Run Your Own Docker Containers on a Seedbox

What You Get

Every Bytesized appbox comes with rootless Docker and SSH. That means you can run your own containers and Docker Compose stacks right next to the one-click apps, and any web app you start can get its own address like myapp.USERNAME.SERVER.bysh.me with a real HTTPS certificate, automatically. No DNS setup, no certbot, no port forwarding.

Most shared seedbox hosts do not allow customer containers at all. Ultra.cc formally declined the feature and GigaRapid forbids it outright. Of the few hosts that do allow it, containers are usually left without a web route, so you end up fiddling with raw ports. On Bytesized the routing and the certificate are already there.

Everywhere below, replace USERNAME with your panel username in lowercase and SERVER with your server name. Your appbox page shows both, in the form username.server.bysh.me.

Before You Start

SSH into your appbox and check that Docker answers:

docker info

If you see server details, you are good. If the command is missing or cannot connect, install any Docker app from your panel once (Vaultwarden is a tiny one), which sets up Docker and the routing layer for you, or just open a ticket and we will switch it on.

Quick sanity check:

docker run --rm hello-world

You should see "Hello from Docker!".

Your First Container with Its Own HTTPS Address

This starts a tiny demo web server and puts it on its own subdomain:

docker run -d --name whoami --restart unless-stopped \
    --network traefik_USERNAME \
    -l 'traefik.enable=true' \
    -l 'traefik.http.routers.whoami.rule=Host(`whoami.USERNAME.SERVER.bysh.me`)' \
    -l 'traefik.http.routers.whoami.entrypoints=web' \
    -l 'traefik.http.services.whoami.loadbalancer.server.port=80' \
    traefik/whoami

Give it about five seconds, then open https://whoami.USERNAME.SERVER.bysh.me in your browser. That is your container, live on the internet, with a valid certificate.

The four labels are the whole trick:

• traefik.enable=true tells the proxy to route this container.
• The routers rule sets the address. Pick any subdomain you like; they all work.
• entrypoints=web connects it to the proxy.
• The loadbalancer.server.port is the port your app listens on inside the container. Check the app's own documentation for that number.

Two rules to remember: the router name (the word after routers. and after services.) must be unique per container, and the container must join your traefik_USERNAME network.

Clean up the demo with docker rm -f whoami.

The Same Thing with Docker Compose

For real apps you will want a Compose file, so the setup is saved and repeatable. Create ~/apps/whoami/compose.yaml:

services:
  whoami:
    image: traefik/whoami
    container_name: whoami
    restart: unless-stopped
    networks:
      - traefik_USERNAME
    labels:
      - traefik.enable=true
      - traefik.http.routers.whoami.rule=Host(`whoami.USERNAME.SERVER.bysh.me`)
      - traefik.http.routers.whoami.entrypoints=web
      - traefik.http.services.whoami.loadbalancer.server.port=80

networks:
  traefik_USERNAME:
    external: true

Then:

cd ~/apps/whoami
docker compose up -d

docker compose down stops it and the web route disappears with it. If you ran the same app with docker run earlier, remove that container first; two containers with the same router name will fight over the route.

For a full real-world example, see our Immich guide, and if you prefer clicking over typing, Portainer gives you a web UI for all of it.

About Ports

You normally do not need to publish any ports; the proxy reaches your container over the internal network. If a tool genuinely needs a raw port, bind it to localhost and use a number of 1024 or higher, like -p 127.0.0.1:28999:80. Publishing to 0.0.0.0 puts the port on a shared public address, which you do not want, and ports below 1024 are refused on rootless Docker:

cannot expose privileged port 80 ... choose a larger port number (>= 1024)

HTTPS on ports 80 and 443 is exactly what the proxy does for you, so in practice this limit does not get in your way.

Honest Limits

Rootless Docker keeps everyone on a shared server safe, and it comes with a few real limits. We would rather you know them upfront:

• No GPU. Containers cannot see a graphics card, so no hardware transcoding or CUDA inside your own containers.
• Resource flags are not enforced. --memory and --cpus are accepted but do nothing on this setup, and docker stats shows host totals rather than per-container numbers. Be a good neighbour with heavy workloads.
• Ports below 1024 cannot be bound directly, as above.
• VPN-style containers that reshape networking are untested territory here. If that is your use case, talk to us first.

Housekeeping

• --restart unless-stopped brings your containers back after a server reboot.
• Images count against your disk space. docker image prune cleans up leftovers.
• Want an app as a proper one-click install instead? Use the Request a Docker Image button on the apps page. We add new images on request, usually within a day.

More background on the whole feature lives on the Docker App Hosting page.