aptplatforms/unifi

Docker image

Ubiquiti UniFi Controller in a Docker container. Features include:

• As small as possible and as large as necessary.
• FROM debian:9-slim
• Uses Træfik with Let's Encrypt to provide HTTPS for both the Controller interface and the builtin Captive Portal.
• Allows reuse of an existing Træfik configuration instead of a dedicated UniFi controller host.

Summary

• Docker Tags
• Prerequisites
• Installation

Docker Tags

• 7.1.68 (latest) → Release Notice 7.1.68

  • docker pull aptplatforms/unifi:7.1.68

• 6.5.55 → Release Notice 6.5.55

  • docker pull aptplatforms/unifi:6.5.55

Prerequisites

Ports

If you have a firewall, unblock the following ports, according to your needs :

Service	Container	Protocol	Port	Description
unifi.http.port	unifi	TCP	8080	UAP Inform port. Open to wherever your UniFi devices are installed.
STUN	unifi	TCP	3478	Session Traversal Utilities for NAT. Open to wherever your UniFi devices are installed.
HTTP	Træfik	TCP	80	Open to 0.0.0.0/0 for Let's Encrypt
HTTPS	Træfik	TCP	443	Open to 0.0.0.0/0 for Let's Encrypt

DNS records

A correct DNS setup is required. The Træfik configuration relies on forward DNS lookups (from the Host header) to correctly resolve each service. Since we're running all services on the same host, we need the same IP address for each.

You can use A records like this :

Hostname	Class	Type	Priority	Value
unifi	IN	A	any	1.2.3.4
portal	IN	A	any	1.2.3.4
traefik	IN	A	any	1.2.3.4

Or you can use CNAME records like this :

Hostname	Class	Type	Priority	Value
unifi	IN	A	any	1.2.3.4
portal	IN	CNAME	any	unifi.example.com.
traefik	IN	CNAME	any	unifi.example.com.

Installation

1 - Prepare your environment

💡 The reverse proxy used in this setup is Træfik, but you can use the solution of your choice (Nginx, Apache, Haproxy, Caddy, H2O...etc).

⚠️ This docker image may not work with some hardened Linux distribution using security-enhancing kernel patches like GrSecurity, please use a supported platform.

# Create a new docker network for Traefik (IPv4 only)
docker network create public_network

# Create the required folders and files
mkdir -p traefik/acme unifi/backup \
&& curl https://raw.githubusercontent.com/APTPlatforms/docker-unifi/master/docker-compose.sample.yml -o docker-compose.yml \
&& curl https://raw.githubusercontent.com/APTPlatforms/docker-unifi/master/sample.env -o .env \
&& curl https://raw.githubusercontent.com/APTPlatforms/docker-unifi/master/traefik.sample.toml -o traefik/traefik.toml \
&& touch traefik/acme/acme.json \
&& chmod 00600 docker-compose.yml .env traefik/traefik.toml traefik/acme/acme.json

2 - Edit configuration files

Edit docker-compose.yml and .env and traefik.toml, adapt to your needs.

3 - Start services

Start all services.

docker-compose up -d

Visit https://traefik.example.com/ to see the Træfik dashboard.

4 - Configure the controller

• Visit https://unifi.example.com/ to login to your controller.
• After configuring standard controller settings, set:
  • Guest Control → Guest Portal → Enable Guest Portal = True.
  • Guest Control → Redirection → Use Secure Portal = True.
  • Guest Control → Redirection → Redirect using hostname = portal.example.com.