Configuration

sol2docker is configured entirely through environment variables (SOL2DOCKER_*) plus two mounts: the Docker socket and a /data volume. There is no config file to edit inside the container.

The essentials

Encryption key — SOL2DOCKER_ENCRYPTION_KEY

sol2docker encrypts secrets at rest — registry and git credentials, webhook targets, notification configs, endpoint TLS/SSH keys, and TOTP secrets — with AES-256-GCM using this key.

openssl rand -base64 32

Keep this key

If secrets already exist and the key is missing, the server refuses to boot. Lose the key and those secrets become undecryptable — you'd have to re-enter them. Store it somewhere durable, separate from the data volume.

First admin — SOL2DOCKER_ADMIN_PASSWORD

On first boot, with no users, sol2docker creates an admin account with the global platform_admin role. Set this variable to choose its password; leave it unset and a strong password is generated and printed once to the container logs:

docker logs sol2docker 2>&1 | grep -i password

Set SOL2DOCKER_ADMIN_USER to name that first account something other than admin. Both variables only apply on the very first boot (when there are no users yet); change the password afterward from My Account.

Sessions — SOL2DOCKER_JWT_SECRET

Session cookies are signed with this secret. If it's unset, sol2docker derives one from SOL2DOCKER_ENCRYPTION_KEY; if neither is set, it uses a random secret and sessions won't survive a restart (everyone is logged out on every restart). Set the encryption key (which you want anyway) and you don't need this separately — provide it only to rotate the signing secret independently.

At sign-in the user chooses Stay logged in or not:

• Not chosen (default) — a session cookie that the browser drops when it closes, plus an idle timeout: the app signs the user out after a stretch of no activity. Absolute lifetime is capped at 7 days.
• Chosen — a persistent cookie that lasts 30 days with no idle timeout.

Set the idle window with SOL2DOCKER_SESSION_IDLE_MINUTES (default 30; 0 disables it). SSO sessions always use the non-remembered behavior.

Data volume — /data

All control-plane state lives in SQLite under /data: users, roles, sessions, tokens, environments, credentials, webhooks, notification channels, jobs, the audit log, schedules, alert config, and health history. Back this volume up. Migrations apply automatically on boot. Point SOL2DOCKER_DATA elsewhere to change that directory (defaults to /data in the image).

The Docker socket

Mount the daemon you want to manage as the built-in local environment:

volumes:
  - /var/run/docker.sock:/var/run/docker.sock

You can add more endpoints later from the UI — TCP, TLS client-cert, or SSH. See Environments. Set SOL2DOCKER_DOCKER_SOCK if the local socket lives somewhere other than /var/run/docker.sock.

Port & host

The server listens on 8080 on all interfaces (0.0.0.0) inside the container. Publish it wherever you like:

ports: ["8080:8080"]

Override the listen port with SOL2DOCKER_PORT and the bind address with SOL2DOCKER_HOST if you need to (rarely necessary inside a container). Set the log level with SOL2DOCKER_LOG (fatal, error, warn, info (default), debug, trace).

Single sign-on (optional) — SOL2DOCKER_OIDC_*

Set SOL2DOCKER_OIDC_ISSUER, SOL2DOCKER_OIDC_CLIENT_ID, and SOL2DOCKER_OIDC_CLIENT_SECRET to enable OpenID Connect single sign-on next to local login. Optional variables cover the redirect URI, scopes, provider name, a default role for new SSO users, the groups/roles claim path (SOL2DOCKER_OIDC_GROUPS_CLAIM), and a logout endpoint override (SOL2DOCKER_OIDC_LOGOUT_URL). Set SOL2DOCKER_DISABLE_LOCAL_LOGIN=true to make it OIDC-only — the login page redirects straight to the provider. See the full walkthrough in Single sign-on (OIDC).

The node agent (optional)

If you deploy the node agent, the server issues it a bootstrap token via SOL2DOCKER_AGENT_BOOTSTRAP_TOKEN, and each agent is configured with SOL2DOCKER_SERVER_URL, SOL2DOCKER_AGENT_TOKEN, and (over plain HTTP) SOL2DOCKER_INSECURE_HTTP: "true". See the deploy examples.

TLS & reverse proxies

sol2docker runs plain HTTP by default — ideal for local use or behind a reverse proxy that terminates TLS. You have two ways to serve HTTPS:

Terminate TLS in the server. Set SOL2DOCKER_TLS=on and point it at a mounted certificate and key. If TLS is on but the cert or key is missing, the server refuses to boot.

Variable	Required	Purpose
SOL2DOCKER_TLS	—	on / true to terminate HTTPS in the server. Off by default.
SOL2DOCKER_TLS_CERT	when TLS on	Path to the certificate (PEM) inside the container.
SOL2DOCKER_TLS_KEY	when TLS on	Path to the private key (PEM).
SOL2DOCKER_TLS_CA		Path to a CA bundle, if the chain needs one.
SOL2DOCKER_TLS_KEY_PASSPHRASE		Passphrase for an encrypted private key.

Terminate TLS at a reverse proxy. Leave SOL2DOCKER_TLS off and set:

Variable	Purpose
SOL2DOCKER_SECURE_COOKIES	true marks the session cookie Secure even though sol2docker itself speaks HTTP to the proxy. Set this whenever users reach you over HTTPS.
SOL2DOCKER_TRUST_PROXY	true / on trusts X-Forwarded-For so the per-IP login throttle, rate limits, and audit/session list see the real client IP instead of the proxy's. Only enable it when you actually sit behind a trusted proxy — otherwise a client could spoof its address.

Public URL — SOL2DOCKER_PUBLIC_URL

A TLS-terminating proxy forwards requests to sol2docker as plain http on an internal host, so any URL sol2docker builds from the incoming request — the OIDC callback and the OIDC post-logout redirect today, and likely more over time — would come out as http://‹internal-host›/ instead of your real address. Set this to the URL users actually reach sol2docker at:

SOL2DOCKER_PUBLIC_URL=https://sol2docker.example.com

When set, request-derived URLs are built from it instead of the incoming scheme/host. Leave it unset for direct/local access, where the request already reflects the real address.

Installer

The installer can wire up HTTPS termination (either mode) for you.

First login checklist

1. Open the published URL and sign in as admin.
2. Change the admin password (My Account → change password).
3. Enable 2FA if you want it (My Account → security).
4. Add your Docker environments (or confirm the built-in local one).
5. Set up notifications and users/roles as needed.

Full variable reference

Every environment variable the server reads. Only SOL2DOCKER_ENCRYPTION_KEY and the Docker socket mount are needed for a basic run; everything else has a sensible default.

Variable	Default	Purpose
SOL2DOCKER_ENCRYPTION_KEY	—	AES-256-GCM key for secrets at rest. Strongly recommended; without it, stored secrets and sessions don't persist safely across restarts.
SOL2DOCKER_JWT_SECRET	derived from encryption key	Session-cookie signing secret.
SOL2DOCKER_SESSION_IDLE_MINUTES	30	Idle timeout (minutes) for non-"stay logged in" sessions; 0 disables it.
SOL2DOCKER_ADMIN_USER	admin	Username of the first-boot admin.
SOL2DOCKER_ADMIN_PASSWORD	generated & logged	Password of the first-boot admin.
SOL2DOCKER_DATA	/data	Directory for the SQLite control-plane state.
SOL2DOCKER_DOCKER_SOCK	/var/run/docker.sock	Path to the local Docker socket for the built-in local environment.
SOL2DOCKER_PORT	8080	Listen port.
SOL2DOCKER_HOST	0.0.0.0	Bind address.
SOL2DOCKER_LOG	info	Log level (fatal…trace).
SOL2DOCKER_TLS	(off)	on/true to terminate HTTPS in the server.
SOL2DOCKER_TLS_CERT	—	Certificate path (required when TLS is on).
SOL2DOCKER_TLS_KEY	—	Private-key path (required when TLS is on).
SOL2DOCKER_TLS_CA	—	CA bundle path (optional).
SOL2DOCKER_TLS_KEY_PASSPHRASE	—	Private-key passphrase (optional).
SOL2DOCKER_SECURE_COOKIES	false	Mark the session cookie Secure behind a TLS-terminating proxy.
SOL2DOCKER_TRUST_PROXY	false	Trust X-Forwarded-For behind a reverse proxy.
SOL2DOCKER_PUBLIC_URL	(request)	External base URL used to build request-derived links (OIDC callback/logout) behind a reverse proxy.
SOL2DOCKER_AGENT_BOOTSTRAP_TOKEN	—	Shared token used to enroll the optional node agent.
SOL2DOCKER_OIDC_*	—	OpenID Connect single sign-on — see Single sign-on (OIDC).
SOL2DOCKER_DISABLE_LOCAL_LOGIN	false	OIDC-only login: turn off username/password and redirect to the provider (honored only when OIDC is configured).

Build-time only

SOL2DOCKER_VERSION, SOL2DOCKER_CLIENT_DIST, and SOL2DOCKER_MIGRATIONS are set by the build / image and are not meant for operators to configure.