Docker Compose

This page runs Sovereign with Docker Compose. All configuration lives in two files: compose.yaml (non-sensitive, safe to commit) and sovereign.env (sensitive, never committed).

---

compose.yaml

name: sovereign
services:
  server:
    image: <sovereign-image>:<version>
    env_file:
      - sovereign.env
    environment:
      Sovereign__Authentication__Issuer: https://media.example.com/
      Sovereign__Network__TrustedProxyNetwork__0: 172.16.0.0/12
      Sovereign__DataSources__Radarr__0__Url: http://radarr:7878
      Sovereign__DataSources__Sonarr__0__Url: http://sonarr:8989
    ports:
      - 5000:5000
    stop_grace_period: 90s
    volumes:
      - sovereign-data:/sovereign-data
      - /path/to/media:/media:ro

volumes:
  sovereign-data:

Replace <sovereign-image> and <version> with the image and the release you’re deploying, as the Docker page describes. Set the issuer to the HTTPS address of the reverse proxy in front of port 5000, because while it’s a localhost address only a browser on the server’s own machine can sign in. The trusted proxy network names where that proxy connects from: 172.16.0.0/12 covers Docker’s default networks, so it fits a proxy in another container or on the same host, and a proxy on another machine needs its own address instead (see Trusted Proxy Networks). stop_grace_period gives Sovereign time to stop its running streams cleanly when the container stops, rather than being killed after Docker’s default ten seconds.

---

sovereign.env

Sovereign__Authentication__AdminUsername=admin
Sovereign__Authentication__AdminPassword=Admin1!
Sovereign__DataSources__Radarr__0__ApiKey=<radarr-api-key>
Sovereign__DataSources__Sonarr__0__ApiKey=<sonarr-api-key>

Compose merges env_file and environment at startup. Declare non-sensitive values inline in compose.yaml; keep sensitive values in sovereign.env.

Caution

Add sovereign.env to .gitignore. Commit compose.yaml.

---

NFS Media Volumes

Declare an NFS share as a named volume in compose.yaml, with the mount options on the volume:

name: sovereign
services:
  server:
    image: <sovereign-image>:<version>
    env_file:
      - sovereign.env
    environment:
      Sovereign__Authentication__Issuer: https://media.example.com/
      Sovereign__Network__TrustedProxyNetwork__0: 172.16.0.0/12
      Sovereign__DataSources__Radarr__0__Url: http://radarr:7878
    ports:
      - 5000:5000
    volumes:
      - sovereign-data:/sovereign-data
      - nfs_movies:/media/movies:ro

volumes:
  sovereign-data:
  nfs_movies:
    driver: local
    driver_opts:
      type: nfs
      device: ':/MEDIA/movies'
      o: 'addr=192.168.1.10,nfsvers=4.1,ro,soft,timeo=100,retrans=2,rsize=1048576,wsize=1048576,nconnect=4,actimeo=60'

The option string above is explained option by option on the NFS Media Storage page, along with why the mount should be read-only and fail fast.

---

Docker Secrets

Compose and Swarm secrets: entries reach the container as files under /run/secrets/, and Sovereign doesn’t read its configuration from files there. It takes its settings from environment variables, so keep sensitive values in sovereign.env and pass it with env_file: as shown above.

---

Hardware Acceleration

See Hardware Acceleration for the deploy.resources snippet that exposes a GPU to the container in Compose.