Deploy: Docker #

The container runs the Node server with SQLite and filesystem blobs on a volume. It is the shortest path to a PDS on a host you control.

Pull the image #

atcr.io publishes the images. It is a container registry built on atproto, so the image carries the same handle as everything else here. A pull needs an atproto account. Log in once with your handle and an app password.

docker login atcr.io          # handle + app password

Run it #

# Generate the signing secret once and keep it.
openssl rand -hex 32 > jwt-secret

docker run -d \
  -p 3000:3000 \
  -v pds-data:/data \
  -e PDS_HOSTNAME=your-hostname.com \
  -e JWT_SECRET="$(cat jwt-secret)" \
  -e PDS_PASSWORD='your account password' \
  atcr.io/chadtmiller.com/pds.js:latest

PDS_HOSTNAME, JWT_SECRET and PDS_PASSWORD are required, and the container exits without them. See configuration for the reason, and for every optional variable. The container writes its data to the /data volume.

Generate that secret once, not per run. It signs session tokens, so a fresh secret on every restart signs out every user.

The image targets linux/amd64. On arm64 it runs under emulation.

Finish the setup #

Terminate TLS in front of the container with nginx or Caddy. Point your-hostname.com at it.

Then register the DID with the PLC directory. Run this once, from a checkout of the repository, after the PDS answers at its public URL:

npm run setup -- --pds https://your-hostname.com

Build it yourself #

docker build -t pds.js .

The build takes docker/server.js as its entrypoint. That file composes @pdsjs/node from the environment, the same way examples/node/index.js does.