:9090:9090"
volumes: volumes:
# Please set <HEADSCALE_PATH> to the absolute path # Please set <HEADSCALE_PATH> to the absolute path
# of the previously created headscale directory. # of the previously created headscale directory.
- <HEADSCALE_PATH>/config:/etc/headscale - <HEADSCALE_PATH>/config:/etc/headscale:ro
- <HEADSCALE_PATH>/lib:/var/lib/headscale - <HEADSCALE_PATH>/lib:/var/lib/headscale
- <HEADSCALE_PATH>/run:/var/run/headscale
command: serve command: serve
healthcheck: healthcheck:
test: ["CMD", "headscale", "health"] test: ["CMD", "headscale", "health"]
@ -88,7 +91,7 @@ Registry](https://github.com/juanfont/headscale/pkgs/container/headscale). The c
Verify headscale is available: Verify headscale is available:
```shell ```shell
curl http://127.0.0.1:9090/metrics curl http://127.0.0.1:8080/health
``` ```
1. Create a headscale user: 1. Create a headscale user: