1--- 2date: "2020-02-09T20:00:00+02:00" 3title: "Installation with Docker (rootless)" 4slug: "install-with-docker-rootless" 5weight: 10 6toc: false 7draft: false 8menu: 9 sidebar: 10 parent: "installation" 11 name: "With Docker Rootless" 12 weight: 10 13 identifier: "install-with-docker-rootless" 14--- 15 16# Installation with Docker 17 18Gitea provides automatically updated Docker images within its Docker Hub organization. It is 19possible to always use the latest stable tag or to use another service that handles updating 20Docker images. 21 22The rootless image use Gitea internal SSH to provide Git protocol and doesn't support OpenSSH. 23 24This reference setup guides users through the setup based on `docker-compose`, but the installation 25of `docker-compose` is out of scope of this documentation. To install `docker-compose` itself, follow 26the official [install instructions](https://docs.docker.com/compose/install/). 27 28## Basics 29 30The most simple setup just creates a volume and a network and starts the `gitea/gitea:latest-rootless` 31image as a service. Since there is no database available, one can be initialized using SQLite3. 32Create a directory for `data` and `config` then paste the following content into a file named `docker-compose.yml`. 33Note that the volume should be owned by the user/group with the UID/GID specified in the config file. By default Gitea in docker will use uid:1000 gid:1000. If needed you can set ownership on those folders with the command: `sudo chown 1000:1000 config/ data/` 34If you don't give the volume correct permissions, the container may not start. 35For a stable release you could use `:latest-rootless`, `:1-rootless` or specify a certain release like `:{{< version >}}-rootless`, but if you'd like to use the latest development version then `:dev-rootless` would be an appropriate tag. If you'd like to run the latest commit from a release branch you can use the `:1.x-dev-rootless` tag, where x is the minor version of Gitea. (e.g. `:1.16-dev-rootless`) 36 37```yaml 38version: "2" 39 40services: 41 server: 42 image: gitea/gitea:{{< version >}}-rootless 43 restart: always 44 volumes: 45 - ./data:/var/lib/gitea 46 - ./config:/etc/gitea 47 - /etc/timezone:/etc/timezone:ro 48 - /etc/localtime:/etc/localtime:ro 49 ports: 50 - "3000:3000" 51 - "2222:2222" 52``` 53 54## Custom port 55 56To bind the integrated ssh and the webserver on a different port, adjust 57the port section. It's common to just change the host port and keep the ports within 58the container like they are. 59 60```diff 61version: "2" 62 63services: 64 server: 65 image: gitea/gitea:{{< version >}}-rootless 66 restart: always 67 volumes: 68 - ./data:/var/lib/gitea 69 - ./config:/etc/gitea 70 - /etc/timezone:/etc/timezone:ro 71 - /etc/localtime:/etc/localtime:ro 72 ports: 73- - "3000:3000" 74- - "2222:2222" 75+ - "80:3000" 76+ - "22:2222" 77``` 78 79## MySQL database 80 81To start Gitea in combination with a MySQL database, apply these changes to the 82`docker-compose.yml` file created above. 83 84```diff 85version: "2" 86 87services: 88 server: 89 image: gitea/gitea:{{< version >}}-rootless 90+ environment: 91+ - GITEA__database__DB_TYPE=mysql 92+ - GITEA__database__HOST=db:3306 93+ - GITEA__database__NAME=gitea 94+ - GITEA__database__USER=gitea 95+ - GITEA__database__PASSWD=gitea 96 restart: always 97 volumes: 98 - ./data:/var/lib/gitea 99 - ./config:/etc/gitea 100 - /etc/timezone:/etc/timezone:ro 101 - /etc/localtime:/etc/localtime:ro 102 ports: 103 - "3000:3000" 104 - "222:22" 105+ depends_on: 106+ - db 107+ 108+ db: 109+ image: mysql:8 110+ restart: always 111+ environment: 112+ - MYSQL_ROOT_PASSWORD=gitea 113+ - MYSQL_USER=gitea 114+ - MYSQL_PASSWORD=gitea 115+ - MYSQL_DATABASE=gitea 116+ volumes: 117+ - ./mysql:/var/lib/mysql 118``` 119 120## PostgreSQL database 121 122To start Gitea in combination with a PostgreSQL database, apply these changes to 123the `docker-compose.yml` file created above. 124 125```diff 126version: "2" 127 128services: 129 server: 130 image: gitea/gitea:{{< version >}}-rootless 131 environment: 132+ - GITEA__database__DB_TYPE=postgres 133+ - GITEA__database__HOST=db:5432 134+ - GITEA__database__NAME=gitea 135+ - GITEA__database__USER=gitea 136+ - GITEA__database__PASSWD=gitea 137 restart: always 138 volumes: 139 - ./data:/var/lib/gitea 140 - ./config:/etc/gitea 141 - /etc/timezone:/etc/timezone:ro 142 - /etc/localtime:/etc/localtime:ro 143 ports: 144 - "3000:3000" 145 - "2222:2222" 146+ depends_on: 147+ - db 148+ 149+ db: 150+ image: postgres:13 151+ restart: always 152+ environment: 153+ - POSTGRES_USER=gitea 154+ - POSTGRES_PASSWORD=gitea 155+ - POSTGRES_DB=gitea 156+ volumes: 157+ - ./postgres:/var/lib/postgresql/data 158``` 159 160## Named volumes 161 162To use named volumes instead of host volumes, define and use the named volume 163within the `docker-compose.yml` configuration. This change will automatically 164create the required volume. You don't need to worry about permissions with 165named volumes; Docker will deal with that automatically. 166 167```diff 168version: "2" 169 170+volumes: 171+ gitea-data: 172+ driver: local 173+ gitea-config: 174+ driver: local 175+ 176services: 177 server: 178 image: gitea/gitea:{{< version >}}-rootless 179 restart: always 180 volumes: 181- - ./data:/var/lib/gitea 182+ - gitea-data:/var/lib/gitea 183- - ./config:/etc/gitea 184+ - gitea-config:/etc/gitea 185 - /etc/timezone:/etc/timezone:ro 186 - /etc/localtime:/etc/localtime:ro 187 ports: 188 - "3000:3000" 189 - "2222:2222" 190``` 191 192MySQL or PostgreSQL containers will need to be created separately. 193 194## Custom user 195 196You can choose to use a custom user (following --user flag definition https://docs.docker.com/engine/reference/run/#user). 197As an example to clone the host user `git` definition use the command `id -u git` and add it to `docker-compose.yml` file: 198Please make sure that the mounted folders are writable by the user. 199 200```diff 201version: "2" 202 203services: 204 server: 205 image: gitea/gitea:{{< version >}}-rootless 206 restart: always 207+ user: 1001 208 volumes: 209 - ./data:/var/lib/gitea 210 - ./config:/etc/gitea 211 - /etc/timezone:/etc/timezone:ro 212 - /etc/localtime:/etc/localtime:ro 213 ports: 214 - "3000:3000" 215 - "2222:2222" 216``` 217 218## Start 219 220To start this setup based on `docker-compose`, execute `docker-compose up -d`, 221to launch Gitea in the background. Using `docker-compose ps` will show if Gitea 222started properly. Logs can be viewed with `docker-compose logs`. 223 224To shut down the setup, execute `docker-compose down`. This will stop 225and kill the containers. The volumes will still exist. 226 227Notice: if using a non-3000 port on http, change app.ini to match 228`LOCAL_ROOT_URL = http://localhost:3000/`. 229 230## Install 231 232After starting the Docker setup via `docker-compose`, Gitea should be available using a 233favorite browser to finalize the installation. Visit http://server-ip:3000 and follow the 234installation wizard. If the database was started with the `docker-compose` setup as 235documented above, please note that `db` must be used as the database hostname. 236 237# Customization 238 239Customization files described [here](https://docs.gitea.io/en-us/customizing-gitea/) should 240be placed in `/var/lib/gitea/custom` directory. If using host volumes, it's quite easy to access these 241files; for named volumes, this is done through another container or by direct access at 242`/var/lib/docker/volumes/gitea_gitea/_/var_lib_gitea`. The configuration file will be saved at 243`/etc/gitea/app.ini` after the installation. 244 245# Upgrading 246 247:exclamation::exclamation: **Make sure you have volumed data to somewhere outside Docker container** :exclamation::exclamation: 248 249To upgrade your installation to the latest release: 250``` 251# Edit `docker-compose.yml` to update the version, if you have one specified 252# Pull new images 253docker-compose pull 254# Start a new container, automatically removes old one 255docker-compose up -d 256``` 257 258# Upgrading from standard image 259 260- Backup your setup 261- Change volume mountpoint from /data to /var/lib/gitea 262- If you used a custom app.ini move it to a new volume mounted to /etc/gitea 263- Rename folder (inside volume) gitea to custom 264- Edit app.ini if needed 265 - Set START_SSH_SERVER = true 266- Use image gitea/gitea:{{< version >}}-rootless 267 268## Managing Deployments With Environment Variables 269 270In addition to the environment variables above, any settings in `app.ini` can be set or overridden with an environment variable of the form: `GITEA__SECTION_NAME__KEY_NAME`. These settings are applied each time the docker container starts. Full information [here](https://github.com/go-gitea/gitea/tree/main/contrib/environment-to-ini). 271 272These environment variables can be passed to the docker container in `docker-compose.yml`. The following example will enable an smtp mail server if the required env variables `GITEA__mailer__FROM`, `GITEA__mailer__HOST`, `GITEA__mailer__PASSWD` are set on the host or in a `.env` file in the same directory as `docker-compose.yml`: 273 274```bash 275... 276services: 277 server: 278 environment: 279 - GITEA__mailer__ENABLED=true 280 - GITEA__mailer__FROM=${GITEA__mailer__FROM:?GITEA__mailer__FROM not set} 281 - GITEA__mailer__MAILER_TYPE=smtp 282 - GITEA__mailer__HOST=${GITEA__mailer__HOST:?GITEA__mailer__HOST not set} 283 - GITEA__mailer__IS_TLS_ENABLED=true 284 - GITEA__mailer__USER=${GITEA__mailer__USER:-apikey} 285 - GITEA__mailer__PASSWD="""${GITEA__mailer__PASSWD:?GITEA__mailer__PASSWD not set}""" 286``` 287 288To set required TOKEN and SECRET values, consider using Gitea's built-in [generate utility functions](https://docs.gitea.io/en-us/command-line/#generate). 289 290# SSH Container Passthrough 291 292Since SSH is running inside the container, SSH needs to be passed through from the host to the container if SSH support is desired. One option would be to run the container SSH on a non-standard port (or moving the host port to a non-standard port). Another option which might be more straightforward is to forward SSH commands from the host to the container. This setup is explained in the following. 293 294This guide assumes that you have created a user on the host called `git` with permission to run `docker exec`, and that the Gitea container is called `gitea`. You will need to modify that user's shell to forward the commands to the `sh` executable inside the container, using `docker exec`. 295 296First, create the file `/usr/local/bin/gitea-shell` on the host, with the following contents: 297 298```bash 299#!/bin/sh 300/usr/bin/docker exec -i --env SSH_ORIGINAL_COMMAND="$SSH_ORIGINAL_COMMAND" gitea sh "$@" 301``` 302 303Note that `gitea` in the docker command above is the name of the container. If you named yours differently, don't forget to change that. 304 305You should also make sure that you’ve set the permissions of the shell wrapper correctly: 306 307```bash 308sudo chmod +x /usr/local/bin/gitea-shell 309``` 310 311Once the wrapper is in place, you can make it the shell for the `git` user: 312 313```bash 314sudo usermod -s /usr/local/bin/gitea-shell git 315``` 316 317Now that all the SSH commands are forwarded to the container, you need to set up the SSH authentication on the host. This is done by leveraging the [SSH AuthorizedKeysCommand](https://docs.gitea.io/en-us/command-line/#keys) to match the keys against those accepted by Gitea. Add the following block to `/etc/ssh/sshd_config`, on the host: 318 319```bash 320Match User git 321 AuthorizedKeysCommandUser git 322 AuthorizedKeysCommand /usr/bin/docker exec -i gitea /usr/local/bin/gitea keys -c /etc/gitea/app.ini -e git -u %u -t %t -k %k 323``` 324 325All that is left to do is restart the SSH server: 326 327```bash 328sudo systemctl restart sshd 329``` 330