Container

Qeli with Docker on Linux

One multi-arch image contains both server and client roles. This is the minimal Compose-based server setup without privileged mode.

Host requirements

You need Linux, Docker with Compose, an available /dev/net/tun device and the NET_ADMIN, NET_RAW and NET_BIND_SERVICE capabilities. Persist /etc/qeli and /var/lib/qeli; losing the identity key breaks every client pin.

host

$ docker version
$ docker compose version
$ test -c /dev/net/tun && echo TUN_OK

Build the image and get the Compose file

The commands below build the container directly from the published v0.8.1 tag and do not depend on the state of the GHCR latest tag. The image targets the current host architecture; use the router's target platform for router deployments.

host

$ git clone --branch v0.8.1 --depth 1 https://github.com/litvinovtd/qeli.git
$ cd qeli
$ docker buildx build -f release/docker/Dockerfile -t qeli:latest --load .
$ cp release/docker/docker-compose.yml .
$ docker compose -f docker-compose.yml up -d qeli-server

Create a user and verify the configuration

The first start seeds example configuration and an empty users.conf in the mounted volume. Configure the bind and profile, add a user inside the container and restart the service. A client container must set dns = off.

host

$ docker exec -it qeli-server qeli add-client --config /etc/qeli/server.conf myphone
$ docker exec -it qeli-server qeli check-config --config /etc/qeli/server.conf
$ docker exec -it qeli-server qeli show-identity --config /etc/qeli/server.conf
$ docker compose -f docker-compose.yml restart qeli-server

Check Compose status, container logs, TUN and the published port. Internet egress requires net.ipv4.ip_forward=1 and server NAT; for access to specific networks, prefer routes and a return route without NAT.

verify

$ docker compose -f docker-compose.yml ps
$ docker logs --tail 100 qeli-server

Primary sources

Docker

Docker README → docker-compose.yml → Routing