Installation

Docker (recommended)

docker run -d \
  --name sozune \
  -p 80:80 -p 443:443 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(pwd)/config.yaml:/etc/sozune/config.yaml \
  ghcr.io/kemeter/sozune:latest

Image tags

Tag	Content
`latest`	The latest release. Use this one.
`0.14.0` (any release)	That release, never updated.
`edge`	The current state of `main`, rebuilt after every merge that passes CI. For trying a fix or feature before it is released: it is not a release, and can break at any time. `linux/amd64` only.
`sha-<full commit hash>`	The `main` build of that commit, never rebuilt.

Kubernetes (Helm)

git clone https://github.com/kemeter/sozune
helm install sozune ./sozune/charts/sozune --namespace sozune --create-namespace

See Deploying Sōzune in-cluster for its values.

From source

Requirements: stable Rust, Cargo.

git clone https://github.com/kemeter/sozune
cd sozune
cargo build --release
./target/release/sozune

Running as non-root

The image runs as root by default so it works out of the box: it can bind to ports 80/443 and read /var/run/docker.sock without extra configuration.

If you'd rather run as the unprivileged nonroot user (UID 65532) baked into the distroless base image, override user and grant the necessary capability + group:

services:
  sozune:
    image: ghcr.io/kemeter/sozune:latest
    user: "65532:65532"
    cap_add:
      - NET_BIND_SERVICE
    group_add:
      - "997"  # GID of the `docker` group on the host (varies — check with `getent group docker`)
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock:ro
      - ./config.yaml:/config.yaml:ro

The group_add value must match your host's docker group GID. Without it, sozune cannot read the Docker socket.

Verify the install

/health is exposed by the REST API, not by the proxy itself. With the API enabled (default port 127.0.0.1:3035):

curl http://127.0.0.1:3035/health

You should get 200 OK. Next: Quick start.