Docker Deployment#

Tinyauth ships as a multi-stage Docker image 1 that builds a static Go binary (CGO disabled) and packages it into a minimal Alpine runtime. The image exposes port 3000, creates a dedicated tinyauth non-root user, and pre-creates the /data directory subtree used for all persistent state 2.

The official image is ghcr.io/tinyauthapp/tinyauth:v5 3.

Runtime Detection and Path Defaults#

The Dockerfile sets RUNTIME_ENV=docker as a baked-in environment variable 4. At startup, DetectRuntimeEnv() reads this variable to switch path defaults.

When RUNTIME_ENV=docker, NewDefaultConfiguration() overrides the default (relative) paths with absolute /data-rooted paths:

The Dockerfile also pre-creates these subdirectories and sets ownership to the tinyauth user 5:

• /data/resources
• /data/oidc
• /data/tailscale

Volume Mount Strategy#

A single named volume or host-path bind on /data persists all runtime state. The Dockerfile declares /data as a VOLUME 6.

The example docker-compose.yml uses a host-path bind:

volumes:
  - ./data:/data

This is the recommended pattern for local deployments. The dev compose file follows the same convention 7.

Configuration in Docker#

Configuration is applied via a three-source loader chain — file → flags → env vars — where environment variables win 8. In Docker, the practical approach is:

Option A — Environment variables only (most common)

Set TINYAUTH_ prefixed variables directly in the compose environment block. Example from the production compose template 9:

environment:
  - TINYAUTH_APPURL=https://tinyauth.example.com
  - TINYAUTH_AUTH_USERS=user:$$2a$$10$...

Note the $$ escaping for $ in bcrypt hashes within Docker Compose files.

Option B — Config file via TINYAUTH_CONFIGFILE

Mount a YAML/TOML/JSON config file and point to it with the env var. The FileLoader checks --traefik.configfile first, then falls back to TINYAUTH_CONFIGFILE. If neither is set, file loading is skipped.

environment:
  - TINYAUTH_CONFIGFILE=/data/config.yaml
volumes:
  - ./data:/data # config.yaml lives at ./data/config.yaml

Traefik ForwardAuth Integration#

The example compose file shows the standard ForwardAuth middleware wiring 10:

labels:
  traefik.enable: true
  traefik.http.routers.tinyauth.rule: Host(`tinyauth.example.com`)
  traefik.http.middlewares.tinyauth.forwardauth.address: http://tinyauth:3000/api/auth/traefik

Protected services reference the tinyauth middleware via traefik.http.routers.<service>.middlewares: tinyauth 11.

For Docker label-based ACLs, the Tinyauth container also needs the Docker socket mounted at /var/run/docker.sock so it can read per-app labels at runtime 12.

Key Files#