Docker

The image is the server only. The desktop client stays on the desk.

The container starts as root just long enough to give /var/lib/ryme to user 1542. The server then runs as that user, with no capabilities and no new privileges. The root filesystem is read-only. The only published port is UDP 1542. The certificate and the key stay in the volume, mode 0700 and 0600.

Run

In the repository, put the public address in a .env file beside compose.yaml:

RYME_PUBLIC=voice.example:1542

docker compose up -d --build

The invite is in the logs:

docker compose logs

On a Raspberry Pi, build on that Pi. The image matches the machine it is built on. Aarch64 and armv7 do not share a binary.

Rooms and a new invite

The volume holds channels next to the key. Edit it, then restart. One name per line. Lobby is always there.

A leaked link is replaced by stopping the server and starting once with the flag. Old invites stop working. The new invite is printed again.

docker compose stop
docker compose run --rm --service-ports ryme --new-invite

What stays off the image

No client, no shell as the server process, and no extra published port. Do not mount the data volume onto a shared disk. Anyone who can read key.der can pretend to be the server.