Linux server or VPS
The recommended home for KumoYami, with the installer or by hand.
A Linux server or VPS is where KumoYami runs best: always on, with a public IP for your domain and nothing in between. Any distribution with Docker will do: Debian, Ubuntu, Rocky Linux, AlmaLinux, Fedora…
ARM: coming soon
KumoYami's image is x86_64 only for now (Intel and AMD processors). The ARM build (arm64: Raspberry Pi, Apple Silicon Macs, ARM servers and NAS) is coming in an upcoming release, and this guide will be updated when it lands.
Choosing a server
- Memory: 1 GB of RAM at the very least, 2 GB recommended. If you'll turn on the antivirus for uploads (ClamAV), plan for 4 GB: ClamAV alone uses around 1.5 GB.
- Disk: 5 GB free for Docker and the image, plus whatever the local folders you publish take up. Anything on OneDrive or other clouds takes no space on the server.
- Network: outbound HTTPS (for the registry and the license) and, if you'll use a domain, ports 80 and 443 open to the server.
With the installer
The fastest route: one command that installs Docker, logs in with your license, prepares the files and sets up HTTPS with Caddy. Follow the quick install.
curl -fsSL https://kumoyami.com/install.sh | sudo bashBy hand
If you'd rather see every step, or you already have Docker and a reverse proxy running, follow Docker Compose by hand. You end up with exactly what the installer gives you.
Firewall
KumoYami only listens on 127.0.0.1:4890, so that port should never be opened to the outside: traffic comes in
through the reverse proxy. Open only the proxy's ports. For example, with ufw:
sudo ufw allow 22/tcp # SSH, so you don't lock yourself out
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enableIf your provider has a firewall in its control panel (security groups, network firewall…), open 80 and 443 there as well. With Cloudflare Tunnel you don't need to open any.
Docker and ufw
Docker publishes container ports in a way that bypasses ufw rules. That's why KumoYami's docker-compose.yml only
publishes 4890 on 127.0.0.1: don't change it to 4890:3000 on a server with a public IP.