Wharfbase
One-click templates
Templates for app platforms (plan P5.5). Each one runs the same image as the installer, maps port 8480 and keeps /data. Where the platform can run more than one container per app, the socket-guard sidecar comes along, as in deploy/docker-compose.yml.
| Platform | File | Socket-guard | Data | Notes |
|---|---|---|---|---|
| Coolify | coolify/wharfbase.yaml | yes | named volume | SERVICE_URL_WHARFBASE_8480 gives it a domain; Coolify’s proxy is trusted |
| Dokploy | dokploy/docker-compose.yml + template.toml | yes | named volume | blueprint layout of Dokploy/templates |
| Portainer | portainer/templates.json → docker-compose.yml | yes | named volume | add the JSON’s URL under Settings → App Templates |
| CasaOS / ZimaOS | casaos/docker-compose.yml | yes | /DATA/AppData/wharfbase/data |
starts as root with CHOWN/SETUID/SETGID only, to take over the folder |
| Unraid | unraid/wharfbase.xml | no | /mnt/user/appdata/wharfbase |
single container: mounts the Docker socket directly (see below) |
Differences from the installer:
- Master key: these templates have no secrets file, so the server generates
master.keyinside its data volume on first start. Anyone with a copy of the volume can then decrypt the stored passwords. Back up the volume, and keep the backups private. To move the key out, setWB_MASTER_KEY_FILE(orWB_MASTER_KEY) and keep the same key. - Bind-mounted data folders (CasaOS, Unraid) are usually created by root. The container starts as root, gives the folder to uid 10001, and drops to that user with no capabilities (entrypoint).
- Unraid has no sidecars, so Wharfbase mounts
/var/run/docker.sockitself and joins the socket’s group. That is full Docker API access: the socket-guard’s allowlist (What Wharfbase reads) doesn’t apply. The template says so in its description. - The setup token is in the container’s log, or run
docker exec wharfbase wb setup-token(on Unraid: the container console,wb setup-token).
Checked so far: every compose file passes docker compose config, the XML, JSON and TOML parse, and the CasaOS layout (root start, root-owned 0700 data folder) and the Unraid layout (direct socket, bind-mounted data) were run on Docker 29 and turned healthy, with the server as uid 10001 without capabilities. Not yet tried on the platforms themselves: logos, store categories and each platform’s variable handling need a pass when the images are public.