Pocket ID

services:
  pocket-id:
    image: "ghcr.io/daemonless/pocket-id:latest"
    container_name: pocket-id
    environment:
      - PUID=1000  # User ID for the application process
      - PGID=1000  # Group ID for the application process
      - TZ=UTC  # Timezone for the container
      - APP_URL=http://localhost:1411  # Public URL of Pocket ID as reached by the browser (passkeys bind to this origin)
      - TRUST_PROXY=false  # Trust X-Forwarded-* headers when running behind a reverse proxy
      # - ENCRYPTION_KEY=  # Key used to encrypt stored secrets (`openssl rand -base64 32`); generated into /config/.env on first start if unset
      # - DB_CONNECTION_STRING=  # Database connection string (defaults to SQLite at data/pocket-id.db under /config, or postgres://user:pass@host:5432/dbname)
      # - MAXMIND_LICENSE_KEY=  # MaxMind license key for automatic GeoLite2 City IP geolocation database downloads
      # - ANALYTICS_DISABLED=  # Disable outbound usage heartbeat to Pocket ID (defaults to true in this image)
    volumes:
      - "/containers/pocket-id:/config"
    ports:
      - "1411:1411"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

# .env

DIRECTOR_PROJECT=pocket-id
PUID=1000
PGID=1000
TZ=UTC
APP_URL=http://localhost:1411
TRUST_PROXY=false

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  pocket-id:
    name: pocket_id
    options:
      - container: 'args:--pull'
      - expose: '1411:1411 proto:tcp'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
        - APP_URL: !ENV '${APP_URL}'
        - TRUST_PROXY: !ENV '${TRUST_PROXY}'
    volumes:
      - POCKET_ID_CONFIG_PATH: /config
volumes:
  POCKET_ID_CONFIG_PATH:
    device: '/containers/pocket-id'

# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/pocket-id:${tag}

services:
  pocket-id:
    name: pocket-id
    image: "ghcr.io/daemonless/pocket-id:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
      - APP_URL=http://localhost:1411
      - TRUST_PROXY=false
    volumes:
      - "/containers/pocket-id:/config"