How to open a server in Docker with proximamp

Add a container from the proximamp/proximamp image to compose.yml: it holds tunnels to the containers next to it, and the server's port never has to be published. The image runs on Linux x86_64 and arm64: a server, a Raspberry Pi, a Synology or QNAP NAS, Unraid.

Start it

Example: a Minecraft server (the itzg/minecraft-server image) and a tunnel to it. compose.yml:

services:
  minecraft:
    image: itzg/minecraft-server
    environment:
      EULA: "TRUE"
    volumes:
      - minecraft:/data
    restart: unless-stopped
  proximamp:
    image: proximamp/proximamp
    hostname: minecraft-tunnel          # the device name in the account's device list
    volumes:
      - ./proximamp.yml:/etc/proximamp/proximamp.yml:ro
      - proximamp:/var/lib/proximamp    # the sign-in and the tunnels' addresses
    restart: unless-stopped
volumes:
  minecraft:
  proximamp:

And next to it, proximamp.yml (how this file works):

tunnels:
  minecraft:
    type: tcp
    port: 25565
    host: minecraft     # the service's name in compose.yml

docker compose up -d
docker compose exec proximamp proximamp login --remote
docker compose logs -f proximamp

The second command signs in with a code from your phone. Until it is signed in, the container waits and doesn't exit. The tunnel's address appears in the log the third command shows; Ctrl+C closes only the log, the container keeps running.

In the container, proximamp commands from other pages go after docker compose exec proximamp, for example:

docker compose exec proximamp proximamp whoami

Signing in with nobody there

Sign in with a device key once; how to make a key is on the same page. If no other device is signed in, a container signed in with a phone code makes the key too, when the account has a password: the command asks for it.

docker compose exec proximamp proximamp keys create --name minecraft-tunnel

Save the key in a key.txt file on the computer and sign in with it:

docker compose exec -T proximamp proximamp login --key-stdin < key.txt

In PowerShell < doesn't work:

Get-Content key.txt | docker compose exec -T proximamp proximamp login --key-stdin

You can also give the key in a PROXIMAMP_KEY variable under the proximamp service's environment:, but docker inspect shows it. The sign-in is kept in the volume, so after the first start take the variable out of compose.yml and re-create the container:

docker compose up -d

Volume, permissions and updates

The sign-in and the memory of addresses live in the /var/lib/proximamp volume. With it, a new container, after an image update or a re-create, stays the same device and gets the same address. Without it, every container signs in as a new device.
The program in the container runs as user 10001 without root rights: it must be able to read proximamp.yml (the usual 644 permissions are fine). If you mount a host folder instead of the volume (./data:/var/lib/proximamp), on Linux give it to that user:
```
mkdir -p data
sudo chown 10001:10001 data
```
After you change proximamp.yml, restart the container: it doesn't reread the file by itself.
```
docker compose restart proximamp
```
Updating is on the page "How to update proximamp".

Without Compose

docker run starts one tunnel without a file. Without a sign-in such a tunnel doesn't wait for one but exits, so sign in first, keeping the sign-in in the volume, then start the tunnel. --host is always needed: localhost in a container is the container itself, so give the address of the computer with the server on the network.

docker run --rm -it --hostname minecraft-tunnel -v proximamp:/var/lib/proximamp proximamp/proximamp login --remote
docker run -d --name proximamp --hostname minecraft-tunnel --restart unless-stopped -v proximamp:/var/lib/proximamp proximamp/proximamp tcp 25565 --host 192.168.1.20
docker logs proximamp   # the tunnel's address

With a device key, the first command signs in like this:

docker run --rm -i --hostname minecraft-tunnel -v proximamp:/var/lib/proximamp proximamp/proximamp login --key-stdin < key.txt

Get-Content key.txt | docker run --rm -i --hostname minecraft-tunnel -v proximamp:/var/lib/proximamp proximamp/proximamp login --key-stdin

Other proximamp commands from other pages go after docker exec -it proximamp, and a command with < file or Get-Content … | after docker exec -i proximamp.

If the sign-in has ended, the tunnel restarts again and again. Stop it, sign in and start it again:

docker stop proximamp
docker run --rm -it --hostname minecraft-tunnel -v proximamp:/var/lib/proximamp proximamp/proximamp login --remote
docker start proximamp

Check

Look at the tunnel's address:

docker compose logs proximamp

Connect to it from another computer: your server answers.

Remove

Sign out of the account in the container:
```
docker compose exec proximamp proximamp logout
```
If the container signed in with a device key, revoke the key where you signed in with the password, VK ID, Yandex ID or a phone code (revoking a key), and delete the key.txt file: otherwise the key can sign in again.
Stop and remove the tunnel's container:
```
docker compose rm -sf proximamp
```
Take the proximamp service and the proximamp volume out of compose.yml, or the next docker compose up creates the container again.
Remove the volume and the image. The volume's name is the project folder's name and _proximamp; docker volume ls shows all volumes:
```
docker volume rm minecraft_proximamp   # a project in the minecraft folder
docker image rm proximamp/proximamp
```

A tunnel started with docker run without Compose is removed like this:

docker exec proximamp proximamp logout
docker rm -f proximamp
docker volume rm proximamp
docker image rm proximamp/proximamp

Check:

docker ps -a

The list has no container with the proximamp/proximamp image.

Start it​

Signing in with nobody there​

Volume, permissions and updates​

Without Compose​

Check​

Remove​