Run the hub with Docker or on a NAS

The hub ships as a Docker image, so it runs on most NAS systems and servers.

Start it

Pictures for every step: the NAS & Docker guide.

On the NAS or server (over SSH), go to the folder where you keep apps and paste:

curl -fsSL https://unicam.si/docker.sh | sh

It downloads the latest hub into ./unicam-hub, checks its SHA-256, builds the image on this machine and starts it with Docker Compose. The first build takes a few minutes. It runs on 64-bit x86 and ARM (arm64) machines. If your user can’t use Docker, run it with sudo sh instead of sh.

Then open http://<your-nas-ip>:7700/pairing on any device on your network for the pairing code. To update, run the same line again from the same folder; unicam-hub/unicam-data (recordings, keys, settings) is never touched.

Why host networking

The compose file uses host networking. That lets the hub discover cameras on your network (ONVIF uses multicast, which doesn’t cross Docker’s default bridge) and serve live video over WebRTC directly. The hub uses port 7700 for the app and API and 8555 (TCP and UDP) for live video.

Where data goes

• ./unicam-data holds the hub’s database, keys and local footage. Back this folder up; it contains your encryption keys.
• To record onto a NAS share or USB disk, mount it into the container (the compose file has a commented example), then add that path in Storage → Folder / NAS / USB.

The container runs as an unprivileged user.

Synology, QNAP, Unraid, TrueNAS

Use your NAS’s Docker or Container Manager with the same compose file, keeping host network mode. Map the data folder to a share you back up.

Home Assistant

A Home Assistant add-on is coming. Until then, on Home Assistant Container or Supervised installs run the Docker Compose setup next to Home Assistant. On Home Assistant OS, run the hub on another machine, such as a Raspberry Pi, a NAS or the desktop app.

Don’t expose it to the internet

Never port-forward 7700 or your cameras’ RTSP ports on your router. Away from home, the app uses the built-in, end-to-end encrypted relay (or Tailscale, if you use it). See Remote access.