Installation

Install Arcane to manage Docker on your host through a single container. Use Docker Compose, or run the Linux install script to set up both Docker and Arcane.

Note

To manage other hosts later, add remote environments. To restrict Docker socket access, use a socket proxy.

Docker

1. Generate an encryption key

Generate a 32-byte ARCANE_ENCRYPTION_KEY (raw, base64, or hex) with one of these commands and copy the output.

With a temporary Arcane container:

docker run --rm ghcr.io/getarcaneapp/manager:latest /app/arcane generate secret

With the Arcane CLI:

arcane-cli generate secret

With OpenSSL:

openssl rand -hex 32

Note

Arcane signs session tokens with a self-managed ML-DSA-87 key instead of JWT_SECRET. Remove JWT_SECRET from your environment to silence startup warnings.

2. Create compose.yaml

Replace <your-encryption-key> with your key and /opt/docker with the folder for your Compose projects:

services:
  arcane:
    image: ghcr.io/getarcaneapp/manager:latest
    container_name: arcane
    ports:
      - '3552:3552'
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - arcane-data:/app/data
      - /opt/docker:/opt/docker
    environment:
      - ARCANE_APP_URL=http://localhost:3552
      - PUID=1000
      - PGID=1000
      - ARCANE_ENCRYPTION_KEY=<your-encryption-key>
      - ARCANE_PROJECTS_DIRECTORY=/opt/docker
    cgroup: host
    restart: unless-stopped

volumes:
  arcane-data:

Note

The official images start as root to prepare the container, then drop to a non-root user. PUID and PGID set the host UID and GID for files Arcane creates, or default to 65532:65532 if omitted.

Projects folder

Important

Mount your projects folder at the same absolute path inside the container (such as /opt/docker, not opt/docker) and set ARCANE_PROJECTS_DIRECTORY to match. Matching paths let relative mounts like ./config resolve identically for Arcane and Docker, and let Arcane manage existing projects in that folder.

If you mount a different container path (such as /opt/docker:/app/data/projects), Arcane translates container paths to host paths automatically. You can also set the mapping explicitly with ARCANE_PROJECTS_DIRECTORY=<containerPath>:<hostPath>. If omitted, ARCANE_PROJECTS_DIRECTORY defaults to /app/data/projects.

3. Start Arcane

docker compose up -d

Convenience script

Run the install script

Run the Linux install script to install Docker and Arcane:

curl -fsSL https://getarcane.app/install.sh | sudo bash

Uninstall

Run the interactive uninstaller to choose whether to keep Arcane data, the Arcane user and group, and Docker:

curl -fsSL https://getarcane.app/uninstall.sh -o /tmp/arcane-uninstall.sh && sudo bash /tmp/arcane-uninstall.sh

To remove everything without prompting:

Warning

This removes Arcane, its data, the Arcane user and group, and Docker packages. Run it only if you want to remove Docker from the machine too.

curl -fsSL https://getarcane.app/uninstall.sh | sudo bash -s -- --force --remove-all

Open Arcane

Open localhost:3552, sign in with the default credentials, and set a new password when prompted.

Username:

arcane

Password:

arcane-admin

After signing in, the dashboard summarizes your environments and their resource usage.

×

After signing in, the dashboard summarizes your environments and their resource usage.

More setup options

Expand any section that applies to your environment.

Folders and volumes

What each mount is for, plus optional build and backup folders.

Mount	Purpose
/var/run/docker.sock	Connects Arcane to Docker. Use a socket proxy to restrict access.
arcane-data	Stores Arcane’s database and application data.
Projects folder	Holds your Compose projects. See Projects folder.
/builds	Optional. Stores Dockerfiles and build contexts for Image Builds.
/backups	Optional. Stores exported volume Backups.

Tip

To use the optional folders, add them to volumes: in your compose.yaml:

• /builds — host path /srv/arcane/builds:/builds or named volume arcane-builds:/builds.
• /backups — host path /srv/arcane/backups:/backups or named volume arcane-backups:/backups.

Declare any named Docker volumes under the top-level volumes: section too.

SELinux hosts

Use a socket proxy or relabel the Docker socket mount.

On SELinux hosts, choose one of two options:

• Use a socket proxy (recommended). Run a proxy, set DOCKER_HOST, and add :z to the projects mount (/opt/docker:/opt/docker:z). See Socket Proxy.
• Mount the socket directly. Disable SELinux labeling on the Arcane container and relabel the projects mount:

services:
  arcane:
    image: ghcr.io/getarcaneapp/manager:latest
    container_name: arcane
    ports:
      - '3552:3552'
    security_opt:
      - label:disable
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
      - arcane-data:/app/data
      - /opt/docker:/opt/docker:z
    environment:
      - ARCANE_PROJECTS_DIRECTORY=/opt/docker

Container health check

Add a Docker health check using the built-in arcane health command.

Add a Docker health check using the built-in arcane health command, which checks /api/health:

services:
  arcane:
    image: ghcr.io/getarcaneapp/manager:latest
    # ...
    healthcheck:
      test: ['CMD', './arcane', 'health', '--timeout', '2s']
      interval: 10s
      timeout: 3s
      retries: 5
      start_period: 15s

start_period gives Arcane time to finish first-boot database migrations before failed checks count toward retries.

External Postgres database

Store Arcane's data in Postgres instead of the built-in SQLite file.

Set ARCANE_DATABASE_URL to store Arcane’s data in Postgres instead of the default SQLite file in arcane-data:

postgres://<db_username>:<db_password>@<postgres_url>:<postgres_port>/<postgres_db_name>

To switch back to the default SQLite database, set:

file:data/arcane.db?_pragma=journal_mode(WAL)&_pragma=busy_timeout(2500)&_txlock=immediate

Reverse proxy

Enable WebSocket support when Arcane is behind a proxy or custom domain.

Note

Forward WebSocket connections when running Arcane behind a reverse proxy so live updates work. See Reverse Proxy for Nginx, Apache, and other configurations.

Outbound HTTP proxy

Route Arcane's outbound traffic through an HTTP proxy.

Configure an outbound proxy if Arcane needs one to download templates or check for updates. See Outbound Proxy.

Supported architectures

CPU architectures available for the images and binaries.

Docker automatically pulls the matching manager or agent image for:

• linux/amd64
• linux/arm64
• linux/arm/v7
• linux/riscv64

CLI and agent binaries on GitHub Releases also support Linux 386 and macOS (amd64, arm64).

Preview builds

Try features that haven't been released yet.

Use the :next image tag to test unreleased builds from the main branch on non-production instances. See Preview Builds.