BetterDesk/docker-compose.quick.yml

# =============================================================================
# BetterDesk Console - Quick Start (Pre-built Images)
# =============================================================================
# NO BUILD REQUIRED - uses pre-built images from GitHub Container Registry (ghcr.io).
#
# Image tag (aligned with CHANGELOG / git tag v3.2.12):
#   Default: 3.2.12  |  Rolling: BETTERDESK_IMAGE_TAG=latest
#
# Usage (automated — recommended):
#   curl -fsSL https://raw.githubusercontent.com/UNITRONIX/BetterDesk/main/install.sh | sudo bash
#
# Usage (manual):
#   curl -fsSL https://raw.githubusercontent.com/UNITRONIX/BetterDesk/main/docker-compose.quick.yml -o docker-compose.yml
#   docker compose pull && docker compose up -d
#
# Pin a specific release:
#   BETTERDESK_IMAGE_TAG=3.2.12 docker compose up -d
#
# Web Console: http://localhost:5000
# RustDesk client API: http://localhost:21114 (Go server — not the console port)
# SQLite: server mounts console auth.db read-only for folder/group sync (issue #138).
# Default credentials are written to the shared credentials file:
#   docker compose exec console sh -c 'cat /opt/rustdesk/.admin_credentials 2>/dev/null || cat /app/data/.admin_credentials'
#
# MACVLAN / dedicated LAN IP: use docker-compose.quick.macvlan.yml instead
# (console shares the server network namespace). See docs/docker/DOCKER_QUICKSTART.md
#
# TROUBLESHOOTING: If you get "denied" or "pull access denied" error,
# images may not be published yet. Build from source instead:
#   git clone https://github.com/UNITRONIX/Rustdesk-FreeConsole.git
#   cd Rustdesk-FreeConsole && docker compose -f docker-compose.yml up -d --build
# =============================================================================

services:
  # BetterDesk Server (Go) — handles signal, relay, and API
  server:
    image: ghcr.io/unitronix/betterdesk-server:${BETTERDESK_IMAGE_TAG:-3.2.12}
    container_name: betterdesk-server
    hostname: betterdesk-server
    command: ["/usr/local/bin/betterdesk-server", "-mode", "all", "-api-port", "21114", "-key-file", "/opt/rustdesk/id_ed25519"]
    ports:
      - "21114:21114"           # Go HTTP API (default — RustDesk client + REST)
      - "21115:21115"           # NAT type test
      - "21116:21116/tcp"       # Signal TCP
      - "21116:21116/udp"       # Signal UDP
      - "21117:21117"           # Relay TCP
      - "21118:21118"           # WebSocket Signal
      - "21119:21119"           # WebSocket Relay
    volumes:
      - betterdesk-data:/opt/rustdesk
      # Read-only: console stores folders/groups/ACL in auth.db (SQLite mode).
      - console-data:/app/data:ro
    environment:
      - ENCRYPTED_ONLY=1
      # RustDesk client folders/groups (issue #138). Ignored when DB_URL is postgres://.
      - AUTH_DB_PATH=/app/data/auth.db
      # Set this when clients are outside the Docker network. Use the host's
      # public IP/DNS, or the host LAN IP for LAN-only deployments.
      # Example: RELAY_SERVERS=203.2.1213.10:21117 docker compose up -d
      - RELAY_SERVERS=${RELAY_SERVERS:-}
      - SIGNAL_RATE_LIMIT_PER_IP=${SIGNAL_RATE_LIMIT_PER_IP:-20}
      # Enrollment policy. Fresh volumes default to "managed" (operator approves
      # new devices); pre-existing volumes keep their current mode. Override with
      # "open", "managed", or "locked".
      - ENROLLMENT_MODE=${ENROLLMENT_MODE:-}
    networks:
      - betterdesk-net
    restart: unless-stopped
    # SECURITY (audit fix L-02, 2026-04-10): drop all capabilities except
    # those needed by the entrypoint to chown volumes + su-exec to non-root.
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - FOWNER
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:21114/api/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s

  # BetterDesk Console — Web Management Interface
  console:
    image: ghcr.io/unitronix/betterdesk-console:${BETTERDESK_IMAGE_TAG:-3.2.12}
    container_name: betterdesk-console
    hostname: betterdesk-console
    ports:
      - "5000:5000"             # Web console (admin panel)
    volumes:
      - betterdesk-data:/opt/rustdesk
      - console-data:/app/data
    environment:
      - NODE_ENV=production
      - PORT=5000
      - HOST=0.0.0.0
      - API_HOST=0.0.0.0
      - API_ENABLED=false
      - SERVER_BACKEND=betterdesk
      - BETTERDESK_API_URL=http://betterdesk-server:21114/api
      - RUSTDESK_PATH=/opt/rustdesk
      - DATA_DIR=/app/data
      - DB_PATH=/app/data/db_v2.sqlite3
      - PUB_KEY_PATH=/opt/rustdesk/id_ed25519.pub
      - API_KEY_PATH=/opt/rustdesk/.api_key
      - WS_HBBS_HOST=betterdesk-server
      - WS_HBBS_PORT=21116
      - WS_HBBR_HOST=betterdesk-server
      - WS_HBBR_PORT=21117
      - DOCKER=true
      - BETTERDESK_UPDATE_MODE=image
      - BETTERDESK_IMAGE_TAG=${BETTERDESK_IMAGE_TAG:-3.2.12}
    networks:
      - betterdesk-net
    depends_on:
      # service_started (not healthy): server entrypoint waits for auth.db while
      # console creates it on first boot — avoids deadlock on fresh installs.
      server:
        condition: service_started
    restart: unless-stopped
    # L-02: drop caps + no privilege escalation for Node.js console.
    # SETUID/SETGID needed by su-exec; CHOWN/FOWNER for volume permissions.
    security_opt:
      - no-new-privileges:true
    cap_drop:
      - ALL
    cap_add:
      - SETUID
      - SETGID
      - CHOWN
      - FOWNER
    healthcheck:
      test: ["CMD", "wget", "-q", "--spider", "http://localhost:5000/login"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 20s

networks:
  betterdesk-net:
    driver: bridge

volumes:
  betterdesk-data:
    name: betterdesk-data
  console-data:
    name: betterdesk-console-data