Merge pull request #5503 from duplicati/feature/update-docker-documentation

Update Docker builds
2024-08-29 15:37:30 +02:00
parent d36b396efc 7c2a0f8320
commit cb29a27aae
2 changed files with 45 additions and 2 deletions
@@ -13,8 +13,13 @@ ARG VERSION=
 ENV DUPLICATI_CHANNEL=${CHANNEL}
 ENV DUPLICATI_VERSION=${VERSION}

+ENV DUPLICATI__WEBSERVICE_PORT=8200
+ENV DUPLICATI__WEBSERVICE_INTERFACE=any
+ENV DUPLICATI__DISABLE_DB_ENCRYPTION=true
+ENV DUPLICATI__REQUIRE_DB_ENCRYPTION_KEY=true
+
 ARG TARGETARCH
 COPY ./${TARGETARCH} /opt/duplicati

 EXPOSE 8200
-CMD ["/opt/duplicati/duplicati-server", "--webservice-port=8200", "--webservice-interface=any"]
+CMD ["/opt/duplicati/duplicati-server"]
@@ -1,4 +1,4 @@
-# [Duplicati](https://www.duplicati.com)
+# [Duplicati](https://duplicati.com)

 Duplicati is a free, open source, backup client that securely stores encrypted, incremental, compressed backups on cloud storage services and remote file servers. It works with:

@@ -28,6 +28,17 @@ $ docker run -p 8200:8200 -v /some/path:/some/path duplicati/duplicati

 Then, open [http://localhost:8200](http://localhost:8200) on the host to access the Duplicati web interface and configure backups. Any host directory that you want to back up needs to be mounted into the container using the `-v` option.

+### First launch
+
+On the first launch, Duplicati will generate the database containing the server settings. This includes a signing key for JWT tokens and a randomly generated password for accessing the UI. Because the password is randomly generated, you cannot sign in with the password.
+
+There are two ways to fix this issue:
+
+1. Set up the enviroment variable `DUPLICATI__WEBSERVICE_PASSWORD=<password>` to change the password on restarts.
+2. Find the signin link in the Docker logs. Opening the link will allow you to log in, and you can change the password from there.
+
+If you use the second option, the changed password is persisted, and you will not use the signin link afterwards.
+
 ### Preserving configuration

 All configuration is stored in `/data` inside the container, so you can mount a volume at that path to preserve the configuration:
@@ -62,3 +73,30 @@ To launch the Duplicati server with additional arguments, run the `duplicati-ser
 ```console
 $ docker run duplicati/duplicati duplicati-server --log-level=debug
 ```
+
+### Supplying environment variables
+
+All commandline arguments can also be provided as as environment variables, if both an environment variable and a commandline argument is supplied for the same setting, the commandline arguments are used.
+
+The commandline arguments are mapped to environment variables by prefixing with `DUPLICATI__` and transforming `-` to `_`.
+For example, the commandline argument `--webservice-password` can be provided with the environment variable `DUPLICATI__WEBSERVICE_PASSWORD`.
+
+### Notes on usage and security features
+
+Duplicati has a number of security features that are configured differently for Docker images compared to the other builds. The reason for these changes is to make the Docker images work similar to other Docker images.
+
+The features that are disabled are:
+
+- `DUPLICATI__WEBSERVICE_INTERFACE=any`: This setting disables locking communication only to a single adapter, as the Docker network interface is expected to be guarded in other ways with explicit routing.
+
+- `DUPLICATI__DISABLE_DB_ENCRYPTION=true`: This setting disables encrypting data in the database, which should be stored on the host system.
+
+This setting is added to avoid encrypting the database with the default key, which is derived from the physical machine serial number. When moving Docker containers, the serial number could change, making the database inaccesible. Overriding this setting with `false` will cause the container to use the machine serial number to derive an encryption key.
+
+To increase security, the following steps are recommended:
+
+- Set `DUPLICATI__WEBSERVICE_ALLOWED_HOSTNAMES=<hostname1>;<hostname2>`
+  This will enable using desired hostnames instead of IP addresses only. The hostname `*` will disable the protection, but is not recommended.
+
+- Set `DUPLICATI__DISABLE_DB_ENCRYPTION=false` and `SETTINGS_ENCRYPTION_KEY=<key>`:
+  This will enable database encryption using the supplied key and reduce the risk of leaking credentials from the database. Note that the `SETTINGS_ENCRYPTION_KEY` is not the password used to connect to the UI.