Envoryx

Envoryx

Official

Docker app from Seramos' Repository

Overview

Envoryx - Docker-native development environments for Unraid. Manage complete development stacks (PHP, Node.js, Python, Go, Ruby, Java or .NET, web server, database, cache) per project from a modern web UI. Envoryx creates isolated Docker containers for every project automatically; you never edit compose files. Projects are stored in the "development" share and published on ports 20000-20999 by default. With the proxy ports (80/443) mapped, every project is also reachable as https://name.test through Envoryx's embedded reverse proxy and local certificate authority.

Envoryx - build deeper

Development environments on your own server, set up from a web UI.
For Linux Docker hosts and Unraid, x86_64 and arm64.

Documentation · Installation · Changelog · Releases

Envoryx is a single container that gives each of your projects its own little stack: a web server, the runtime it needs (PHP, Node.js, Python, Go, Ruby, Java or .NET), a database and whatever services you add. You click a project together instead of writing docker-compose.yml files, and it answers at https://<project>.test with a trusted certificate. Your editor connects over SSH, backups run on a schedule, and the whole thing lives on a home server, a NAS or a cheap VM instead of your laptop.

The Envoryx dashboard with four projects (PHP, .NET, Java and Ruby), their services, and the Docker engine's CPU, memory and disk space

Quick start

All it needs is Docker. This starts Envoryx with the web UI on port 8787:

mkdir -p ~/envoryx/config ~/envoryx/projects
docker run -d --name envoryx --restart unless-stopped --stop-timeout 90 \
  -p 8787:8787 -p 80:80 -p 443:443 -p 2222:2222 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v ~/envoryx/config:/config -v ~/envoryx/projects:/projects \
  -e PUID=$(id -u) -e PGID=$(id -g) -e ENVORYX_SHUTDOWN_GRACE=80s \
  ghcr.io/envoryx/envoryx:latest

Open http://<your-server>:8787, create the admin account and click New project. Ports 80 and 443 are for reaching projects by name, 2222 for your IDE; leave them out if you don't need that yet.

The installation guide has the same as a Compose file and explains the options. On Unraid there's a template with everything filled in.

What it does

Projects in a few clicks. Start from a template (Laravel, Symfony, WordPress, Drupal, TYPO3, Shopware, Craft CMS, Vite + React, Next.js, Nuxt, Django, Flask, FastAPI, Gin, Echo, Rails, Sinatra, Spring Boot, Quarkus, ASP.NET Core and more), clone a Git repository, upload an existing website with its database dump, or start empty. An envoryx.yml in the repository describes the environment, so a fresh clone comes up the same way.

The runtimes you work with. Each runs in its own container with the tools around it and, where it makes sense, a dev server with live reload and a debugger port:

Runtime Versions Comes with
PHP 8.2 - 8.5 Composer, Xdebug, extensions to pick; Caddy, Apache or Nginx in front
Node.js 22, 24, 26 npm, pnpm, Yarn; dev server with HMR, inspector
Python 3.11 - 3.15 pip, uv, venv; runserver, uvicorn or gunicorn, debugpy
Go 1.26, 1.27 air live reload, Delve, gotestsum
Ruby 3.3 - 4.0 Bundler, Puma, rdbg
Java 17, 21, 25 Maven, Gradle, Spring Boot DevTools, Quarkus dev mode, JDWP
.NET 8, 10 dotnet watch, dotnet-ef

A runtime can also come from your own image or a Dockerfile in the project.

Databases and services. MariaDB, MySQL, PostgreSQL or MongoDB per project (more than one if you need it, or your own existing server), plus Redis, Memcached, Mailpit, RabbitMQ, Meilisearch, Typesense, OpenSearch, Ollama and S3-compatible object storage. The connection details land in the project's environment. Anything else comes in as a small YAML addon.

Domains and HTTPS. Every project gets https://<project>.test from a local CA you trust once, or a Let's Encrypt wildcard for your own domain. A built-in proxy handles extra domains, basic auth, IP rules and redirects, and a project can be shared publicly for a few hours through a Cloudflare tunnel.

Working on it. Live and searchable logs, a browser terminal, one-click actions (composer install, php artisan migrate, npm run build …), a test runner for PHPUnit, Pest, npm test scripts, Playwright, Cypress, pytest, go test, RSpec and Rails tests, workers for queues and schedulers, and cron jobs. Duplicate a project, rename it, or let Envoryx keep a copy per Git branch (shop-feature-login.test) that follows your pushes.

Your IDE stays local. PhpStorm, WebStorm, PyCharm, GoLand, RubyMine, IntelliJ, Rider and VS Code connect over the built-in SSH server for remote interpreters, SFTP and debugging, and JetBrains Gateway can run its backend next to the project.

Your data is safe. Database snapshots before a migration, scheduled project backups, backups of Envoryx itself, and offsite copies to S3, SFTP or WebDAV, encrypted if you like. Restoring a project, or a whole instance on a new machine, is a click.

For a team or a client. Users with roles (viewer, developer, admin) per project, sign-in through OpenID Connect, an audit log, notifications to ntfy, Discord, Slack, Telegram or e-mail, resource limits and health checks per project. The interface speaks English, German, French, Spanish, Italian, Dutch, Polish, Portuguese, Russian and Ukrainian.

Scriptable. A REST API with scoped tokens, a command line (the same binary) and an MCP server for AI assistants like Claude Code or Cursor.

How it works

Envoryx keeps what each project should look like in its database (/config/envoryx.db) and makes Docker match it: on every change, at startup and every half minute. Each project gets its own network and one container per service:

Browser ──▶ Envoryx (Go API + React UI, proxy, SSH) ──▶ Docker Engine
                                                         ├── envoryx-<project>        network
                                                         ├── envoryx-<project>-web    Caddy / Apache / Nginx
                                                         ├── envoryx-<project>-php    or -node, -python, -go, -ruby, -java, -dotnet
                                                         ├── envoryx-<project>-database
                                                         └── envoryx-<project>-redis, -mailpit, …

Your files live in /projects/<name> on the host and are mounted into the containers, owned by your user. Envoryx only touches Docker resources it labelled itself (envoryx.managed=true), so everything else on the host is left alone. Updating Envoryx doesn't touch your projects either: their containers keep running while Envoryx is replaced.

Command line

The binary that runs the server is also the client. On the host:

docker exec -it envoryx envoryx project list
docker exec -it envoryx envoryx project exec shop -- php artisan migrate --force

From any other machine, after envoryx login --url https://envoryx.example.com:

envoryx project create "Shop" --php 8.4 --database mariadb --template laravel --start
envoryx project logs shop --follow
envoryx db snapshot shop --note "before the migration"
envoryx up        # in a clone: envoryx.yml becomes a project

See the command line docs for everything else.

Documentation

The user documentation, in English and German, is at envoryx.dev/docs. The reference material lives in this repository:

Document What's in it
DEPLOYMENT.md every setting and environment variable, Unraid, domains and HTTPS, the API, backups, managed instances
SECURITY.md the threat model, the Docker socket and how to harden a setup
ARCHITECTURE.md design, data model and the project lifecycle
DEVELOPMENT.md building, running and testing Envoryx locally
CHANGELOG.md what changed in each release

Contributing

Bug reports and ideas are welcome as issues. For code, see CONTRIBUTING.md; pull requests need a one-time signature of the Contributor License Agreement.

License

Envoryx is free software under the GNU Affero General Public License v3.0. You may use it freely, also commercially. If you change it and distribute it, or offer a changed version as a network service, you publish your changes under the same license. The projects you run inside Envoryx aren't affected by it.

Copyright (c) 2026 Stefan Mertens

Related apps

Details

Repository
ghcr.io/envoryx/envoryx:latest
Last Updated2026-10-27
First Seen2026-10-27

Runtime arguments

Web UI
http://[IP]:[PORT:8787]
Network
bridge
Shell
sh
Privileged
false

Template configuration

Web UI portPorttcp

Port of the Envoryx web interface.

Target
8787
Default
8787
Value
8787
Proxy HTTP portPorttcp

Embedded reverse proxy: opens projects by domain (http://shop.test). Change the host port if 80 is taken on your server; Envoryx detects the mapping.

Target
80
Default
80
Value
80
SSH port (IDE remote interpreter)Porttcp

Embedded SSH server for PhpStorm/WebStorm/VS Code remote interpreters and SFTP into project containers. Optional.

Target
2222
Default
2222
Value
2222
Proxy HTTPS portPorttcp

Embedded reverse proxy with certificates from Envoryx's local CA (https://shop.test). Change the host port if 443 is taken.

Target
443
Default
443
Value
443
ConfigPathrw

Envoryx database, generated configuration and caches. Holds an SQLite database: prefer the pool path (e.g. /mnt/cache/appdata/envoryx) or enable exclusive access for the appdata share; /mnt/user works but goes through FUSE.

Target
/config
Default
/mnt/user/appdata/envoryx
Value
/mnt/user/appdata/envoryx
ProjectsPathrw

Root folder of all development projects. Each project gets its own sub-folder.

Target
/projects
Default
/mnt/user/development
Value
/mnt/user/development
BackupsPathrw

Optional: folder for project backups, e.g. /mnt/user/backups/envoryx on the array. Leave empty to keep backups under /config/backups (appdata).

Target
/backups
Docker socketPathrw

Required: Envoryx creates the project containers through the Docker engine. See SECURITY.md for the socket-proxy alternative.

Target
/var/run/docker.sock
Default
/var/run/docker.sock
Value
/var/run/docker.sock
PUIDVariable

User id project files are owned by (99 = nobody).

Default
99
Value
99
PGIDVariable

Group id project files are owned by (100 = users).

Default
100
Value
100
Project port range startVariable

First host port assigned to project web servers.

Target
ENVORYX_PORT_RANGE_START
Default
20000
Value
20000
Project port range endVariable

Last host port assigned to project web servers.

Target
ENVORYX_PORT_RANGE_END
Default
20999
Value
20999
Project network rangeVariable

IPv4 range each new project network gets a /24 of. off leaves it to Docker, whose default ranges run out after about 30 networks.

Target
ENVORYX_NETWORK_POOL
Default
10.213.0.0/16
Value
10.213.0.0/16
Host for project links (optional)Variable

IP or host name browsers should use to open projects. Set this to the Unraid IP if Envoryx runs with its own IP (br0/macvlan) or behind a reverse proxy. Can also be changed in Envoryx's settings.

Target
ENVORYX_PUBLIC_HOST
Projects host path (optional)Variable

Only needed if auto-detection fails: the host path you mapped to /projects, e.g. /mnt/user/development.

Target
ENVORYX_PROJECTS_HOST_PATH
Shutdown graceVariable

How long running project operations (image pulls, backups) may finish after a stop signal. Must stay below Unraid's Docker stop timeout (Settings &gt; Docker, default 10 s); raise both together if you want image pulls to survive an Envoryx update. With 'Stop projects with Envoryx' enabled in Settings &gt; General, the stop timeout must also cover stopping all projects (60 s or more).

Target
ENVORYX_SHUTDOWN_GRACE
Default
8s
Value
8s
Config host path (optional)Variable

Only needed if auto-detection fails: the host path you mapped to /config, e.g. /mnt/user/appdata/envoryx.

Target
ENVORYX_CONFIG_HOST_PATH
Admin user (optional)Variable

Create the admin account automatically instead of via the setup page. Must be set together with the password.

Target
ENVORYX_ADMIN_USER
Admin password (optional)Variable

At least 10 characters.

Target
ENVORYX_ADMIN_PASSWORD
Secret key (optional)Variable

Key that encrypts the stored passwords and tokens: base64 of 32 bytes, e.g. from 'openssl rand -base64 32'. Leave empty to let Envoryx keep one in /config/secret.key; set here, it stays out of appdata backups. Keep a copy: without it, secrets can't be read back.

Target
ENVORYX_SECRET_KEY
Previous secret key (optional)Variable

Only for replacing the secret key: put the new key above and the current one here for one start. Envoryx re-encrypts everything with the new key; empty this field afterwards.

Target
ENVORYX_SECRET_KEY_OLD
Project ports listen onVariable

Where the project ports (databases, Mailpit, debuggers) listen: 'all' on every interface (the default when empty), 'local' only on the server itself (127.0.0.1), for a server reachable from the internet. The projects stay reachable through the proxy.

Target
ENVORYX_HOST_PORTS