DSH

DSH

Docker app from MeiXu's Repository

Overview

DSH（DeepSeek Harness）是开源 AI 编码智能体：在浏览器里与它协作，读写你的项目、执行命令、管理模型与会话历史。本镜像为 Unraid 准备——自动跟随上游发版重建，内置命令沙箱所需的 bubblewrap，使它在没有 Landlock 的内核上也能正常执行命令，并集成 [dsh-remote-signin](https://github.com/MeiXu6693/dsh-remote-signin) 插件：在局域网、Tailscale 或反向代理后面，用 DeepSeek 账号登录也能正常走完（只在最后多一步粘贴，粘贴框会自己出现在页面上）。 容器内置 Caddy 反向代理与可选口令门禁（也可设为 none 交给你现有的 SSO），以非 root 身份（PUID/PGID，默认 99:100；UMASK=022）运行。 | DSH (DeepSeek Harness) is an open-source AI coding agent you drive from the browser: it works on your projects, runs commands and keeps your session history. Built for Unraid — rebuilt automatically for every upstream release, with the bubblewrap sandbox bundled so commands work even on kernels without Landlock, and with the [dsh-remote-signin](https://github.com/MeiXu6693/dsh-remote-signin) plugin integrated: a DeepSeek account sign-in also works over the LAN, Tailscale or behind a reverse proxy (it adds one paste, into a box that appears in the page). The container bundles its own reverse proxy and an optional password gate (or set none and delegate to your SSO), and runs unprivileged as a non-root uid (PUID/PGID, 99:100 on Unraid; UMASK=022).

Readme

View on GitHub

DeepSeek Harness

English | 中文

DeepSeek Harness (dsh) is an open-source agent harness developed by DeepSeek AI.

It is built on an everything-is-a-plugin architecture and powered by Cordis, whose design is described in A Programming Paradigm for Spatiotemporal Composability.

Documentation: https://deepseek-harness.github.io/deepseek-harness/

Developer preview

DeepSeek Harness is in developer preview and iterating rapidly. THERE WILL BE COMPATIBILITY-BREAKING CHANGES.

Review the safety notice before running the project.

Run

Run from npm

Install Node.js, then run:

npx @deepseek-ai/dsh web

The command starts the Web UI at http://127.0.0.1:3080 by default and opens it in the default browser for a local launch. An SSH launch only prints the host URL because the SSH client or editor owns the local forwarded address. Pass --no-open to run the server without opening a browser. See Web UI guide.

Run from source

To run from a repository checkout:

git clone https://github.com/deepseek-ai/deepseek-harness.git
cd deepseek-harness
pnpm install
pnpm run build
pnpm dsh web

pnpm run build prepares the repository artifacts. pnpm dsh web uses those built artifacts without rebuilding.

Community and support

Contributing

See CONTRIBUTING.md.

Development

Start with the development guide and architecture documentation.

pnpm run dev:web builds, serves, and rebuilds client bundles on source edits in one terminal, and make help lists the matching Make targets for Web and Desktop; the guide's application commands section owns the full table.

For agents, follow AGENTS.md.

Citation

@misc{deepseek-harness2026,
  title={DeepSeek Harness: Everything is a Plugin},
  author={DeepSeek-AI},
  year={2026},
  publisher={GitHub},
  howpublished={\url{https://github.com/deepseek-ai/deepseek-harness}},
}

License

MIT

Third-party dependencies and their licenses are disclosed in THIRD_PARTY_NOTICES.md.

Requirements

Docker；请保留模板自带的 Extra Parameters（两个 --security-opt），否则命令沙箱不可用 | Docker; keep the template's Extra Parameters or the command sandbox is unavailable

Categories

Tools > Utilities

Related apps

Explore more like this

Explore all
Utilities apps

Links

Projectgithub.comSupportforums.unraid.netRegistrygithub.comTemplateraw.githubusercontent.com

Details

Repository
ghcr.io/meixu6693/dsh:latest
Registry
https://github.com/MeiXu6693/dsh-docker/pkgs/container/dsh
Last Updated2026-10-26
First Seen2026-10-26

Runtime arguments

Web UI
http://[IP]:[PORT:8080]
Network
bridge
Shell
bash
Privileged
false
Extra Params
--security-opt seccomp=unconfined --security-opt systempaths=unconfined --restart=unless-stopped

Template configuration

WebUI PortPorttcp

Web UI 端口，格式必须是 IP:端口（如 127.0.0.1:3080）。| Web UI port; must be IP:port (e.g. 127.0.0.1:3080).

Target
8080
Default
0.0.0.0:8080
Value
0.0.0.0:8080
Data DirectoryPathrw

会话、凭据与插件数据；必须持久化。| Sessions, credentials and plugins; keep it persistent.

Target
/data
Default
/mnt/user/appdata/dsh/data
Value
/mnt/user/appdata/dsh/data
Workspace DirectoryPathrw

智能体的工作目录。| The agent's working directory.

Target
/workspace
Default
/mnt/user/appdata/dsh/workspace
Value
/mnt/user/appdata/dsh/workspace
PUIDVariable

DSH 运行的用户 ID。Unraid 默认 99。| User ID for DSH. Unraid default: 99.

Default
99
Value
99
PGIDVariable

DSH 运行的用户组 ID。Unraid 默认 100。| Group ID for DSH. Unraid default: 100.

Default
100
Value
100
UMASKVariable

新文件的权限掩码，默认 022。| File creation mask for new files; default 022.

Default
022
Value
022
Allowed ClientsVariable

允许访问的 IP/CIDR 或域名，逗号分隔；默认私有网段。| Allowed client IPs/CIDRs or hostnames, comma separated; defaults to private ranges.

Target
ALLOWED_CLIENTS
Default
127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,100.64.0.0/10,fc00::/7,fe80::/10
Value
127.0.0.1,10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,169.254.0.0/16,100.64.0.0/10,fc00::/7,fe80::/10
UsernameVariable

内置口令门禁的用户名，默认 dsh。| Username for the built-in gate; default dsh.

Target
AUTH_USER
Default
dsh
Value
dsh
PasswordVariable

内置口令门禁的密码。默认 12345678，请改成只有你知道的值。| Password for the built-in gate. Default 12345678 — change it.

Target
DSH_PASSWORD
Default
12345678
Authentication ModeVariable

builtin=容器自带口令；none=交给反向代理/SSO。| builtin = built-in password gate; none = delegate to a proxy or SSO.

Target
AUTH_MODE
Default
builtin
Value
builtin
Trusted Proxy CIDRsVariable

前置代理的网段，用于读取真实客户端 IP；没有代理留空。| Proxy CIDRs for X-Forwarded-For; leave empty without a proxy.

Target
TRUSTED_PROXY_CIDRS
Public URLVariable

反向代理的对外地址（https://…）；纯内网留空。| Public origin behind a reverse proxy; leave empty on a LAN.

Target
PUBLIC_URL
Remote Sign-inVariable

on=允许远程浏览器完成 DeepSeek 账号登录；off=仅回环地址。| on = let a remote browser finish DeepSeek account sign-in; off = loopback only.

Target
REMOTE_SIGNIN
Default
on
Value
on
Time ZoneVariable

容器时区。| Container time zone.

Target
TZ
Default
Asia/Shanghai
Value
Asia/Shanghai