Docker

The official image runs Stib Server, the embedded web client, and the bundled stib CLI as a non-root user. It is published for amd64 and arm64.

Start a server

docker run -d \
  --name stib \
  --restart unless-stopped \
  -p 50505:50505 \
  -v stib-data:/data \
  enixion/stib-server:latest

Open http://localhost:50505 or connect the desktop app to that origin.

Persist data and expose repositories

/data is the persistent application-data volume. The server database is stored below it and must survive container replacement.

Project repositories are separate. Mount every host directory that Stib must access, preferably at a stable container path:

docker run -d \
  --name stib \
  --restart unless-stopped \
  -p 50505:50505 \
  -v stib-data:/data \
  -v "$PWD/projects:/projects" \
  enixion/stib-server:latest

Create Stib projects with paths such as /projects/my-repository, not the host-only path. SSH Git operations also require the relevant keys and known-hosts data to be made available deliberately.

WARNING

Never run the container without a persistent /data mount. Do not use a raw copy of a live stib.db as your backup procedure; create a consistent backup from Settings → Server → Backup.

Environment

Variable	Use
RUST_LOG	Rust log filter; defaults to info
STIB_ENCRYPTION_KEY	Optional 64-character hex key managed outside the database
STIB_SERVER_ORIGIN	Public origin used for OIDC redirects, for example https://stib.example.com
STIB_RELEASE_CHANNEL	stable or beta
STIB_UPDATE_URL	Override the signed server update manifest URL

If STIB_ENCRYPTION_KEY is absent, Stib creates and stores a key in its database. If you provide the variable, keep the same value across every restart and replica.

Generate an environment-managed key with:

openssl rand -hex 32

Use an env file or secret manager instead of placing the value in shell history.

Agent sandboxing

A server container can launch per-card sandbox containers only when it can reach a Docker API (for example through /var/run/docker.sock) and an agent image is configured. Mounting the Docker socket grants the Stib container extensive control over the host; use it only on a trusted, single-tenant machine and follow the dedicated sandbox deployment guide.

Without Docker API access, the server remains fully usable but project sandbox toggles are unavailable.

Health and logs

curl http://localhost:50505/api/health
docker logs -f stib

The image already contains a health check. Container port 50505 is fixed; expose it on another host port if needed, for example -p 8080:50505.

Update

docker pull enixion/stib-server:latest
docker stop stib
docker rm stib
# Run the same docker run command again, with the same volumes and environment.

Docker installations are not replaced by Stib's native updater.

Next: Configuration.