---
title: Docker
weight: 7
description: "Self-host RustDesk Server OSS with Docker, Docker Compose, or Podman. Review the required ports, host networking notes, and sample container definitions for hbbs and hbbr."
keywords: ["rustdesk docker", "rustdesk docker compose", "rustdesk server docker", "rustdesk hbbs hbbr docker", "rustdesk podman", "rustdesk self-host docker"]
---

Use this guide to self-host RustDesk Server OSS with Docker, Docker Compose, or Podman and to open the correct ports for `hbbs` and `hbbr`.

## What is the best way to run RustDesk Server OSS in Docker?

For most Linux deployments, Docker Compose with `network_mode: "host"` is the simplest and most reliable option. It keeps the setup repeatable, makes upgrades easier, and avoids extra port-mapping complexity when host networking is available.

## Docker deployment checklist

1. Install Docker or Podman.
2. Create a persistent data directory or volume for `hbbs` and `hbbr`.
3. Open the required RustDesk ports in your firewall.
4. Start `hbbs` and `hbbr` with Docker Compose, `docker run`, or Podman Quadlet.
5. Point clients to the new self-hosted server and verify registration and relay traffic.

## Which container setup should you choose?

| Method | Best for | Why you would use it |
| --- | --- | --- |
| Docker Compose | Most Linux servers | Repeatable setup and easier ongoing maintenance |
| `docker run` | Quick manual testing | Fastest way to start a simple pair of containers |
| Podman Quadlet | Podman plus systemd environments | Native systemd-style service management |

> Here is another good tutorial: [Building Your Own Remote Desktop Solution: RustDesk Self-Hosted on Cloud with Docker (Hetzner)](https://www.linkedin.com/pulse/building-your-own-remote-desktop-solution-rustdesk-cloud-montinaro-bv94f)

## Install your own server with Docker

### Requirements
You need to have Docker/Podman installed to run a rustdesk-server as a Docker container. If in doubt, install Docker with this [guide](https://docs.docker.com/engine/install) to ensure it's the most up to date!

Be sure to open these ports in the firewall:
- `hbbs`:
  - `21114` (TCP): used for web console, only available in `Pro` version.
  - `21115` (TCP): used for the NAT type test.
  - `21116` (TCP/UDP): **Please note that `21116` should be enabled both for TCP and UDP.** `21116/UDP` is used for the ID registration and heartbeat service. `21116/TCP` is used for TCP hole punching and connection service.
  - `21118` (TCP): used to support web clients.
- `hbbr`:
  - `21117` (TCP): used for the Relay services.
  - `21119` (TCP): used to support web clients.

*If you do not need web client support, the corresponding ports `21118`, `21119` can be disabled.*

{{% notice warning %}}
When WebSocket is enabled (ports `21118`/`21119` are open for the [web client](https://rustdesk.com/web/)), `hbbs`/`hbbr` trust the `X-Real-IP` / `X-Forwarded-For` headers of incoming WebSocket connections to determine the real client IP, so that the client IP is preserved when the WebSocket traffic goes through a reverse proxy ([WSS](/docs/en/self-host/rustdesk-server-pro/faq/#8-add-websocket-secure-wss-support-for-the-id-server-and-relay-server-to-enable-secure-communication-for-all-platforms)). These headers are not validated, so anyone who can reach `21118`/`21119` directly can spoof an arbitrary IP address with forged headers, bypassing IP-based rate limiting and blocking, and falsifying the IP addresses recorded in logs.

If you use the web client, expose the WebSocket ports only through a reverse proxy that sets `X-Real-IP` itself, and restrict `21118`/`21119` with firewall rules so that only the reverse proxy can connect to them. If you do not use the web client, keep ports `21118` and `21119` closed.
{{% /notice %}}

### Docker examples

```sh
sudo docker image pull rustdesk/rustdesk-server
sudo docker run --name hbbs -v ./data:/root -td --net=host --restart unless-stopped rustdesk/rustdesk-server hbbs
sudo docker run --name hbbr -v ./data:/root -td --net=host --restart unless-stopped rustdesk/rustdesk-server hbbr
```
<a name="net-host"></a>

{{% notice note %}}
`--net=host` only works on **Linux**, which makes `hbbs`/`hbbr` see the real incoming IP Address rather than the Container IP (172.17.0.1).
If `--net=host` works fine, the `-p` options are not used. If on Windows, leave out `sudo` and `--net=host`.

**Please remove `--net=host` if you are having connection problems on your platform.**
{{% /notice %}}

{{% notice note %}}
If you cannot see logs with `-td`, you can see logs via `docker logs hbbs`. Or you can run with `-it`, `hbbs/hbbr` will not run as daemon mode.
{{% /notice %}}

### Docker Compose examples
For running the Docker files with the `compose.yml` as described here you need to have [Docker Compose](https://docs.docker.com/compose/) installed.

```yaml
services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    volumes:
      - ./data:/root
    network_mode: "host"

    depends_on:
      - hbbr
    restart: unless-stopped

  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: "host"
    restart: unless-stopped
```

If you need to make config changes e.g. set ALWAYS_USE_RELAY=Y you can use environment in the docker-compose.yml

```yaml
services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    environment:
      - ALWAYS_USE_RELAY=Y
    command: hbbs
    volumes:
      - ./data:/root
    network_mode: "host"

    depends_on:
      - hbbr
    restart: unless-stopped

  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: "host"
    restart: unless-stopped
```

### Podman Quadlet examples

If you would like to run the containers with Podman as a systemd service you can use these sample Podman Quadlet configurations:

```ini
[Container]
AutoUpdate=registry
Image=rustdesk/rustdesk-server:latest
Exec=hbbs
Volume=/path/to/rustdesk-server/data:/root
Network=host

[Service]
Restart=always

[Install]
WantedBy=default.target
```

or

```ini
[Container]
AutoUpdate=registry
Image=rustdesk/rustdesk-server:latest
Exec=hbbr
Volume=/path/to/rustdesk-server/data:/root
Network=host

[Service]
Restart=always

[Install]
WantedBy=default.target
```