Seawise.io Client

Share your self-hosted apps with family, friends or clients. Jellyfin, Plex, Seerr, Immich, Home Assistant or anything else with a web page.

Run one Docker container, connect it to your Seawise.io account, and pick which apps to make reachable. Visitors sign in with Google, GitHub or an email link and only see the apps you share with them. Nothing for them to install.

Works behind CGNAT, double NAT and firewalls. No port forwarding, no VPN, no domain or DNS setup.

Quick Start

Linux:

docker run -d --name seawise \
  --restart unless-stopped \
  --network host \
  -e SEAWISE_HOST_NETWORK=true \
  -v seawise-data:/config \
  --log-opt max-size=10m --log-opt max-file=3 \
  ghcr.io/seawise-io/seawise-client:latest

Docker Desktop (macOS, Windows):

docker run -d --name seawise \
  --restart unless-stopped \
  -p 8082:8082 \
  -v seawise-data:/config \
  --log-opt max-size=10m --log-opt max-file=3 \
  ghcr.io/seawise-io/seawise-client:latest

Docker Compose: use the docker-compose.yml in this repo.

The --log-opt flags cap Docker's copy of the client's logs at 30 MB.

Then open http://localhost:8082, or http://your-server-ip:8082 from another computer on your network.

Setup

1. Set a password for the web UI right away. This has to happen within 5 minutes of the container starting. If the window passes, run docker restart seawise to open it again.
2. Click Connect to Seawise.io and approve the connection in your browser.
3. Add apps by name, host and port.

Each app gets its own address on seawise.dev. Apps are private: only you can open them after signing in, until you add them to a portal and invite people.

What People Use It For

More in the guides, including CGNAT, sharing with clients and per-person access.

Adding Apps

Link-local addresses (169.254.0.0/16, fe80::/10), including cloud metadata endpoints, can't be added.

FAQ

Do I need port forwarding, a public IP or a domain? No. The client connects out to Seawise.io, so nothing on your router changes. It works behind CGNAT.

Is it safe to share Jellyfin or Immich this way? Apps are private by default. Visitors sign in before they reach anything, and you choose who can open each app. Nothing on your network is opened to the internet.

Do the people I share with need an account or an app? They sign in with Google, GitHub or an email link in any browser. Nothing to install.

How is this different from Cloudflare Tunnel, Tailscale or ngrok? See the comparison. In short: no domain needed, sign-in for guests is built in, and you get portals, one page per group of people with the apps you share.

What does it cost? The free plan covers one server, 30 apps and one portal. See pricing.

Docker Compose

services:
  seawise:
    image: ghcr.io/seawise-io/seawise-client:latest
    container_name: seawise
    restart: unless-stopped
    network_mode: host
    environment:
      SEAWISE_HOST_NETWORK: "true"
    volumes:
      - seawise-data:/config
    logging:
      options:
        max-size: 10m
        max-file: "3"

volumes:
  seawise-data:

On Docker Desktop, replace network_mode and environment with ports: ["8082:8082"].

Security

• Outbound only. The client opens the connection to Seawise.io. Nothing on your network is opened to the internet.
• This client decides what is reachable. Apps are added and changed only here. The Seawise.io website and servers can't add apps or change where they point.
• Verified tunnel. The client only connects to *.seawise.dev and checks the server's TLS certificate.
• Protected web UI. Password required, stored as a bcrypt hash, with a growing delay after failed attempts. The first-run password window closes after 5 minutes.

To report a vulnerability, see SECURITY.md.

What the Client Sends

To Seawise.io:

• The server name you choose when connecting.
• Each app's name, host and port, when you add it.
• Every 30 seconds: whether the tunnel is connected, how many apps there are and the client version.
• Whether each app is up or down.

To the tunnel server: the tunnel login, which includes the FRP version, operating system, CPU type and the machine's hostname, and then the traffic for the apps you've shared.

To GitHub: a check for new releases, which powers the update banner.

It never sends your apps' content or files, its logs, the web UI password, or anything about apps you haven't added. It doesn't scan your network.

Environment Variables

Health Checks

Both are unauthenticated.

Updating

docker pull ghcr.io/seawise-io/seawise-client:latest
docker stop seawise && docker rm seawise
# Run the same docker run command again. Pairing, apps and password are kept in the volume.

With Compose: docker compose pull && docker compose up -d.

The web UI shows a banner when a new version is available.

Platform Support

• Images: Linux amd64 and arm64 (Raspberry Pi, most NAS devices)
• Hosts: Linux, macOS and Windows with Docker, Unraid, Synology, TrueNAS
• Requirements: Docker 20+, outbound HTTPS (port 443)

Documentation

• Quick start
• Apps
• Portals and sharing
• Client configuration
• Security
• Guides

License

MIT. Tunnels use FRP (Apache 2.0); its license ships in the image at /app/licenses/frp-LICENSE.