Docker Deployment

Anyy includes a Dockerfile and Compose definition for a resident, self-hosted deployment. The container runs the Gateway and Dashboard under supervision, while a named volume keeps Profile data across container replacement.

Use the native installer when you want Anyy to integrate directly with one macOS or Linux user account. Use Docker when container lifecycle and isolation fit the host better.

What You Need

• Docker Engine or Docker Desktop with Docker Compose v2;
• the Anyy source checkout containing Dockerfile and compose.yaml; and
• one model provider credential for setup.

The supplied image supports Linux amd64 and arm64. The default Compose project builds a local image named anyy:local; this page does not assume a public Anyy image registry.

Build and Configure

From the repository root:

docker compose build
docker compose run --rm anyy setup

The setup container writes configuration and credentials to the persistent anyy-data volume. It runs Anyy as the unprivileged anyy user, not as root.

Re-run setup when configuration changes

docker compose run --rm anyy setup reuses the same volume. You can use it later to change providers, models, or optional capabilities without rebuilding the image.

Start Anyy

docker compose up -d
docker compose ps
docker compose logs anyy

The container starts the default Profile Gateway, waits for it to become healthy, and then starts Dashboard. Open:

http://127.0.0.1:8767

Use the tokenized Dashboard URL printed in the logs. Treat that token as a secret.

The default deployment publishes only Dashboard and binds it to host loopback. Gateway RPC remains on a Profile-local Unix socket inside the volume; there is no public Gateway TCP port.

Run Anyy Commands

Run administrative commands inside the active container:

docker compose exec anyy anyy status
docker compose exec anyy anyy doctor
docker compose exec anyy anyy skills list

The entrypoint drops these commands to UID/GID 10000. Files in the persistent volume therefore remain owned by the unprivileged Anyy user.

Ports and Time Zone

Set Compose variables before starting the project:

ANYY_DASHBOARD_PORT=8877 TZ=Asia/Shanghai docker compose up -d

Variable	Default	Purpose
ANYY_DASHBOARD_PORT	8767	Host loopback port mapped to Dashboard
TZ	UTC	Container time zone used by schedules and displayed times
ANYY_IMAGE	anyy:local	Exact trusted image name to run instead of the default local tag

Changing ANYY_DASHBOARD_PORT does not change the container's internal port.

Keep Dashboard private

Do not replace the 127.0.0.1 host binding with a public address without a deliberate access design. For remote access, prefer a trusted tunnel or a TLS reverse proxy, and continue protecting the Dashboard token.

Data and Backups

The named anyy-data volume is mounted at /data. It contains the Profile root: configuration, credentials, sessions, memory, Skills, Workspace files, logs, and backups.

Create a Profile backup from the running container:

docker compose exec anyy anyy backup create
docker compose exec anyy anyy backup list

Credentials are excluded unless you explicitly use --include-secrets. A backup stored only inside the same Docker volume is not an independent recovery copy; export a verified archive to separate storage when disaster recovery matters.

Never share one writable volume between live deployments

Two running Anyy deployments must not mount the same Profile root or anyy-data volume. The Gateway is the single live writer for its Profile state.

Update

For a source-built deployment, update the trusted checkout, then rebuild and recreate:

docker compose build --pull
docker compose up -d
docker compose ps

If you deliberately set ANYY_IMAGE to a trusted registry image, use that registry's release process:

docker compose pull
docker compose up -d

anyy update does not replace a container-managed installation. Container replacement preserves the named data volume.

Stop or Remove

Stop while keeping the container and volume:

docker compose stop

Remove containers and the project network, but keep Profile data:

docker compose down

Delete the deployment and its persistent data only after a verified backup:

docker compose down --volumes

--volumes deletes the Profile data

docker compose down --volumes removes the named volume, including configuration, credentials, sessions, memory, Skills, and Workspace files. This is the container equivalent of a full data removal.

Isolation and Runtime Boundaries

One Compose project is one trusted Anyy deployment, not necessarily one Profile. Profiles may share it only when they belong to the same trusted operator and do not need separate resource, network, compliance, or blast-radius boundaries.

For stronger isolation, create another Compose project with another volume and host port. Do not add Compose init: true: the image's s6 supervisor must remain PID 1. The default deployment does not mount the Docker socket or control other containers.

Troubleshooting

Problem	Fix
Setup cannot save files	Confirm the named volume is writable by UID/GID 10000; do not replace it with a root-owned bind mount without fixing ownership
Container stays unhealthy	Run docker compose logs anyy; health requires the default Profile Gateway to be ready
Dashboard does not open	Check docker compose ps, the selected ANYY_DASHBOARD_PORT, and the loopback URL printed in logs
A command cannot find the Profile	Run it through docker compose exec anyy anyy ... so /data and the container environment are used
Recreated container looks new	Confirm the same Compose project and named volume are attached; project names create distinct volumes
Update has no effect	Rebuild the source image or pull the configured trusted image, then recreate the service

For the choices inside Setup and the first conversation, continue with Quickstart, substituting the Compose lifecycle commands on this page for native host commands. Read Backup & Restore before moving the deployment.