Ports and Data
The host ports a self-hosted Sealant listens on, where it keeps its state, and what to back up.
Everything Sealant needs on disk lives in one directory and three Docker named volumes. This page is the reference for what listens where and what to preserve.
Ports
By default every user-facing port binds to loopback (127.0.0.1). Change the interface with
SEALANT_BIND_HOST and the host ports with the
SEALANT_*_PORT knobs. Postgres and RabbitMQ are never published to the host — they are reachable
only inside the compose network.
| Service | Host bind | Container port |
|---|---|---|
| Web app | 127.0.0.1:3000 | 3000 |
| API | 127.0.0.1:4000 | 4000 |
| SSH gateway | 127.0.0.1:2222 | 2222 |
| zot registry | 127.0.0.1:5000 | 5000 |
| Postgres | internal only | 5432 |
| RabbitMQ | internal only | 5672 |
The registry stays on loopback even when SEALANT_BIND_HOST=0.0.0.0 — only web, API, and SSH follow
the bind host. See Beyond localhost for exposing the stack safely.
State
| State | Location | Kind |
|---|---|---|
| Install metadata | ~/.sealant/compose.yaml, ~/.sealant/.env | Host files |
| Postgres data | sealant_postgres-data | Docker named volume |
| Registry data | sealant_zot-data | Docker named volume |
| SSH gateway host key | sealant_gateway-keys, at /keys/ssh_gateway_host_key | Docker named volume |
| Workspace control sockets | /run/sealant/sockets | Host path |
| Workspace containers and images | Host Docker daemon (via the mounted socket) | Docker objects |
A few things worth knowing:
- The control plane's durable state is Postgres. Accounts, SSH keys, workspace metadata, and
execution records all live in the
sealant_postgres-datavolume. - The SSH gateway host key is generated once into
sealant_gateway-keysand is not rotated on upgrade. Deleting that volume changes the host key and triggers the "host key changed" warning on next connect. - Workspaces run on your host Docker daemon, created by the worker through the mounted socket. They are not part of the compose project — see the uninstall note below.
- The registry (
sealant_zot-data) holds the built workspace images. It is a cache: it can be rebuilt from source repositories, but losing it means re-building workspaces.
What to back up
To capture a full install, preserve:
~/.sealant/.env— your secrets and knobs. Without it you cannot match the DB password to the volume, preserve web session signing, or keep the SSH gateway token stable. Back this up somewhere safe.- The
sealant_postgres-datavolume — all durable control-plane state.
The sealant_zot-data and sealant_gateway-keys volumes are recoverable (rebuild images;
regenerate a host key), though restoring the gateway key avoids the host-key-changed warning for
existing users.
A note on uninstall
docker compose --project-directory ~/.sealant down -v removes the compose services and the three
named volumes. It does not remove workspace containers or images the worker created on your host
Docker daemon — those are separate Docker objects. Clean them up with the usual docker commands if
needed. Full sequence in Upgrade, repair, uninstall.
Related: Environment variables · Installer and compose
Environment Variables
The operator environment reference for a self-hosted Sealant — installer-generated secrets, ports and bind knobs, GitHub App variables, and the runtime defaults worth knowing.
Installer and Compose
Reference for install.sh — every environment override, how the version is resolved, the compose services it starts, and the docker compose commands to operate the stack.