Deepseek Harness Docker

DeepSeek Harness Docker

Use the public runzhliu/deepseek-harness-docker project as the source of truth. Treat it as a community containerization project around the official @deepseek-ai/dsh npm package, not as an official DeepSeek image.

Preserve the security boundary

• Bind native WebUI port 3080 and noVNC port 6080 to 127.0.0.1 only. For an explicit trusted-LAN request, use compose.lan.yaml; never publish the native ports.
• Never create a public Ingress, LoadBalancer, NodePort, unrestricted -p 3080:3080, privileged container, or Docker socket mount.
• Pass provider keys only at runtime through the Harness settings page, environment variables, .env, or Kubernetes Secrets. Never write credentials into Dockerfiles, images, Compose files committed to Git, logs, or answers.
• Keep the named dsh-home volume unless the user explicitly asks to delete all Harness settings, credentials, sessions, and browser state.
• Mount only the workspace the user authorizes. Do not broaden a bind mount to a home directory or filesystem root.
• Treat the optional plugin market and every installed plugin as third-party code with access to the mounted workspace and persisted Harness profile.

Locate the deployment files

Use the current checkout when it contains compose.yaml and Dockerfile. Otherwise clone the public repository:

git clone https://github.com/runzhliu/deepseek-harness-docker.git
cd deepseek-harness-docker

Read README.md, SECURITY.md, compose.yaml, and .env.example before changing defaults. Prefer the repository's pinned image and DSH versions; do not silently switch to latest.

Choose the smallest suitable mode

Use default Compose for a local, single-user WebUI with the embedded Debian Chromium desktop. The image attaches official Playwright MCP Browser Use to the same persistent Chromium used for visible human takeover. Add compose.lan.yaml only for an explicit trusted-LAN request, after choosing one exact bind address, an internal DNS name or IP, a Caddy Basic Auth credential, and a firewall boundary. This mode uses caddy:2.11.4-alpine and still represents one shared trust domain, not multi-tenancy. Select the immutable 0.2.1-alpha.2-r1-ungoogled.1 tag only when the user explicitly prioritizes minimized Google background egress and accepts its contributor-binary and reduced browser-service tradeoffs. Add compose.market.yaml only when the user explicitly wants the community plugin market. Use headless mode for one-shot automation and Helm only when the user requests Kubernetes.

Use compose.bwrap.yaml and immutable image 0.2.1-alpha.2-r1-bwrap.1 only when a Docker host cannot enforce Landlock and the user accepts seccomp=unconfined plus systempaths=unconfined. First distinguish a kernel with Landlock omitted from the active LSM list from a kernel built without Landlock; prefer enabling the existing LSM when possible. Never add SYS_ADMIN, --privileged, or the Docker socket. Require unprivileged user namespaces, run make bwrap-smoke, and confirm /workspace writes succeed while writes to the test's separate outer writable mount fail. Do not apply this overlay to rootless Podman or Kubernetes.

For an explicitly rootless Podman deployment, require Podman 4.5 and podman-compose 1.6.0 or newer, then add compose.podman.yaml. Confirm podman info --format '{{.Host.Security.Rootless}}' returns true. The overlay maps the caller to container UID/GID 1000 and privately labels the workspace on SELinux hosts; authorize one dedicated project directory and never broaden the mount to a shared home or filesystem root. Use make podman-smoke when validation is requested.

Enable protected LAN access

Follow the .env.lan.example and README procedure. Generate the bcrypt hash without recording its plaintext, keep .env.lan private, bind DSH_LAN_BIND_ADDRESS to one exact server LAN IP, and prefer an internal DNS name for DSH_LAN_HOST. Start with make lan-up, install the persistent Caddy internal CA root on authorized clients, and use the DSH launch token only through the resulting HTTPS URL. Verify with make lan-smoke. Tell the user that all authenticated clients share the same Harness authority and that mutually untrusted users need isolated instances and volumes.

Start the default local runtime

1. Confirm Docker and Compose are available:

   docker version
   docker compose version

2. Resolve the requested workspace to an absolute path and confirm it is the intended writable directory.

3. Pull and start without rebuilding unless the user asks for a local source build:

   DSH_WORKSPACE=/absolute/path/to/project docker compose pull
   DSH_WORKSPACE=/absolute/path/to/project docker compose up -d --no-build
   docker compose ps

4. Wait for the deepseek-harness service to become healthy. Verify both surfaces:

   test "$(curl --silent --output /dev/null --write-out '%{http_code}' http://127.0.0.1:3080/)" = 401
   curl --fail http://127.0.0.1:6080/novnc-debian-1.6.0-2/vnc.html
   docker compose logs --tail=120 deepseek-harness

5. Tell the user to open http://127.0.0.1:3080. Configure the model provider and key in Harness settings. Use the WebUI browser action for the embedded Chromium desktop; use http://127.0.0.1:6080/novnc-debian-1.6.0-2/vnc.html?autoconnect=1 only as a direct fallback.