Docker

git clone https://github.com/jp1337/easywall.git
cd easywall
docker compose up -d

Open https://localhost:12227 and complete the setup wizard.

Where to pull from

The same linux/amd64 + linux/arm64 image, pushed to all three by CI. Public, no authentication.

Registry	Image
GitHub Container Registry	ghcr.io/jp1337/easywall
Docker Hub	docker.io/kermit1337/easywall
Quay.io	quay.io/jp1337/easywall

Quay is behind as of v2.4.0. The publishing token is being rejected, so that mirror is skipped until it is replaced. Use GHCR or Docker Hub.

Which tag

Tag	Moves	For
:latest	on tagged releases only	production
:vX.Y.Z	never	pinning, e.g. v2.4.0
:edge	after every green build on main	tracking development, demo hosts
:sha-<commit>	never	rollback and debugging

# docker-compose.override.yml — pin a version
services:
  easywall:
    image: ghcr.io/jp1337/easywall:v2.4.0

Why host networking

nftables acts on the host’s network namespace. In its own namespace the container would filter only its own traffic, which is not what you asked for. NET_ADMIN is what lets it issue the netlink calls that reach host tables.

network_mode: host
cap_add:
  - NET_ADMIN

This is also why easywall in a container still coexists with Docker’s own rules — it owns table inet easywall and nothing else.

Needs

• Docker Engine 24+, Compose v2
• A Linux host with nftables

Your own certificate

volumes:
  - /etc/letsencrypt:/etc/letsencrypt:ro
  - ./config:/etc/easywall

# config/web.toml
[tls]
cert = "/etc/letsencrypt/live/example.com/fullchain.pem"
key  = "/etc/letsencrypt/live/example.com/privkey.pem"

Updating

docker compose pull && docker compose up -d

Watchtower automates it. Nightly or weekly on :latest for production; the public demo runs it against :edge.

Checking what you pulled

Every image carries the source commit in an OCI label:

docker buildx imagetools inspect \
  --format '{{ index .Manifest.Annotations "org.opencontainers.image.revision" }}' \
  ghcr.io/jp1337/easywall:latest

Compare it against the commit the release tag points at. The workflows that publish these images are release.yml and publish-edge.yml.