Docker Configuration

Docker Configuration

PalCenter is designed to run as a non-root container with one persistent data mount at /app/data.

Compose variables

Place optional values in a .env file beside docker-compose.yml.

Variable	Default	Purpose
PALCENTER_IMAGE	ghcr.io/shanebionic/palcenter:latest	Image and release tag
PALCENTER_WEB_PORT	3000	Host port for the web interface
PALCENTER_API_PORT	3001	Host port for optional direct API access
PALCENTER_UID	1000	Container process user ID
PALCENTER_GID	1000	Container process group ID
PALCENTER_HISTORY_INTERVAL_SECONDS	30	Live-history collection interval; minimum 5 seconds
PALCENTER_SESSION_DURATION_SECONDS	43200	Session lifetime in seconds
PALCENTER_SESSION_COOKIE_SECURE	false	Set true when the browser always uses HTTPS
PALCENTER_CORS_ORIGINS	empty	Comma-separated origins allowed to call the API directly
PALCENTER_LOG_LEVEL	info	Application log level
PALCENTER_BACKUP_MAX_BYTES	536870912	Maximum restore upload size

PALCENTER_SESSION_SECRET is only an optional migration input for older installations. New installations generate and persist their own secret. Do not add or rotate this value casually.

Configurable UID/GID

The supplied Compose deployment uses:

user: "${PALCENTER_UID:-1000}:${PALCENTER_GID:-1000}"

Keep 1000:1000 with the default Docker-managed volume. Change these values only when a host bind mount uses a different ownership model.

Example for Unraid:

PALCENTER_UID=99
PALCENTER_GID=100

PalCenter does not start as root and does not change ownership of mounted data. The selected account must already be able to create and update files in the host directory.

Security settings

Keep these Compose settings:

cap_drop:
  - ALL
security_opt:
  - no-new-privileges:true

Do not add privileged mode, extra capabilities, the Docker socket, or Palworld save directories.

For remote access, place PalCenter behind HTTPS, enable secure session cookies, and restrict published ports to a trusted management network.