UniFi Network

Version Tags

Prerequisites

Deployment

Podman Compose

services:
  unifi:
    image: "ghcr.io/daemonless/unifi:latest"
    container_name: unifi
    environment:
      - PUID=1000  # User ID for the application process
      - PGID=1000  # Group ID for the application process
      - TZ=UTC  # Timezone for the container
    volumes:
      - "/containers/unifi:/config"
    ports:
      - "8443:8443"
      - "8080:8080"
      - "8843:8843"
      - "8880:8880"
      - "6789:6789"
      - "3478:3478/udp"
      - "10001:10001/udp"
    annotations:
      org.freebsd.jail.allow.mlock: "true"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

AppJail Director

# .env

DIRECTOR_PROJECT=unifi
PUID=1000
PGID=1000
TZ=UTC

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  unifi:
    name: unifi
    options:
      - container: 'args:--pull'
      - expose: '8443:8443 proto:tcp'
      - expose: '8080:8080 proto:tcp'
      - expose: '8843:8843 proto:tcp'
      - expose: '8880:8880 proto:tcp'
      - expose: '6789:6789 proto:tcp'
      - expose: '3478:3478 proto:udp'
      - expose: '10001:10001 proto:udp'
      - template: !ENV '${PWD}/template.conf'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
    volumes:
      - unifi: /config
volumes:
  unifi:
    device: '/containers/unifi'

# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/unifi:${tag}

# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.mlock

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

To avoid exposing ports, just remove the expose option in your appjail-director.yml or from your command-line arguments.

Bastille

Warning

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

services:
  unifi:
    name: unifi
    image: "ghcr.io/daemonless/unifi:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
    volumes:
      - "/containers/unifi:/config"

Parameters

Environment Variables

Volumes

Ports