Briki - User contributions [en]

Docker

2026-03-10T16:04:24Z

Andrew: /* Govee2MQTT */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Mosquitto ===
sudo docker run -d --name mosquitto -e TZ=Europe/London \
-p 1883:1883 -p 9001:9001\
-v /var/lib/mosquitto:/mosquitto \
--restart unless-stopped \
eclipse-mosquitto

=== Govee2MQTT ===
Note: `--net=host` is needed for LAN API connections

sudo docker run -d --name govee2mqtt \
--net=host \
--env-file /var/lib/govee2mqtt/.env \
--restart unless-stopped \
ghcr.io/wez/govee2mqtt

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-03-10T16:03:33Z

Andrew: /* Govee2MQTT */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Mosquitto ===
sudo docker run -d --name mosquitto -e TZ=Europe/London \
-p 1883:1883 -p 9001:9001\
-v /var/lib/mosquitto:/mosquitto \
--restart unless-stopped \
eclipse-mosquitto

=== Govee2MQTT ===
Note: `--net=host` is needed for LAN API connections

sudo docker run -d --name govee2mqtt \
--net=host
--env-file /var/lib/govee2mqtt/.env \
--restart unless-stopped \
ghcr.io/wez/govee2mqtt

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-03-10T16:02:20Z

Andrew: /* Govee2MQTT */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Mosquitto ===
sudo docker run -d --name mosquitto -e TZ=Europe/London \
-p 1883:1883 -p 9001:9001\
-v /var/lib/mosquitto:/mosquitto \
--restart unless-stopped \
eclipse-mosquitto

=== Govee2MQTT ===
sudo docker run -d --name govee2mqtt \
--env-file /var/lib/govee2mqtt/.env \
--restart unless-stopped \
ghcr.io/wez/govee2mqtt

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-03-10T15:42:59Z

Andrew: /* Govee2MQTT */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Mosquitto ===
sudo docker run -d --name mosquitto -e TZ=Europe/London \
-p 1883:1883 -p 9001:9001\
-v /var/lib/mosquitto:/mosquitto \
--restart unless-stopped \
eclipse-mosquitto

=== Govee2MQTT ===
sudo docker run -d --name govee2mqtt -e TZ=Europe/London \
-e CONFIG_PATH=/config/config.yaml \
-v /var/lib/govee2mqtt:/config \
--restart unless-stopped \
ghcr.io/wez/govee2mqtt

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-03-10T05:46:23Z

Andrew: /* Containers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Mosquitto ===
sudo docker run -d --name mosquitto -e TZ=Europe/London \
-p 1883:1883 -p 9001:9001\
-v /var/lib/mosquitto:/mosquitto \
--restart unless-stopped \
eclipse-mosquitto

=== Govee2MQTT ===
sudo docker run -d --name govee2mqtt -e TZ=Europe/London \
-e CONFIG_PATH=/config/config.yaml \
-v /var/lib/govee2mqtt:/config \
--restart unless-stopped \
graystorm/govee2mqtt

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Machine List

2026-01-30T07:03:05Z

Andrew: /* History */

== History ==

=== Pre-networking ===
* (1988-1993) 8086 4.2MHz, MS-DOS 3.3
* (1993-1995) 386SX 16MHz, Windows 3.1 + MS-DOS 5.0
* (1995-1996) 486DX 50MHz, Windows 3.1 + MS-DOS 5.0/Windows 95

=== indiana ===
* (1996 - 1999) Fujitsu-ICL Pentium 90, Windows 95 + Windows NT 4.0
** 1996?: +Orchid Righteous 3D

=== colorado ===
* (1999 - 2001) Homebuilt Celeron 300, Windows 98/Me/XP
** Matrox Millennium G200?
* (2001 - 2002) Homebuilt Pentium 3 800, Windows XP
* (2002 - 2005) Homebuilt Pentium 3 800, Mandriva Linux 8.0/9.0/10.0
* (2005 - 2008) Dell Dimension 4300 (Pentium 4 1.8), Kubuntu 6.04
** 2005: +128MB Sparkle GeForce MX4000 AGP
** 2005: +Hauppauge WinTV-NOVA-T-MCE
** 2006: +Seagate Barracuda 7200.10 320GB ST3320620A
** 2006: +NEC-4570 16x DVD±RW/RAM Black
* (2008 - 2010) Dell Dimension 4300 (Pentium 4 1.8), Ubuntu 8.04
** 2008: +Seagate Barracuda 7200.10 750GB SATA2 3.5"
** 2008: +SATA & IDE PCI Controller Card

=== texas ===
* (2002 - 2005) Dell Dimension 4300 (Pentium 4 1.8), Windows XP
** GeForce 2 MX400?

=== vermont ===
* (2004 - 2006) Sony Vaio TR5MP (Pentium M 1.0), Windows XP
* (2006 - 2008) Sony Vaio TR5MP (Pentium M 1.0), Ubuntu 6.10/7.04/7.10/8.04

=== alaska ===
* (2005 - 2007) Homebuilt Athlon64 3500+, Windows XP + Ubuntu 7.04 -> 8.04
** Cooler Master Wave Master TAC-T01-E1C Silver All Aluminum Alloy ATX Mid Tower Computer Case
** MSI K8N Diamond
** AMD Athlon 64 3500+
** 512MB Corsair Value Select 400MHz DDR Memory Stick
** 128MB Sparkle GeForce 6600GT PCI-E
** 300Gb Maxtor DiamondMax 10 ATA/133 6L300S0
** NEC ND-3520 Silver
** 460W Akasa PaxPower Ultra Quiet
** 2006: +320GB Seagate Barracuda 7200.10 SATA2 ST3320620AS
** 2007: +Sapphire X1950PRO 512MB GDDR3 PCI-Express
* (2008 - 2014) Homebuilt Core 2 Duo 3.0, Windows XP/7 + Ubuntu 8.04 -> 9.10
** 2008: +Gigabyte GA P35C-DS3R, iP35 Express, S775, PCI-E(x16), DDR2/3 1066/1333/800, SATA II, SATA RAID, ATX
** 2008: +Intel Core 2 Duo E8400 2 x 3.00Ghz 6Mb Cache 1333 FSB Dual Core
** 2008: +Corsair XMS6400 4GB DDR2 (2x2GB) 800Mhz Non-ECC
** 2009: +GeForce GTX 260 Core 216
** 2012: +Samsung 830 256GB SSD
* (2014 - ) Homebuilt Core i7-4770, Windows 7/10
** 2014: +Asus Z87-Plus Motherboard (Socket 1150, 4x DDR3, ATX, 2x PCI Express 3.0/2.0, 6x SATA 6.0 Gb/s, USB 3.0)
** 2014: +Intel Core i7 4770 Quad Core Retail CPU (Socket 1150, 3.40GHz, 8MB, Haswell)
** 2014: +Corsair CML16GX3M2A1600C10 Vengeance Low Profile 16GB (2x8GB) DDR3 1600 Mhz CL10 XMP
** 2014: +Sapphire R9 270X 2GB Vapor-X 1050MHz GDDR 5 PCI Express Graphics Card
** 2015: +ASUS Z87-A Motherboard
** 2015: +Cooler Master Hyper 103 92mm Fan
** 2016: +MSI GeForce GTX 970 GAMING Twin Frozr V 4GB Graphics Card (Maxwell)
** 2016: +Samsung 850 EVO 500 GB 2.5 inch Solid State Drive
** 2021: +Corsair RM650x PSU

=== hawaii ===
* (2007 - 2009) Nintendo Wii

=== montana ===
* (2007 - ) Apple Mac Mini (Mid 2007), Mac OS X Tiger -> Lion
** Core 2 Duo T7200 @ 2.0GHz
** 4GB DDR2-667 RAM
** 120GB HDD
** Intel GMA 950

=== pennsylvania ===
* (2008 - 2012) Sony PS3

=== nevada ===
* (2009 - 2011) Samsung NC20 (VIA Nano 1.6), Windows XP + Ubuntu 9.04 -> 9.10

=== maine ===
* (2010 - 2023) Homebuilt Core i5 750, Ubuntu 9.10/12.04/14.04/16.04/18.04/20.04/22.04
** Cooler Master ATCS 840 RC-840-KKN1-GP Black Aluminum ATX Full Tower Computer Case
*** Front Case Fan failed
** Gigabyte GA-P55-UD3R LGA 1156 Intel P55 ATX Intel Motherboard
** Intel Core i5-750 Lynnfield 2.66GHz LGA 1156 95W Quad-Core Processor Model BX80605I5750
** OCZ Gold 4GB (2 x 2GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10666) Desktop Memory Model OCZ3G1333LV4GK
** MSI N8400GS-D256H GeForce 8400 GS 256MB 64-bit GDDR2 PCI Express 2.0 x16 HDCP Ready Video Card
** Seagate Barracuda LP ST31500541AS 1.5TB 5900 RPM SATA 3.0Gb/s 3.5"
** Nexus NX-5000 R3 530W ATX12V v2.2 80 PLUS BRONZE Certified Modular Active PFC Power Supply
** 2011 onwards: +Various SATA HDDs
** 2013: +Crucial Ballistix 16GB (2x8GB) 240-pin DIMM, DDR3 PC3-12800
** 2019: +Timetec Hynix IC 16GB (2x8GB) DDR3 PC3-12800 1600 MHz Non ECC Unbuffered 1.35V/1.5V Dual Rank 240 Pin UDIMM
** 2021: +Corsair RM650 PSU
** 2021: +Cooler Master Hyper 212 CPU Fan
* (2023 - ) Homebuilt Core i5 13500, Ubuntu 22.04
** 2023: +ASRock Z790 PRO RS/D4
** 2023: +Intel Core i5-13500 Desktop Processor 14 cores (6 P-cores + 8 E-cores)
** 2023: +Corsair CMK64GX4M2E3200C16 Vengeance LPX 64GB (2 x 32GB) DDR4 3200

=== arizona ===
* (2010 - ) Apple Macbook Air (Late 2010 13-inch), Mac OS X Snow Leopard -> macOS Sierra
** Core 2 Duo SL9400 @ 1.86 GHz
** 2GB DDR3-1066 RAM
** 128GB SSD
** Nvidia GeForce 320M

=== dakota ===
* (2012 - ) Apple Mac Mini (Mid 2011), Mac OS X Lion -> macOS Sierra
** Core i5-2520M @ 2.5 GHz
** 4GB DDR3-1333 RAM
** 500GB SATA HDD
** AMD Radeon HD 6630M

=== router ===
* (2016 - ) Homebuilt Celeron G1840, pfSense
** IN Win EM050 Matx Black Case
** MSI H97M-G43 Socket 1150 VGA DVI HDMI DisplayPort mATX Motherboard
** Intel Celeron G1840 2.80GHz Socket 1150 2MB L3 Cache
** Corsair 4GB DDR3 1333MHz Memory Module CL9(9-9-9-24) 1.5V Unbuffered Non-ECC
** Corsair Force Series LS 60GB SATA 2.5inch SSD
** 2021: +Corsair RM650 PSU

=== oregon ===
* (2016 - ) Apple MacBook Pro (Late 2016 13-inch Touch Bar), macOS Sierra -> Mojave
** Core i5-6287U @ 3.1GHz
** 16GB DDR3-2133 RAM
** 256GB PCIe SSD
** Intel Iris Graphics 550

=== virginia ===
* (2021 - 2025) Homebuilt Ryzen 5 5600X, Windows 10
** Phanteks Evolv X Antracite Grey Case
** Gigabyte AMD Ryzen X570 AORUS PRO
** Ryzen 5 5600X @ 3.7Ghz
** Corsair Vengeance LPX Black 32GB 3600MHz 2x16GB CAS 18-22-22-42 DDR4
** NVIDIA RTX 3080 Founders Edition
** Corsair Force MP600 1TB M.2 PCIe Gen 4 NVMe SSD
** Corsair RM850 PSU
** 2021: +Samsung 980 PRO M.2 NVMe SSD 2TB
* (2025 -) Homebuilt Ryzen 7 9800X3D, Windows 10
** +MSI MAG X870 Tomahawk
** +AMD Ryzen 7 9800X3D AM5 @ 4.7Ghz
** +Corsair Vengeance 64GB (2*32GB) RGB 6000 MHz CAS 30-36-36-76 DDR5
** +Corsair RM1000x Shift

=== delaware ===
* (2024 -) Steam Deck 1TB OLED

=== york ===
* (2026 -) Beelink Mini S12 Pro
** Intel 12th Gen N100
** 16GB DDR4 RAM
** 500GB M.2 SSD

Docker

2026-01-22T15:05:01Z

Andrew: /* Radarr (Movie Downloads) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:04:48Z

Andrew: /* Deluge */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:04:35Z

Andrew: /* Deluge */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents/deluge:/torrents \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:04:17Z

Andrew: /* Deluge */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:04:00Z

Andrew: /* Jackett (Torrent Gateway) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:03:52Z

Andrew: /* Tautulli (Plex Monitoring/Notifications) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:03:35Z

Andrew: /* Overseerr (Media Requests) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:03:16Z

Andrew: /* Sonarr (TV Downloads) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2026-01-22T15:02:53Z

Andrew: /* Radarr (Movie Downloads) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
Note: torrents and movies should both be under /srv to enable import via hard links

sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv:/srv \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

SnapRAID / MergerFS

2025-12-19T07:18:10Z

Andrew: /* Identifying/Fixing a bad block */

= SnapRAID / MergerFS =

== Setup ==
https://zackreed.me/setting-up-snapraid-on-ubuntu/

Note that if (like me) you use a dedicated snapraid content directory then you'll need to create that by hand for each disk with:

mkdir /mnt/data/disk1/.snapraid

== Partitioning a new data disk ==
Note: "-m 2" here reserves 2% of the filesystem for root-owned files (eg. .../.snapraid/content)
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 2 -T largefile4 /dev/sdX1

== Partitioning a new parity disk ==
Note: "-m 0" here reserves 0% of the filesystem, ensuring that the parity disks are slightly larger than the data disks
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 0 -T largefile4 /dev/sdX1

== Adding a new data disk to mergerfs ==
From: https://zackreed.me/mergerfs-neat-tricks/
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '+>/mnt/data/disk4/srv' .mergerfs

== Removing a data disk from mergerfs ==
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '-/mnt/data/disk4/srv' .mergerfs

== Forcing a resync ==

sudo snapraid sync

== Identifying/Fixing a bad block ==
* Run ddrescue to identify the failing bytes on the disk:
<pre>
ddrescue --ask --verbose --binary-prefixes --idirect --force /dev/sdX /dev/null sdX.map
</pre>
* ddrescue will write out a map file containing start positions and sizes (all in bytes) of good (+) and bad (-) byte ranges
* Get the block size for the volume with <code>tune2fs -l /dev/sdXY | grep "Block size"</code> (we'll call this '''B'''). In my case this is 4096.
* Get the sector size for the disk with <code>fdisk -l /dev/sdX | grep Units</code> (we'll call this '''S'''). In my case this is 512.
* Identify the starting sector for the /dev/sdXY volume (eg. /dev/sda1) with <code>fdisk -l /dev/sdX</code> (we'll call this '''T'''). In my case this is 2048.
* Calculate the offset to go from disk to volume location with <code>(T * S / B)</code> (we'll call this '''F'''). In my case this is 256.
* Run ddrescuelog to list out the bad block locations (using the block size B) and convert to a volume location (by subtracting the offset F):
<pre>
ddrescuelog -b B --list-blocks=- sdX.map | xargs -n 1 expr -F +
</pre>
* Let's call each of these bad volume blocks '''BB'''
* Start debugfs for the volume with :
<pre>
debugfs /dev/sdXY
</pre>
* For each '''BB''' run:
<pre>
testb BB
</pre>
* If debugfs returns "Block BB not in use", then that block isn't part of a file and can safely be overwritten. If it returns "Block BB marked in use" then we need to get an inode number (we'll call it '''I''') and convert that inode number to a file path with:
<pre>
icheck BB
ncheck I
</pre>

For any unused blocks, we need to do the following:
* Check with dd that we’ve got the right block IDs. For each one of these reads we expect to see an error (and “0+0 records in”):
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/sdX of=/dev/null count=1 bs=B skip=$block
done
</pre>

* For each of the bad blocks, write zeros over the block to force it to be reallocated from spare space on the drive. Be careful here – getting it wrong will destroy data! Also note that when reading, “skip” is used to position the input stream, but here “seek” is used to position the output stream:
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/zero of=/dev/sdX count=1 bs=B seek=$block
done
</pre>

* It’s possible that dd will fail to write to the block, in which case try again with hdparm:

** First check that we’ve got the right sectors (we expect to see “SG_IO: bad/missing sense data” for each sector on stderr, so we pipe stdout to /dev/null to avoid noise). Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors:
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --read-sector $block /dev/sdX > /dev/null
done
</pre>

** Assuming we’ve seen the expected errors, write zeros over each of the bad sectors. Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors. Be careful here – getting it wrong will destroy data! You may be asked to add a “—yes-i-know-what-i-am-doing” flag.
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --write-sector $block /dev/sdX
done
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

For any files reported by `debugfs`:
* Write random data over the bad file, which should force the pending sector to be marked bad and reallocated from spare space on the disk:
<pre>
shred -n 1 –v /path/to/bad/file
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

* Assuming the number of pending sectors has decreased, it’s then ok to delete the bad file:
<pre>
rm /path/to/bad/file
</pre>

* Restore the deleted file:
<pre>
snapraid fix -f /path/to/bad/file
</pre>

More details:
* https://www.smartmontools.org/wiki/BadBlockHowto
* [[Mdadm#Repairing_failing_disk_on_degraded_array]]

Docker

2025-11-25T05:55:23Z

Andrew: /* Automatically */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
Use portainer, or:
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T08:18:02Z

Andrew: /* Minecraft Servers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

sudo docker run -d --name brettropolis \
-e EULA=TRUE -e SERVER_PORT=19152 \
-p 19152:19152/udp \
-v /var/lib/minecraft/brettropolis:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T07:52:39Z

Andrew: /* Minecraft Servers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE -e SERVER_PORT=19142 \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T07:47:12Z

Andrew: /* Bedrock Connect */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132/udp \
-v /var/lib/minecraft/bedrock-connect:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T07:42:17Z

Andrew: /* Minecraft Server */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132 \
-v /var/lib/minecraft/bedrock-connect/config:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Servers ===
sudo docker run -d --name brettopia \
-e EULA=TRUE \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T07:41:32Z

Andrew: /* Minecraft Server */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132 \
-v /var/lib/minecraft/bedrock-connect/config:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Server ===
docker run -d -it -e EULA=TRUE -p 19132:19132/udp -v mc-bedrock-data:/data itzg/minecraft-bedrock-server
sudo docker run -d --name brettopia \
-e EULA=TRUE \
-p 19142:19142/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-11-23T07:29:35Z

Andrew: /* Containers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Bedrock Connect ===
sudo docker run -d --name bedrock-connect \
-e NODB=true \
-p 19132:19132 \
-v /var/lib/minecraft/bedrock-connect/config:/app/config \
--restart unless-stopped \
strausmann/minecraft-bedrock-connect

=== Minecraft Server ===
docker run -d -it -e EULA=TRUE -p 19132:19132/udp -v mc-bedrock-data:/data itzg/minecraft-bedrock-server
sudo docker run -d --name brettopia \
-e EULA=TRUE \
-p 19133:19133/udp \
-v /var/lib/minecraft/brettopia:/data \
--restart unless-stopped \
itzg/minecraft-bedrock-server

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

SnapRAID / MergerFS

2025-11-19T06:46:44Z

Andrew: /* Identifying/Fixing a bad block */

= SnapRAID / MergerFS =

== Setup ==
https://zackreed.me/setting-up-snapraid-on-ubuntu/

Note that if (like me) you use a dedicated snapraid content directory then you'll need to create that by hand for each disk with:

mkdir /mnt/data/disk1/.snapraid

== Partitioning a new data disk ==
Note: "-m 2" here reserves 2% of the filesystem for root-owned files (eg. .../.snapraid/content)
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 2 -T largefile4 /dev/sdX1

== Partitioning a new parity disk ==
Note: "-m 0" here reserves 0% of the filesystem, ensuring that the parity disks are slightly larger than the data disks
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 0 -T largefile4 /dev/sdX1

== Adding a new data disk to mergerfs ==
From: https://zackreed.me/mergerfs-neat-tricks/
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '+>/mnt/data/disk4/srv' .mergerfs

== Removing a data disk from mergerfs ==
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '-/mnt/data/disk4/srv' .mergerfs

== Forcing a resync ==

sudo snapraid sync

== Identifying/Fixing a bad block ==
* Run ddrescue to identify the failing bytes on the disk:
<pre>
ddrescue --ask --verbose --binary-prefixes --idirect --force /dev/sdX /dev/null sdX.map
</pre>
* ddrescue will write out a map file containing start positions and sizes (all in bytes) of good (+) and bad (-) byte ranges
* Get the block size for the volume with <code>tune2fs -l /dev/sdXY | grep "Block size"</code> (we'll call this '''B'''). In my case this is 4096.
* Get the sector size for the disk with <code>fdisk -l /dev/sdX | grep Units</code> (we'll call this '''S'''). In my case this is 512.
* Identify the starting sector for the /dev/sdXY volume (eg. /dev/sda1) with <code>fdisk -l /dev/sdX</code> (we'll call this '''T'''). In my case this is 2048.
* Calculate the offset to go from disk to volume location with <code>(T * S / B)</code> (we'll call this '''O'''). In my case this is 256.
* Run ddrescuelog to list out the bad block locations (using the block size B) and convert to a volume location (by subtracting the offset O):
<pre>
ddrescuelog -b B --list-blocks=- sdX.map | xargs -n 1 -O +
</pre>
* Let's call each of these bad volume blocks '''BB'''
* Start debugfs for the volume with :
<pre>
debugfs /dev/sdXY
</pre>
* For each '''BB''' run:
<pre>
testb BB
</pre>
* If debugfs returns "Block BB not in use", then that block isn't part of a file and can safely be overwritten. If it returns "Block BB marked in use" then we need to get an inode number (we'll call it '''I''') and convert that inode number to a file path with:
<pre>
icheck BB
ncheck I
</pre>

For any unused blocks, we need to do the following:
* Check with dd that we’ve got the right block IDs. For each one of these reads we expect to see an error (and “0+0 records in”):
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/sdX of=/dev/null count=1 bs=B skip=$block
done
</pre>

* For each of the bad blocks, write zeros over the block to force it to be reallocated from spare space on the drive. Be careful here – getting it wrong will destroy data! Also note that when reading, “skip” is used to position the input stream, but here “seek” is used to position the output stream:
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/zero of=/dev/sdX count=1 bs=B seek=$block
done
</pre>

* It’s possible that dd will fail to write to the block, in which case try again with hdparm:

** First check that we’ve got the right sectors (we expect to see “SG_IO: bad/missing sense data” for each sector on stderr, so we pipe stdout to /dev/null to avoid noise). Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors:
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --read-sector $block /dev/sdX > /dev/null
done
</pre>

** Assuming we’ve seen the expected errors, write zeros over each of the bad sectors. Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors. Be careful here – getting it wrong will destroy data! You may be asked to add a “—yes-i-know-what-i-am-doing” flag.
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --write-sector $block /dev/sdX
done
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

For any files reported by `debugfs`:
* Write random data over the bad file, which should force the pending sector to be marked bad and reallocated from spare space on the disk:
<pre>
shred -n 1 –v /path/to/bad/file
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

* Assuming the number of pending sectors has decreased, it’s then ok to delete the bad file:
<pre>
rm /path/to/bad/file
</pre>

* Restore the deleted file:
<pre>
snapraid fix -f /path/to/bad/file
</pre>

More details:
* https://www.smartmontools.org/wiki/BadBlockHowto
* [[Mdadm#Repairing_failing_disk_on_degraded_array]]

Windows 10 Tips

2025-10-22T15:12:44Z

Andrew: /* Running rsyncd automatically */

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
** Leave the username/password blank and then follow: http://www.aboutmyip.com/AboutMyXApp/DisplayFAQ.do?fid=22. Simply set the user to "Local System".
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

== Virpil CM3 Throttle ==
https://www.youtube.com/watch?v=JDSk2oADsZg

Windows 10 Tips

2025-10-22T15:12:08Z

Andrew: /* Running rsyncd automatically */

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
** For problems with starting the service: http://www.aboutmyip.com/AboutMyXApp/DisplayFAQ.do?fid=22. Simply set the user to "Local System".
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

== Virpil CM3 Throttle ==
https://www.youtube.com/watch?v=JDSk2oADsZg

Windows 10 Tips

2025-10-22T15:11:58Z

Andrew: /* Running rsyncd automatically */

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
** For problems with starting the service: http://www.aboutmyip.com/AboutMyXApp/DisplayFAQ.do?fid=22. Simply set the user to "Local System"
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

== Virpil CM3 Throttle ==
https://www.youtube.com/watch?v=JDSk2oADsZg

Windows 10 Tips

2025-10-22T15:06:45Z

Andrew: /* Running rsyncd automatically */

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
** For problems with starting the service: http://www.aboutmyip.com/AboutMyXApp/DisplayFAQ.do?fid=22
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

== Virpil CM3 Throttle ==
https://www.youtube.com/watch?v=JDSk2oADsZg

Snapshot backups using rsync

2025-10-22T14:44:43Z

Andrew: /* Example 3: Backup of C:\Documents and Settings on alaska */

== Intro ==
The scripts on this page are designed to allow the backup of a set of directories to a defined location, with the backups preserving the state of those directories from a number of different times in the past. They require a linux box with a free disk partition to act as the backup server, and the instructions below are designed for Ubuntu, so other distros may require slightly different steps. In summary, they will give you a snapshot directory with contents would look something like (as of 26th Sept 2006):
<pre>
Contents of /mnt/snapshot:
drwxr-xr-x 7 root root 4096 2006-09-26 00:01 daily.0
drwxr-xr-x 7 root root 4096 2006-09-25 00:00 daily.1
drwxr-xr-x 7 root root 4096 2006-09-24 00:00 daily.2
drwxr-xr-x 7 root root 4096 2006-09-23 00:00 daily.3
drwxr-xr-x 7 root root 4096 2006-09-22 00:00 weekly.0
drwxr-xr-x 5 root root 4096 2006-09-15 00:00 weekly.1
drwxr-xr-x 2 root root 4096 2006-09-08 00:00 weekly.2
drwxr-xr-x 2 root root 4096 2006-09-01 00:00 monthly.0
drwxr-xr-x 2 root root 4096 2006-08-01 00:00 monthly.1
drwxr-xr-x 2 root root 4096 2006-01-01 00:00 annual.0
</pre>
Note the timestamps of these directories - each one captures the state of the location(s) to be backed up at the time shown.
The actual backup process uses [http://samba.anu.edu.au/rsync/ rsync] and hard links to ensure that if a file doesn't change between two snapshots, then it doesn't take up any additional space (well, virtually no more space).
The contents of this page are based on Mike Rubel's instructions at: http://www.mikerubel.org/computers/rsync_snapshots/ - if you find difficulty understanding/using the scripts here, then you may wish to look at his page for additional help.

== Prerequisites ==
* Install '''rsync''' and '''nfs-kernel-server''' with apt-get (eg. ''sudo apt-get install rsync'')
* http://bretts.org/files/snapshot.tar.bz2

== Instructions ==
* Unzip the contents of '''snapshot.tar.bz2''' to a temporary directory.
* As root, copy the files and directories from the temporary directory to the implied filesystem location (eg. snapshot/etc/cron.d/snapshot -> /etc/cron.d/snapshot, snapshot/var/log/snapshot -> /var/log/snapshot etc.)
* As root, create the directories '''/root/.snapshot''' and '''/mnt/snapshot'''
* Add the following lines to '''/etc/fstab''', substituting your free disk partition, and it's filesystem type, for '''/dev/hdb1''' and '''ext3''':
<pre>
/dev/hdb1 /root/.snapshot ext3 ro 0 2
localhost:/root/.snapshot /mnt/snapshot nfs ro 0 2
</pre>
: (This mounts your backup partition as /root/.snapshot, away from prying eyes, and mounts the NFS exported version of it as /mnt/snapshot. We mount it twice so that non-root users NEVER see a writable version of the backup directory - see Mike Rubels page for more details.)
* Add the following line to '''/etc/exports''' (or create '''/etc/exports''' with this line if it doesn't already exist):
<pre>
/root/.snapshot 127.0.0.1(secure,sync,ro,no_root_squash)
</pre>
: (This defines the NFS share that we will mount as '''/mnt/snapshot''')
* Restart nfs-kernel-server (using ''sudo /etc/init.d/nfs-kernel-server restart'').

== Defining areas to be backed up ==
* For each directory tree to be backed up, create a directory in '''/etc/snapshot''' with a logical name for the backup (the name doesn't matter, as long as it's unique).
* Within the newly created directory, created a file called '''location''' (eg. '''/etc/snapshot/my-backup/location'''), the contents of which should be a single line defining the head of the directory tree to be backed up. This line may be in one of 3 formats:
** For a local directory, simply the fully qualified path to the location to back up (eg. '''/home/fred/docs''')
** For a remote directory accessed via an rsync daemon running on the remote machine, the location in the format ''machinename''::''rsync_module''/''subdirectory'' (eg. '''xp-box::c/Documents and Settings''')
** For a remote directory accessed via an ssh server running on the remote machine, the location in the format ''machinename'':''path'' (eg. '''other-host:/usr/local/src''')
: For remote hosts, an rsync daemon is generally preferable, both for performance reasons, and for ease of use. If ssh is to be used, ssh keys will need to be defined to stop the scripts prompting for a password whenever they're run. However, if the data is being transferred between hosts across an insecure network, ssh may be needed for reasons of security (rsync transmits data between hosts unencrypted, and has a simplistic security model).
* Also within the directory, create a file called '''filters''' (eg. '''/etc/snapshot/my-backup/filters'''), which may contain multiple lines prefixed with a '''-''' to specify locations to exclude from the backup. This file is simply in rsync filters file format (see the rsync man page for more details).

Each one of the locations specified within '''/etc/snapshot''' will end up as a subdirectory of '''/mnt/snapshot''' (eg. this morning's backup of /home/fred will end up in '''/mnt/snapshot/daily.0/home/fred''').

=== Example 1: Backup of /home ===
'''/etc/snapshot/home/location''':
<pre>
/home
</pre>
'''/etc/snapshot/home/filters''':
<pre>
- /andrew/Download/
- /andrew/svn/
</pre>

=== Example 2: Backup of /etc ===
'''/etc/snapshot/etc/location''':
<pre>
/etc
</pre>
'''/etc/snapshot/etc/filters''':
<pre>
</pre>
Note that filters file is empty, since no subdirectories of /etc are excluded from the backup.

=== Example 3: Backup of C:\Documents and Settings on alaska ===
Note that alaska is an XP box running an [[Windows_10_Tips#Running_rsyncd_automatically|rsync daemon]].<br>
'''/etc/snapshot/alaska-home/location''':
<pre>
alaska::c/Documents and Settings
</pre>
'''/etc/snapshot/alaska-home/filters''':
<pre>
- /*/Local Settings/Temp
- /*/Local Settings/Temporary Internet Files
- /Andrew/My Documents/Downloads
</pre>

=== Further Examples ===
These and other examples can be found in http://bretts.org/files/snapshot-examples.tar.bz2

== Notes ==
* The partition used for /root/.snapshot should ideally be on a different disk to the files being backed up, to reduce the risk of a disk failure destroying both the data and the backups.
* The scripts can be used without defining /root/.snapshot as a separate partition, subject to the caveat about separate disks directly above. To do this, simply:
** Don't add the first of the two lines above to '''/etc/fstab'''
** In each of the snapshot scripts within '''/usr/local/sbin''' remove the calls near the beginning and end of the file to remount the /root/.snapshot partition (the beginning of each script remounts this partition as read/write, and the end remounts it as read).

== Setting up a machine with an rsync daemon ==
* Edit /etc/xinetd.d/rsync and add:
<pre>
service rsync
{
disable = no
socket_type = stream
wait = no
user = root
server = /usr/bin/rsync
server_args = --daemon
log_on_failure += USERID
}
</pre>

* Edit /etc/rsyncd.conf and add (for example):
<pre>
use chroot = false
strict modes = false
hosts allow = 192.168.1.0/24

[root]
path = /
comment = Root
read only = true
</pre>

* Restart rsync

== Future Development ==
* It would be nice to have the latest backup burnt to a DVD-RW which could be left in a dedicated DVD-RW drive attached to the backup server. This would help both because DVDs are more robust than hard drives in certain situations (eg. mechanical shock) in case of a problem (eg. power surge) which for some reason destroyed multiple drives on the machine. In addition, the DVD disk could be swapped out periodically to provide an off-site backup copy.
* Some companies provide free or low cost disk space online - this could be used to store a copy of the latest backup for even greater robustness. In addition, since the process uses rsync, unless large numbers of backed up files were changing on a daily basis, there would be relatively little network traffic once the initial backup was rsynced across to the remote site.

Docker

2025-09-19T15:35:02Z

Andrew: /* Overseerr (Media Requests) */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=127:138 -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Docker

2025-09-19T15:33:37Z

Andrew: /* Containers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Overseerr (Media Requests) ===
sudo docker run -d --name overseerr --user=torrent:torrent -e LOG_LEVEL=debug -e TZ=Europe/London \
-e PORT=5055 `#optional` \
-p 5055:5055 \
-v /var/lib/torrent/overseerr/config:/app/config \
--restart unless-stopped \
sctx/overseerr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

SnapRAID / MergerFS

2025-08-21T05:28:46Z

Andrew: /* Identifying/Fixing a bad block */

= SnapRAID / MergerFS =

== Setup ==
https://zackreed.me/setting-up-snapraid-on-ubuntu/

Note that if (like me) you use a dedicated snapraid content directory then you'll need to create that by hand for each disk with:

mkdir /mnt/data/disk1/.snapraid

== Partitioning a new data disk ==
Note: "-m 2" here reserves 2% of the filesystem for root-owned files (eg. .../.snapraid/content)
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 2 -T largefile4 /dev/sdX1

== Partitioning a new parity disk ==
Note: "-m 0" here reserves 0% of the filesystem, ensuring that the parity disks are slightly larger than the data disks
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 0 -T largefile4 /dev/sdX1

== Adding a new data disk to mergerfs ==
From: https://zackreed.me/mergerfs-neat-tricks/
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '+>/mnt/data/disk4/srv' .mergerfs

== Removing a data disk from mergerfs ==
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '-/mnt/data/disk4/srv' .mergerfs

== Forcing a resync ==

sudo snapraid sync

== Identifying/Fixing a bad block ==
* Run ddrescue to identify the failing bytes on the disk:
<pre>
ddrescue --ask --verbose --binary-prefixes --idirect --force /dev/sdX /dev/null sdX.map
</pre>
* ddrescue will write out a map file containing start positions and sizes (all in bytes) of good (+) and bad (-) byte ranges
* Get the block size for the volume with <code>tune2fs -l /dev/sdXY | grep "Block size"</code> (we'll call this '''B'''). In my case this is 4096.
* Get the sector size for the disk with <code>fdisk -l /dev/sdX | grep Units</code> (we'll call this '''S'''). In my case this is 512.
* Identify the starting sector for the /dev/sdXY volume (eg. /dev/sda1) with <code>fdisk -l /dev/sdX</code> (we'll call this '''T'''). In my case this is 2048.
* Run ddrescuelog to list out the bad block locations (using the block size B):
<pre>
ddrescuelog -b B --list-blocks=- sdX.map
</pre>
* For each of these, convert to a block location in the volume (rather than the disk) by subtracting <code>(T * S / B)</code>. In my case that's 256. Let's call each of these bad volume blocks '''BB'''
* Start debugfs for the volume with :
<pre>
debugfs /dev/sdXY
</pre>
* For each '''BB''' run:
<pre>
testb BB
</pre>
* If debugfs returns "Block BB not in use", then that block isn't part of a file and can safely be overwritten. If it returns "Block BB marked in use" then we need to get an inode number (we'll call it '''I''') and convert that inode number to a file path with:
<pre>
icheck BB
ncheck I
</pre>

For any unused blocks, we need to do the following:
* Check with dd that we’ve got the right block IDs. For each one of these reads we expect to see an error (and “0+0 records in”):
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/sdX of=/dev/null count=1 bs=B skip=$block
done
</pre>

* For each of the bad blocks, write zeros over the block to force it to be reallocated from spare space on the drive. Be careful here – getting it wrong will destroy data! Also note that when reading, “skip” is used to position the input stream, but here “seek” is used to position the output stream:
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/zero of=/dev/sdX count=1 bs=B seek=$block
done
</pre>

* It’s possible that dd will fail to write to the block, in which case try again with hdparm:

** First check that we’ve got the right sectors (we expect to see “SG_IO: bad/missing sense data” for each sector on stderr, so we pipe stdout to /dev/null to avoid noise). Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors:
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --read-sector $block /dev/sdX > /dev/null
done
</pre>

** Assuming we’ve seen the expected errors, write zeros over each of the bad sectors. Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors. Be careful here – getting it wrong will destroy data! You may be asked to add a “—yes-i-know-what-i-am-doing” flag.
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --write-sector $block /dev/sdX
done
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

For any files reported by `debugfs`:
* Write random data over the bad file, which should force the pending sector to be marked bad and reallocated from spare space on the disk:
<pre>
shred -n 1 –v /path/to/bad/file
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

* Assuming the number of pending sectors has decreased, it’s then ok to delete the bad file:
<pre>
rm /path/to/bad/file
</pre>

* Restore the deleted file:
<pre>
snapraid fix -f /path/to/bad/file
</pre>

More details:
* https://www.smartmontools.org/wiki/BadBlockHowto
* [[Mdadm#Repairing_failing_disk_on_degraded_array]]

SnapRAID / MergerFS

2025-08-21T04:53:10Z

Andrew: /* Identifying/Fixing a bad block */

= SnapRAID / MergerFS =

== Setup ==
https://zackreed.me/setting-up-snapraid-on-ubuntu/

Note that if (like me) you use a dedicated snapraid content directory then you'll need to create that by hand for each disk with:

mkdir /mnt/data/disk1/.snapraid

== Partitioning a new data disk ==
Note: "-m 2" here reserves 2% of the filesystem for root-owned files (eg. .../.snapraid/content)
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 2 -T largefile4 /dev/sdX1

== Partitioning a new parity disk ==
Note: "-m 0" here reserves 0% of the filesystem, ensuring that the parity disks are slightly larger than the data disks
sudo parted -a optimal -s /dev/sdX -- mklabel gpt mkpart primary 0% 100%
sudo mkfs.ext4 -m 0 -T largefile4 /dev/sdX1

== Adding a new data disk to mergerfs ==
From: https://zackreed.me/mergerfs-neat-tricks/
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '+>/mnt/data/disk4/srv' .mergerfs

== Removing a data disk from mergerfs ==
From within the root of the mergerfs filesystem (eg. /srv)
xattr -w user.mergerfs.srcmounts '-/mnt/data/disk4/srv' .mergerfs

== Forcing a resync ==

sudo snapraid sync

== Identifying/Fixing a bad block ==
* Run ddrescue to identify the failing bytes on the disk:
<pre>
ddrescue --ask --verbose --binary-prefixes --idirect --force /dev/sdX /dev/null sdX.map
</pre>
* ddrescue will write out a map file containing start positions and sizes (all in bytes) of good (+) and bad (-) byte ranges
* Get the block size for the volume with <code>tune2fs -l /dev/sdXY | grep "Block size"</code> (we'll call this '''B'''). In my case this is 4096.
* Get the sector size for the disk with <code>fdisk -l /dev/sdX | grep Units</code> (we'll call this '''S'''). In my case this is 512.
* Identify the starting sector for the /dev/sdXY volume (eg. /dev/sda1) with <code>fdisk -l /dev/sdX</code> (we'll call this '''T'''). In my case this is 2048.
* Run ddrescuelog to list out the bad block locations (using the block size B):
<pre>
ddrescuelog -b B --list-blocks=- sdX.map
</pre>
* For each of these, convert to a block location in the volume (rather than the disk) by subtracting <code>(T * S / B)</code>. In my case that's 256. Let's call each of these bad volume blocks '''BB'''
* Start debugfs for the volume with :
<pre>
debugfs /dev/sdXY
</pre>
* For each '''BB''' run:
<pre>
testb BB
</pre>
* If debugfs returns "Block BB not in use", then that block isn't part of a file and can safely be overwritten. If it returns "Block BB marked in use" then we need to get an inode number (we'll call it '''I''') and convert that inode number to a file path with:
<pre>
icheck BB
ncheck I
</pre>

For any unused blocks, we need to do the following:
* Check with dd that we’ve got the right block IDs. For each one of these reads we expect to see an error (and “0+0 records in”):
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/sdX of=/dev/null count=1 bs=B skip=$block
done
</pre>

* For each of the bad blocks, write zeros over the block to force it to be reallocated from spare space on the drive. Be careful here – getting it wrong will destroy data! Also note that when reading, “skip” is used to position the input stream, but here “seek” is used to position the output stream:
<pre>
for block in `ddrescuelog -b B --list-blocks=- sdX.map`
do
dd if=/dev/zero of=/dev/sdX count=1 bs=B seek=$block
done
</pre>

* It’s possible that dd will fail to write to the block, in which case try again with hdparm:

** First check that we’ve got the right sectors (we expect to see “SG_IO: bad/missing sense data” for each sector on stderr, so we pipe stdout to /dev/null to avoid noise). Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors:
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --read-sector $block /dev/sdX > /dev/null
done
</pre>

** Assuming we’ve seen the expected errors, write zeros over each of the bad sectors. Note that we use '''S''' as the block size for ddrescuelog, since hdparm deals in sectors. Be careful here – getting it wrong will destroy data! You may be asked to add a “—yes-i-know-what-i-am-doing” flag.
<pre>
for block in `ddrescuelog -b S --list-blocks=- sdX.map`
do
hdparm --write-sector $block /dev/sdX
done
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl -a /dev/sdX | grep Pending
</pre>

For any files reported by `debugfs`:
* Write random data over the bad file, which should force the pending sector to be marked bad and reallocated from spare space on the disk:
<pre>
shred –v /path/to/bad/file
</pre>

* Check that the number of failing sectors has decreased:
<pre>
smartctl –a /dev/sdX | grep Pending
</pre>

* Assuming the number of pending sectors has decreased, it’s then ok to delete the bad file:
<pre>
rm /path/to/bad/file
</pre>

More details:
* https://www.smartmontools.org/wiki/BadBlockHowto
* [[Mdadm#Repairing_failing_disk_on_degraded_array]]

Saber Controls

2025-08-12T07:39:07Z

Andrew: /* Saber Controls (ProffieOS 7) */

== Saber Controls (ProffieOS 7) ==

=== Config ===
Backup: \\maine\andrew\Documents\Saber
Config File: ProffieOS\config\e29a-*.h

=== Preset List ===
* Obi-Wan Kenobi (Episode 3)
* Mace Windu
* Anakin Skywalker
* Darth Maul
* Luke Skywalker (Episode 4)
* Luke Skywalker (Episode 6)
* Darth Vader
* Rey Skywalker
* Kylo Ren
* The Mandalorian
* Cal Kestis
* Pod Racer
* Heavy Blade
* Speeder Bike
* Seethe
* Coda
* Ghostbusters
* Star Trek
* Rainbow

=== Blade Off ===
;PWR
:Ignite Blade
;PWR (Double Click)
:Ignite Blade (muted)
;PWR (Long Click - blade up)
:Play Track
:'''PWR (Long Click)''': Stop
;PWR (Long Click - blade parallel)
:Track Player
:'''Turn Right''': Next Track
:'''Turn Left''': Previous Track
:'''PWR (Long Click)''': Stop
;PWR (Hold) + Clash
:Toggle Gesture Sleep
;PWR (Hold) + AUX
:Volume
:'''Turn Right''': Increase Volume
:'''Turn Left''': Decrease Volume
:'''PWR'''/'''AUX''': Exit
---
;AUX (Click)
:Change Preset
;AUX (Long Click)
:Scroll Presets
:'''Turn Right''': Next Preset
:'''Turn Left''': Previous Preset
:'''PWR''': Select Preset and Exit
:'''AUX''': Select First Preset and Exit
;AUX (Hold) + PWR (Click)
:Battery Level

=== Blade On ===
;PWR
:Extinguish Blade
;PWR (Hold) + Clash
:Lockup
;PWR (Hold) + AUX
:Lightning Block
---
;AUX
:Blaster Deflect
;AUX (Long Click)
:Multi-Blast (each swing is a Blaster Deflect)
:'''AUX'''/Clash: Exit
;AUX (Hold) + Stab Down
:Drag
;AUX (Hold) + Stab Up/Parallel
:Melt
---
;Clash
:Clash

Saber Controls

2025-08-12T07:18:58Z

Andrew: /* Blade Off */

Saber Controls

2025-08-12T07:16:45Z

Andrew: /* Blade Off */

== Saber Controls (ProffieOS 7) ==

=== Config ===
Backup: \\maine\andrew\Documents\Saber
Config File: ProffieOS\config\e29a-*.h

=== Preset List ===
* Obi-Wan Kenobi (Episode 3)
* Mace Windu
* Anakin Skywalker
* Darth Maul
* Luke Skywalker (Episode 4)
* Luke Skywalker (Episode 6)
* Darth Vader
* Rey Skywalker
* Kylo Ren
* The Mandalorian
* Cal Kestis
* Pod Racer
* Heavy Blade
* Speeder Bike
* Seethe
* Coda
* Ghostbusters
* Star Trek
* Rainbow

=== Blade Off ===
;PWR (Click)
:Ignite Blade
;PWR (Double Click)
:Ignite Blade (muted)
;PWR (Long Click - blade up)
:Play Track
:'''PWR (Long Click)''': Stop
;PWR (Long Click - blade parallel)
:Track Player
:'''Turn Right''': Next Track
:'''Turn Left''': Previous Track
:'''PWR (Long Click)''': Stop
;PWR (Hold) + Clash
:Toggle Gesture Sleep
;AUX (Click)
:Change Preset
;AUX (Long Click)
:Scroll Presets
:'''Turn Right''': Next Preset
:'''Turn Left''': Previous Preset
:'''PWR''': Select Preset and Exit
:'''AUX''': Select First Preset and Exit
;AUX (Hold) + PWR (Click)
:Battery Level

Saber Controls

2025-08-12T07:14:42Z

Andrew: /* When Off */

Saber Controls

2025-08-12T07:14:28Z

Andrew: /* When Off */

Saber Controls

2025-08-12T07:13:28Z

Andrew: /* When Off */

Saber Controls

2025-08-12T07:10:36Z

Andrew: /* Saber Controls (ProffieOS 7) */

Saber Controls

2025-08-12T07:08:21Z

Andrew: /* Preset List */

== Saber Controls (ProffieOS 7) ==

=== Preset List ===
- Obi-Wan Kenobi (Episode 3)
- Mace Windu
- Anakin Skywalker
- Darth Maul
- Luke Skywalker (Episode 4)
- Luke Skywalker (Episode 6)
- Darth Vader
- Rey Skywalker
- Kylo Ren
- The Mandalorian
- Cal Kestis
- Pod Racer
- Heavy Blade
- Speeder Bike
- Seethe
- Coda
- Ghostbusters
- Star Trek
- Rainbow

=== When Off ===
;PWR
:Ignite Blade
;PWR (Double Click)
:Ignite Blade (muted)
;PWR (Long Click - blade up)
:Play Track
:PWR (Long Click): Stop
;PWR (Long Click - blade parallel)
:Track Player
:'''Turn Right''': Next Track
:'''Turn Left''': Previous Track
:'''PWR (Long Click)''': Stop
;PWR (Hold) + Clash
:Toggle Gesture Sleep
;AUX
:Change Preset
;AUX (Hold)
:Scroll Presets
:'''Turn Right''': Next Preset
:'''Turn Left''': Previous Preset
:'''PWR''': Select Preset
:'''PWR (Long Click)''': Select Preset

Saber Controls

2025-08-12T06:57:55Z

Andrew: Created page with "== Saber Controls (ProffieOS 7) == === Preset List === - === When Off === ;PWR :Ignite Blade ;PWR (Double Click) :Ignite Blade (muted) ;PWR (Long Click - blade up) :Play Tr..."

== Saber Controls (ProffieOS 7) ==

=== Preset List ===
-

=== When Off ===
;PWR
:Ignite Blade
;PWR (Double Click)
:Ignite Blade (muted)
;PWR (Long Click - blade up)
:Play Track
:PWR (Long Click): Stop
;PWR (Long Click - blade parallel)
:Track Player
:'''Turn Right''': Next Track
:'''Turn Left''': Previous Track
:'''PWR (Long Click)''': Stop
;PWR (Hold) + Clash
:Toggle Gesture Sleep
;AUX
:Change Preset
;AUX (Hold)
:Scroll Presets
:'''Turn Right''': Next Preset
:'''Turn Left''': Previous Preset
:'''PWR''': Select Preset
:'''PWR (Long Click)''': Select Preset

Main Page

2025-08-12T06:20:17Z

Andrew: /* Other */

== briki Contents ==
=== Technology ===
==== Software ====
* [[Linux Tips]]
* [[Windows 10 Tips]]
* [[Windows XP Tips]]
* [[MacOS X Tips]]
* [[Networking Tips]]

==== Hardware ====
* [[Machine List]]
* [[Sony TR Tips]]
* [[SPV M5000 Tips]]
* [[Speedtouch 780 Tips]]

=== Other ===
* [[Bikes]]
* [[Saber Controls]]
* [[Simpsons Quotes]]
* [[Temporary Pages]]
* [[Alex]]

== Other Contents ==
=== Home ===
----
* [https://home-assistant.bretts.org Home Assistant] (protected)
* [https://arlo.netgear.com Security Cameras] (protected)

=== Media ===
----
* [https://plex.bretts.org Plex] (protected)
* [https://radarr.bretts.org Radarr] ([https://radarr-lowres.bretts.org low-res]) (private)
* [https://sonarr.bretts.org Sonarr] (private)
* [https://tautulli.bretts.org Tautulli (Plex status)] (private)
* [http://maine.bretts.org:33400 Plex WebTools] (private)
* [http://maine.bretts.org:9117 Jackett] (private)

=== Admin ===
----
==== Network ====
* [https://router.bretts.org:1443/ Router] (protected)
* [https://unifi.bretts.org Unifi Controller] (protected)

==== Monitoring ====
* [http://netdata.bretts.org Device Monitoring (netdata)]
* [https://ntopng.bretts.org Bandwidth Monitoring (ntopng)] (protected)
* [http://maine.bretts.org/mon/ Process Monitoring (nagios4)] [https://maine.bretts.org/cgi-bin/nagios4/status.cgi?host=all Services](protected)
* [http://maine.bretts.org/graph/bretts.org/ Network Monitoring (munin)]
* [https://maine.bretts.org:9443 Container Monitoring (portainer)]
* [http://maine.bretts.org:3001/ Grafana] (protected)

==== Torrents ====
* [https://deluge.bretts.org Deluge] (protected)

==== Apache (protected) ====
* [http://maine.bretts.org/doc/ Manual]
* [http://maine.bretts.org/server-info Server Info]
* [http://maine.bretts.org/server-status Server Status]
* [http://maine.bretts.org/php-info/ PHP Info]

==== Tomcat (protected) ====
* [http://maine.bretts.org/tomcat/manager/html Manager]

=== Development ===
* [http://bitbucket.bretts.org/ BitBucket]
* [http://jira.bretts.org/ JIRA]
* [http://bamboo.bretts.org/ Bamboo]

== About ==
'''briki''' (''bretts.org wiki'') administered by Andrew Brett. Feel free to contribute to pre-existing pages.

Machine List

2025-08-04T12:36:07Z

Andrew: /* History */

Docker

2025-02-25T06:56:30Z

Andrew:

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Byparr (Alternative CloudFlare proxy bypass) ===
sudo docker run -d --name=byparr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/thephaseless/byparr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}

Windows 10 Tips

2025-02-22T12:17:46Z

Andrew:

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

== Virpil CM3 Throttle ==
https://www.youtube.com/watch?v=JDSk2oADsZg

Windows 10 Tips

2025-02-17T03:49:00Z

Andrew:

== Monitor Switcher ==
https://sourceforge.net/projects/monitorswitcher/

== Monitor Test Patterns ==
* Limited vs. Full Range: http://www.lagom.nl/lcd-test/img/blacktest.png
* Chroma Subsampling: https://www.rtings.com/images/test-materials/2017/chroma-444.png

== Setup MPC-BE ==
* MPC-BE: https://chamconsoft.com/cmc/forums/?w3=dmlld3RvcGljLnBocD90PTE5Nw==
* madVR: https://forum.kodi.tv/showthread.php?tid=259188

== Rename Network ==
https://www.howtogeek.com/364291/how-to-change-or-rename-the-active-network-profile-name-in-windows-10/

== Installing WSL ==
https://docs.microsoft.com/en-us/windows/wsl/install-win10

Note: If you see Error 0x80370102, you may need to enable virtualization in your motherboard BIOS: https://ourcodeworld.com/articles/read/1283/how-to-enable-amd-virtualization-on-the-aorus-x570-motherboard

=== Running rsyncd automatically (DEPRECATED) ===
* Set '''RSYNC_ENABLE=true''' in ''/etc/default/rsync''
* Create ''/etc/rsyncd.conf'' with the contents (for example):
[users]
path = /mnt/c/Users
comment = Users
read only = true
* WSL2 virtual machines run on a separate NATed network, so we need to forward the rsync port from the real LAN to the virtual machine:
netsh interface portproxy add v4tov4 listenport=873 listenaddress=0.0.0.0 connectport=873 connectaddress=127.0.0.1
* Go to Settings -> Update & Security -> Windows Security -> Firewall & network protection -> Advanced Settings -> Inbound Rules -> New Rule...
** Select "Port"
** Set "Specific local ports" to 873
** Select "Allow the connection"
** Select only "Private"
** Set the "Name" to "rsync"

== Running rsyncd automatically ==
* Install DeltaCopy Server from http://www.aboutmyip.com/AboutMyXApp/DeltaCopy.jsp
* Add an application rule for rsync.exe in Settings -> Update & Security -> Windows Security -> Firewall & network protection

== Renaming networks ==
https://www.ghacks.net/2021/10/25/how-to-change-network-names-on-windows-11/

Machine List

2025-02-07T06:46:29Z

Andrew: /* virginia */

Machine List

2025-02-07T02:55:51Z

Andrew:

== History ==

=== Pre-networking ===
* (1988-1993) 8086 4.2MHz, MS-DOS 3.3
* (1993-1995) 386SX 16MHz, Windows 3.1 + MS-DOS 5.0
* (1995-1996) 486DX 50MHz, Windows 3.1 + MS-DOS 5.0/Windows 95

=== indiana ===
* (1996 - 1999) Fujitsu-ICL Pentium 90, Windows 95 + Windows NT 4.0
** 1996?: +Orchid Righteous 3D

=== colorado ===
* (1999 - 2001) Homebuilt Celeron 300, Windows 98/Me/XP
** Matrox Millennium G200?
* (2001 - 2002) Homebuilt Pentium 3 800, Windows XP
* (2002 - 2005) Homebuilt Pentium 3 800, Mandriva Linux 8.0/9.0/10.0
* (2005 - 2008) Dell Dimension 4300 (Pentium 4 1.8), Kubuntu 6.04
** 2005: +128MB Sparkle GeForce MX4000 AGP
** 2005: +Hauppauge WinTV-NOVA-T-MCE
** 2006: +Seagate Barracuda 7200.10 320GB ST3320620A
** 2006: +NEC-4570 16x DVD±RW/RAM Black
* (2008 - 2010) Dell Dimension 4300 (Pentium 4 1.8), Ubuntu 8.04
** 2008: +Seagate Barracuda 7200.10 750GB SATA2 3.5"
** 2008: +SATA & IDE PCI Controller Card

=== texas ===
* (2002 - 2005) Dell Dimension 4300 (Pentium 4 1.8), Windows XP
** GeForce 2 MX400?

=== vermont ===
* (2004 - 2006) Sony Vaio TR5MP (Pentium M 1.0), Windows XP
* (2006 - 2008) Sony Vaio TR5MP (Pentium M 1.0), Ubuntu 6.10/7.04/7.10/8.04

=== alaska ===
* (2005 - 2007) Homebuilt Athlon64 3500+, Windows XP + Ubuntu 7.04 -> 8.04
** Cooler Master Wave Master TAC-T01-E1C Silver All Aluminum Alloy ATX Mid Tower Computer Case
** MSI K8N Diamond
** AMD Athlon 64 3500+
** 512MB Corsair Value Select 400MHz DDR Memory Stick
** 128MB Sparkle GeForce 6600GT PCI-E
** 300Gb Maxtor DiamondMax 10 ATA/133 6L300S0
** NEC ND-3520 Silver
** 460W Akasa PaxPower Ultra Quiet
** 2006: +320GB Seagate Barracuda 7200.10 SATA2 ST3320620AS
** 2007: +Sapphire X1950PRO 512MB GDDR3 PCI-Express
* (2008 - 2014) Homebuilt Core 2 Duo 3.0, Windows XP/7 + Ubuntu 8.04 -> 9.10
** 2008: +Gigabyte GA P35C-DS3R, iP35 Express, S775, PCI-E(x16), DDR2/3 1066/1333/800, SATA II, SATA RAID, ATX
** 2008: +Intel Core 2 Duo E8400 2 x 3.00Ghz 6Mb Cache 1333 FSB Dual Core
** 2008: +Corsair XMS6400 4GB DDR2 (2x2GB) 800Mhz Non-ECC
** 2009: +GeForce GTX 260 Core 216
** 2012: +Samsung 830 256GB SSD
* (2014 - ) Homebuilt Core i7-4770, Windows 7/10
** 2014: +Asus Z87-Plus Motherboard (Socket 1150, 4x DDR3, ATX, 2x PCI Express 3.0/2.0, 6x SATA 6.0 Gb/s, USB 3.0)
** 2014: +Intel Core i7 4770 Quad Core Retail CPU (Socket 1150, 3.40GHz, 8MB, Haswell)
** 2014: +Corsair CML16GX3M2A1600C10 Vengeance Low Profile 16GB (2x8GB) DDR3 1600 Mhz CL10 XMP
** 2014: +Sapphire R9 270X 2GB Vapor-X 1050MHz GDDR 5 PCI Express Graphics Card
** 2015: +ASUS Z87-A Motherboard
** 2015: +Cooler Master Hyper 103 92mm Fan
** 2016: +MSI GeForce GTX 970 GAMING Twin Frozr V 4GB Graphics Card (Maxwell)
** 2016: +Samsung 850 EVO 500 GB 2.5 inch Solid State Drive
** 2021: +Corsair RM650x PSU

=== hawaii ===
* (2007 - 2009) Nintendo Wii

=== montana ===
* (2007 - ) Apple Mac Mini (Mid 2007), Mac OS X Tiger -> Lion
** Core 2 Duo T7200 @ 2.0GHz
** 4GB DDR2-667 RAM
** 120GB HDD
** Intel GMA 950

=== pennsylvania ===
* (2008 - 2012) Sony PS3

=== nevada ===
* (2009 - 2011) Samsung NC20 (VIA Nano 1.6), Windows XP + Ubuntu 9.04 -> 9.10

=== maine ===
* (2010 - 2023) Homebuilt Core i5 750, Ubuntu 9.10/12.04/14.04/16.04/18.04/20.04/22.04
** Cooler Master ATCS 840 RC-840-KKN1-GP Black Aluminum ATX Full Tower Computer Case
*** Front Case Fan failed
** Gigabyte GA-P55-UD3R LGA 1156 Intel P55 ATX Intel Motherboard
** Intel Core i5-750 Lynnfield 2.66GHz LGA 1156 95W Quad-Core Processor Model BX80605I5750
** OCZ Gold 4GB (2 x 2GB) 240-Pin DDR3 SDRAM DDR3 1333 (PC3 10666) Desktop Memory Model OCZ3G1333LV4GK
** MSI N8400GS-D256H GeForce 8400 GS 256MB 64-bit GDDR2 PCI Express 2.0 x16 HDCP Ready Video Card
** Seagate Barracuda LP ST31500541AS 1.5TB 5900 RPM SATA 3.0Gb/s 3.5"
** Nexus NX-5000 R3 530W ATX12V v2.2 80 PLUS BRONZE Certified Modular Active PFC Power Supply
** 2011 onwards: +Various SATA HDDs
** 2013: +Crucial Ballistix 16GB (2x8GB) 240-pin DIMM, DDR3 PC3-12800
** 2019: +Timetec Hynix IC 16GB (2x8GB) DDR3 PC3-12800 1600 MHz Non ECC Unbuffered 1.35V/1.5V Dual Rank 240 Pin UDIMM
** 2021: +Corsair RM650 PSU
** 2021: +Cooler Master Hyper 212 CPU Fan
* (2023 - ) Homebuilt Core i5 13500, Ubuntu 22.04
** 2023: +ASRock Z790 PRO RS/D4
** 2023: +Intel Core i5-13500 Desktop Processor 14 cores (6 P-cores + 8 E-cores)
** 2023: +Corsair CMK64GX4M2E3200C16 Vengeance LPX 64GB (2 x 32GB) DDR4 3200

=== arizona ===
* (2010 - ) Apple Macbook Air (Late 2010 13-inch), Mac OS X Snow Leopard -> macOS Sierra
** Core 2 Duo SL9400 @ 1.86 GHz
** 2GB DDR3-1066 RAM
** 128GB SSD
** Nvidia GeForce 320M

=== dakota ===
* (2012 - ) Apple Mac Mini (Mid 2011), Mac OS X Lion -> macOS Sierra
** Core i5-2520M @ 2.5 GHz
** 4GB DDR3-1333 RAM
** 500GB SATA HDD
** AMD Radeon HD 6630M

=== router ===
* (2016 - ) Homebuilt Celeron G1840, pfSense
** IN Win EM050 Matx Black Case
** MSI H97M-G43 Socket 1150 VGA DVI HDMI DisplayPort mATX Motherboard
** Intel Celeron G1840 2.80GHz Socket 1150 2MB L3 Cache
** Corsair 4GB DDR3 1333MHz Memory Module CL9(9-9-9-24) 1.5V Unbuffered Non-ECC
** Corsair Force Series LS 60GB SATA 2.5inch SSD
** 2021: +Corsair RM650 PSU

=== oregon ===
* (2016 - ) Apple MacBook Pro (Late 2016 13-inch Touch Bar), macOS Sierra -> Mojave
** Core i5-6287U @ 3.1GHz
** 16GB DDR3-2133 RAM
** 256GB PCIe SSD
** Intel Iris Graphics 550

=== virginia ===
* (2021 - 2025) Homebuilt Ryzen 5 5600X, Windows 10
** Phanteks Evolv X Antracite Grey Case
** Gigabyte AMD Ryzen X570 AORUS PRO
** Ryzen 5 5600X @ 3.7Ghz
** Corsair Vengeance LPX Black 32GB 3600MHz 2x16GB CAS 18-22-22-42 DDR4
** NVIDIA RTX 3080 Founders Edition
** Corsair Force MP600 1TB M.2 PCIe Gen 4 NVMe SSD
** Corsair RM850 PSU
* (2025 -) Homebuilt Ryzen 7 9800X3D, Windows 10
** +MSI MAG X870 Tomahawk
** +AMD Ryzen 7 9800X3D AM5 @ 4.7Ghz
** +Corsair Vengeance 64GB (2*32GB) RGB 6000 MHz CAS 30-36-36-76 DDR5
** +Corsair RM1000x Shift

Docker

2024-12-04T06:09:03Z

Andrew: /* Containers */

== Useful Commands ==

; docker ps -a: List all containers
; docker container inspect <container>: Show details of <container>
; docker logs <container>: Show logs for <container>
; docker exec -it <container> /bin/bash: Start an interactive shell in <container>

== Updating container ==

=== Manually ===
sudo docker pull <image>
sudo docker stop <container>
sudo docker rm <container>
<docker run command>

=== Automatically ===
sudo docker run --rm -v /var/run/docker.sock:/var/run/docker.sock taisun/updater --oneshot <container>

== Containers ==

=== Portainer ===
sudo docker run -d --name portainer \
-p 8000:8000 -p 9443:9443 \
-v /var/run/docker.sock:/var/run/docker.sock -v /var/lib/portainer:/data \
-v /etc/ssl/bretts.org:/certs \
--restart unless-stopped \
portainer/portainer-ce \
--sslcert /certs/fullchain.pem --sslkey /certs/key.pem

=== Plex ===

Get your claim token: https://www.plex.tv/claim/

Create the container with the claim token substituted:
sudo docker run -d --name plex --network=host -e PLEX_UID=111 -e PLEX_GID=127 -e TZ=Europe/London -e PLEX_CLAIM=<CLAIM_TOKEN> \
-v /var/lib/plexmediaserver:/config -v /srv:/srv --device=/dev/dri:/dev/dri \
--restart unless-stopped \
plexinc/pms-docker:plexpass

=== Tautulli (Plex Monitoring/Notifications) ===
sudo docker run -d --name tautulli -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8181:8181 \
-v /var/lib/torrent/tautulli/config:/config -v /var/lib/plexmediaserver/Library/Logs:/logs \
--restart unless-stopped \
linuxserver/tautulli

=== Jackett (Torrent Gateway) ===
sudo docker run -d --name=jackett -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 9117:9117 \
-v /var/lib/torrent/jackett/config:/config -v /var/lib/torrent/jackett/downloads:/downloads \
--restart unless-stopped \
linuxserver/jackett

=== FlareSolverr (CloudFlare proxy bypass) ===
sudo docker run -d --name=flaresolverr \
-p 8191:8191 \
-e LOG_LEVEL=info \
--restart unless-stopped \
ghcr.io/flaresolverr/flaresolverr:latest

=== Deluge ===
sudo docker run -d --name deluge -e PUID=127 -e PGID=138 -e TZ=Europe/London \
--net=host \
-v /var/lib/torrent/deluged/config:/config -v /srv/incoming/torrents/deluge:/srv/incoming/torrents/deluge \
-v /etc/ssl/bretts.org:/etc/ssl/bretts.org \
--restart unless-stopped \
linuxserver/deluge

Since user groups don't seem to apply across the docker boundary, "torrent" will need to be given explicit permission to the private key file via an ACL:
setfacl -m "u:torrent:rw" /etc/ssl/bretts.org/key.pem

=== Radarr (Movie Downloads) ===
sudo docker run -d --name radarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 7878:7878 \
-v /var/lib/torrent/radarr/config:/config -v /srv/videos/programs/movies:/movies -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/radarr

=== Sonarr (TV Downloads) ===
sudo docker run -d --name=sonarr -e PUID=127 -e PGID=138 -e TZ=Europe/London \
-p 8989:8989 \
-v /var/lib/torrent/sonarr/config:/config -v /srv/videos/programs/tv:/tv -v /srv/incoming/torrents/deluge:/downloads \
--restart unless-stopped \
linuxserver/sonarr

=== Unifi ===
sudo docker run -d --name=unifi-controller -e PUID=140 -e PGID=150 \
-p 3478:3478/udp -p 10001:10001/udp -p 18080:18080 -p 18081:18081 -p 18443:18443 -p 18880:18880 -p 6789:6789 \
-v /var/lib/unifi:/config \
--restart unless-stopped \
linuxserver/unifi-controller

=== Home-Assistant (as part of host network) ===
sudo docker run -d --name=home-assistant -e TZ=Europe/London \
--net=host \
-v /var/lib/home-assistant/config:/config -v /srv:/media -v /etc/ssl/bretts.org:/etc/ssl/bretts.org -v /var/www/html/arlo-snapshots:/arlo-snapshots \
--restart unless-stopped \
homeassistant/home-assistant

=== Stash ===
sudo docker run -d --name stash \
-e STASH_GENERATED=/generated/ -e STASH_METADATA=/metadata/ -e STASH_CACHE=/cache/ \
-e STASH_STASH=/data/ \
-p 9999:9999 \
-v /var/lib/stash:/root/.stash -v /var/lib/stash/metadata:/metadata -v /var/lib/stash/cache:/cache -v /var/lib/stash/blobs:/blobs -v /var/lib/stash/generated:/generated \
-v /var/lib/stash/data:/data -v /srv/porn:/srv/porn -v /srv/incoming/torrents/deluge/porn:/srv/incoming/torrents/deluge/porn \
-v /etc/localtime:/etc/localtime:ro \
--restart unless-stopped \
stashapp/stash

=== Atlassian ===

==== JIRA ====
Note: In this instance JIRA is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name jira
sudo docker run -d --name=jira -e TZ=Europe/London \
-e ATL_TOMCAT_SCHEME=https -e ATL_TOMCAT_SECURE=true -e ATL_PROXY_NAME=jira.bretts.org -e ATL_PROXY_PORT=443 \
-p 7980:8080 \
-v jira:/var/atlassian/application-data/jira \
--restart unless-stopped \
atlassian/jira-software

Docker JIRA runs with a uid and gid of 2001. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2001 jira-docker
sudo adduser --system --no-create-home --uid 2001 --gid 2001 jira-docker

==== Bitbucket====
Note: In this instance Bitbucket is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bitbucket
sudo docker run -d --name=bitbucket -e TZ=Europe/London \
-e SERVER_SCHEME=https -e SERVER_SECURE=true -e SERVER_PROXY_NAME=bitbucket.bretts.org -e SERVER_PROXY_PORT=443 \
-p 7990:7990 -p 7999:7999 \
-v bitbucket:/var/atlassian/application-data/bitbucket \
--restart unless-stopped \
atlassian/bitbucket-server

Docker Bitbucket runs with a uid and gid of 2003. To ensure they show up as a named user in the hosting system you can run:
sudo addgroup --gid 2003 bitbucket-docker
sudo adduser --system --no-create-home --uid 2003 --gid 2003 bitbucket-docker

==== Bamboo ====
Note: In this instance Bamboo is configured (with `-v`) using a named volume, rather than a bind mount
sudo docker volume create --name bamboo
sudo docker run -d --name=bamboo -e TZ=Europe/London \
-p 54663:54663 -p 7970:8085 \
-v bamboo:/var/atlassian/application-data/bamboo \
--restart unless-stopped \
atlassian/bamboo-server

===== Limitations =====
* Bamboo runs with a uid of 1000, which means it's likely to clash with a real user in the containing host
* Bamboo container doesn't support any reverse proxy configuration, which means hiding it behind nginx is likely to result in broken Application Links. This can be worked around by manually editing /opt/atlassian/bamboo/conf/server.xml, but those changes will be overwritten on every container upgrade.

== Tips / Fixes ==

=== Tautulli slow to start ===
This may be due to an attempt to chown a large number of files.
Login to the container:
sudo docker exec -it <container> /bin/bash
Disable the chown step by editing <code>/etc/cont-init.d/30-config</code> and commenting out the chown command.

=== Adding an SSL cert for Unifi ===
sudo openssl pkcs12 -export -inkey /etc/ssl/bretts.org/key.pem -in /etc/ssl/bretts.org/fullchain.pem -out /tmp/cert.p12 -name unifi -password pass:temppass
sudo keytool -importkeystore -deststorepass aircontrolenterprise -destkeypass aircontrolenterprise -destkeystore /var/lib/unifi/data/keystore -srckeystore /tmp/cert.p12 -srcstoretype PKCS12 -srcstorepass temppass -alias unifi -noprompt
sudo docker restart unifi-controller
sudo rm /tmp/cert.p12

=== Local DNS resolution fails on docker 18.09 ===
This may be the result of a bug: https://bugs.launchpad.net/ubuntu/+source/docker.io/+bug/1820278. Normally the container's /etc/resolv.conf should mirror that of the host, but in this case it seems to just be a default version. As a workaround, create /etc/docker/daemon.json with the following contents:

{
"dns": ["192.168.1.1", "8.8.8.8"],
"dns-search": ["bretts.org"]
}