Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Containers

Tuwunel ships as a small, statically linked OCI image that runs unprivileged on any container runtime. Pick a deployment style based on how you already manage services on the host.

  • Docker. Pull prebuilt images from GHCR or Docker Hub, then run standalone or via one of the provided docker-compose stacks (with Caddy, Traefik, or a bring-your-own reverse proxy).

  • Kubernetes. Community-maintained Helm chart for cluster deployments. Tuwunel itself does not scale horizontally, so the chart runs a single replica with persistent storage.

  • Podman with Quadlets. Rootless deployment managed by systemd user units, suited to single-host setups where containers should behave like native services.

Whichever style you pick, security profiles and limits covers the two runtime defaults that affect this server: the task limit that can stop startup outright, and the seccomp profile that decides whether the database gets io_uring.

Registries

RegistryImageTags
GitHub Registryghcr.io/matrix-construct/tuwunellatest, preview, main
Docker Hubdocker.io/jevolk/tuwunellatest, preview, main

Images

Three rolling tags trade update frequency for confidence.

TagSourceCadenceUse when
:latestMost recent tagged release~monthlyProduction. Default choice.
:previewSelected higher-confidence updates~weeklyYou want fixes between releases without chasing main.
:mainEvery reviewed merge to the main branch~dailyYou track development and accept unknown-risk changes.

Important

We strongly advise tracking the :latest tag when automatically updating.

Tracking :latest gives us the necessary discretion to keep you on the appropriate stable release version. Tracking the :preview tag provides select updates of higher confidence between releases. Tracking the :main branch provides the most frequent updates which have been reviewed and tested with confidence for release, the only remaining risk being the unknown. The publication frequency for these tags are on average monthly, weekly and daily, respectively.