Ubiquiti UniFi Network Application for managing UniFi access points, switches, and gateways.
| Port | 8443 |
| Registry | ghcr.io/daemonless/unifi |
| Source | https://ui.com/ |
| Website | https://ui.com/ |
| Tag | Description | Best For |
|---|---|---|
latest |
Upstream Binary. Built from official release. | Most users — recommended. |
pkg |
FreeBSD Quarterly. Uses stable, tested packages. | Production stability. |
pkg-latest |
FreeBSD Latest. Rolling package updates. | Staying current. |
Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions.
services:
unifi:
image: "ghcr.io/daemonless/unifi:latest"
container_name: unifi
environment:
- PUID=1000 # User ID for the application process
- PGID=1000 # Group ID for the application process
- TZ=UTC # Timezone for the container
volumes:
- "/path/to/containers/unifi:/config"
ports:
- "8443:8443"
- "8080:8080"
- "8843:8843"
- "8880:8880"
- "6789:6789"
- "3478:3478"
- "10001:10001"
annotations:
org.freebsd.jail.allow.mlock: "true"
# always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
restart: alwaysSave as compose.yaml, then run podman-compose up -d.
.env:
# .env
DIRECTOR_PROJECT=unifi
PUID=1000
PGID=1000
TZ=UTC
appjail-director.yml:
# appjail-director.yml
options:
- virtualnet: ':<random> default'
- nat:
services:
unifi:
name: unifi
options:
- container: 'boot args:--pull'
- expose: '8443:8443 proto:tcp'
- expose: '8080:8080 proto:tcp'
- expose: '8843:8843 proto:tcp'
- expose: '8880:8880 proto:tcp'
- expose: '6789:6789 proto:tcp'
- expose: '3478:3478 proto:udp'
- expose: '10001:10001 proto:udp'
oci:
user: root
environment:
- PUID: !ENV '${PUID}'
- PGID: !ENV '${PGID}'
- TZ: !ENV '${TZ}'
volumes:
- unifi: /config
volumes:
unifi:
device: '/path/to/containers/unifi'Makejail:
# Makejail
ARG tag=latest
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/unifi:${tag}
SET allow.mlock=1
Save the files above, then run appjail-director up.
Note: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
podman run -d --name unifi \
-p 8443:8443 \
-p 8080:8080 \
-p 8843:8843 \
-p 8880:8880 \
-p 6789:6789 \
-p 3478:3478 \
-p 10001:10001 \
--annotation 'org.freebsd.jail.allow.mlock=true' \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=UTC \
-v /path/to/containers/unifi:/config \
ghcr.io/daemonless/unifi:latestSave as run.sh, then run sh run.sh.
appjail oci run -Pd \
-o overwrite=force \
-o container="args:--pull" \
-o virtualnet=":<random> default" \
-o nat \
-o expose="8443:8443 proto:tcp" \
-o expose="8080:8080 proto:tcp" \
-o expose="8843:8843 proto:tcp" \
-o expose="8880:8880 proto:tcp" \
-o expose="6789:6789 proto:tcp" \
-o expose="3478:3478 proto:udp" \
-o expose="10001:10001 proto:udp" \
-e PUID=1000 \
-e PGID=1000 \
-e TZ=UTC \
-o fstab="/path/to/containers/unifi /config <pseudofs>" \
ghcr.io/daemonless/unifi:latest unifiSave as run.sh, then run sh run.sh.
Note: Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the IPv4 address assigned by the virtual network.
Warning
Bastille's OCI support is experimental. It requires buildah, shares the host network stack (inherit), and persists image-declared volumes under --data-path.
services:
unifi:
image: "ghcr.io/daemonless/unifi:latest"
container_name: unifi
network_mode: host # jail shares host networking
environment:
- PUID=1000
- PGID=1000
- TZ=UTCSave as podman-compose.yml, then run bastille up. Or via CLI:
bastille create -O \
--env PUID=1000 \
--env PGID=1000 \
--env TZ=UTC \
--data-path /path/to/containers/unifi \
unifi ghcr.io/daemonless/unifi:latest inherit- name: Deploy unifi
containers.podman.podman_container:
name: unifi
image: "ghcr.io/daemonless/unifi:latest"
state: started
restart_policy: always
env:
PUID: "1000"
PGID: "1000"
TZ: "UTC"
ports:
- "8443:8443"
- "8080:8080"
- "8843:8843"
- "8880:8880"
- "6789:6789"
- "3478:3478"
- "10001:10001"
volumes:
- "/path/to/containers/unifi:/config"
annotation:
org.freebsd.jail.allow.mlock: "true"Save as unifi-deploy.yaml, then run ansible-playbook unifi-deploy.yaml.
| Variable | Default | Description |
|---|---|---|
PUID |
1000 |
User ID for the application process |
PGID |
1000 |
Group ID for the application process |
TZ |
UTC |
Timezone for the container |
| Path | Description |
|---|---|
/config |
Configuration and database directory |
| Port | Protocol | Description |
|---|---|---|
8443 |
TCP | Web UI (HTTPS) |
8080 |
TCP | Device inform |
8843 |
TCP | Guest portal HTTPS |
8880 |
TCP | Guest portal HTTP |
6789 |
TCP | Mobile throughput test |
3478 |
UDP | STUN (UDP) |
10001 |
UDP | Device discovery (UDP) |
Architectures: amd64, aarch64
User: bsd (UID/GID via PUID/PGID, defaults to 1000:1000)
Base: FreeBSD 15.1
Need help? Join our Discord community.