How a Docker site runs
A Docker Compose site is a reverse-proxy site whose upstream is a container stack. The panel allocates a loopback port, exposes it to your compose file as AURA_PORT, runs docker compose up in the foreground under aurapanel-site-<domain>.service, and proxies the domain to that port with HTTPS. The compose file and a .env live in the site's document root, htdocs/<domain>/docker-compose.yml.
Only administrators can create Docker sites. Docker itself is installed with --docker=yes at install time or later from the Services screen.
Create the site
Sites → Add site → Docker Compose, then choose one of two modes:
- Single image. Enter the image (for example
ghcr.io/example/app:1.4), the container port the application listens on, environment variables asKEY=valuelines, and optionally a host port. The panel writes the compose file for you. - Compose file. Paste your own YAML. Your web service must publish its port to the panel's loopback port:
"127.0.0.1:${AURA_PORT}:<container-port>".
services:
web:
image: ghcr.io/example/app:1.4
ports:
- "127.0.0.1:${AURA_PORT}:8080"
env_file: .env
volumes:
- ./data:/data
restart: unless-stoppedCreate returns quickly: the image pull runs in the background, and the site shows the panel's placeholder until the stack is up.
The domain serves the container over HTTPS. The site's Docker tab shows the containers, and Logs shows docker compose logs.
What the panel enforces
The compose file is checked before anything starts. These are refused, with the message shown:
| Refused | Message |
|---|---|
Publishing a port on any address other than 127.0.0.1 | "service … publishes a port on … — containers may only publish to 127.0.0.1" |
| No service publishing the proxy port | "no service publishes the proxy port — map your web service to 127.0.0.1:${AURA_PORT}:<container-port>" |
privileged: true, network_mode: host, pid: host | Refused outright. |
Capabilities that allow container escape; bind-mounting / or the Docker socket | Refused outright. |
Everything else in Compose is yours: multiple services, named volumes, networks, health checks.
Operate the stack
- Up, Down, Restart, Pull, Recreate from the site's Docker tab. Pull fetches newer images; Recreate applies a changed compose file.
- Changing the service port re-renders the unit and restarts the stack.
- Edit
docker-compose.ymland.envin the File Browser or over SFTP, then Recreate. - Logs:
docker compose logsin the Logs tab, plus the unit's journal.
Data and backups
Keep persistent data in a bind mount under the site's document root (./data in the example) rather than a named volume: site backups archive the document root, not Docker named volumes. Deleting a Docker site removes its containers, network, named volumes and images.
Not provided
- Per-site Docker isolation or rootless Docker: all stacks share the host's Docker daemon, which is why Docker sites are administrator-only.
- CPU or memory quotas set by the panel; set them in your compose file.
- Registry credential management; log in with
docker loginon the host for private images. - The Databases and page-cache tabs, which are hidden for Docker sites. Run your database as a service in the stack or use a panel database from another site.
Common messages
"no compose definition (provide an image or a docker-compose.yml)" or "compose file cannot be empty"
The form was submitted without an image or YAML.
The site shows a 502 after creation
The pull is still running, or the container listens on a different port than the one mapped to AURA_PORT. Check the Docker tab and docker compose logs.
"this is not a Docker site"
Docker actions were called on a site of another type.