Install

Up and running in under a minute.

One native binary — no JVM at runtime, no npm toolchain. Evaluate the full UI in Docker in seconds, or run it properly under systemd.

Fastest path — evaluate in Docker

terminal
docker run -d -p 8080:8080 --cap-add NET_ADMIN \
  -e ISLANDR_ADMIN_PASSWORD=change-me \
  -v islandr:/data ghcr.io/chriscohnen/islandr:latest
# → http://localhost:8080

Boots the full console so you can click around and build a config. For real WireGuard/nftables enforcement, use one of the paths below.

Install

Pick your path.

From a throwaway dev instance to a production hub under systemd.

terminal
# Clone & run with Quarkus live coding
git clone https://github.com/chriscohnen/islandr.git
cd islandr
./gradlew quarkusDev
# → http://localhost:8080   (admin / admin in the %dev profile)
terminal
# Download pre-built binary (x86_64 or ARM64)
ARCH=$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/')
curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}" \
     -o /tmp/islandr
curl -fsSL "https://github.com/chriscohnen/islandr/releases/latest/download/islandr-runner-linux-${ARCH}.sha256" \
     | sha256sum -c -

# Set up the unprivileged service user, scoped sudo for wg/nft (ADR-0011),
# and the systemd unit — read it first before piping to sudo bash
curl -fsSL https://raw.githubusercontent.com/chriscohnen/islandr/main/docs/install/setup-hub.sh \
     -o setup-hub.sh
sudo bash setup-hub.sh

Not a fresh box, or want every step spelled out? The full install guide walks through the same steps by hand.

docker-compose.yml
services:
  islandr:
    image: ghcr.io/chriscohnen/islandr:latest
    ports: ["8080:8080"]
    cap_add: ["NET_ADMIN"]
    environment:
      ISLANDR_ADMIN_USER: admin
      ISLANDR_ADMIN_PASSWORD: change-me
    volumes: ["./data:/data"]

# docker compose up -d   →   http://localhost:8080

In production the admin password has no default — without ISLANDR_ADMIN_PASSWORD the local login stays deliberately disabled (HTTP 503). A known default in containers would be a security hole.

Production

A bare container boots the full UI so you can build a config, but enforcing nftables rules needs privileges. For production run the native binary under systemd, or attach the host socket proxy — the full install guide covers the least-privilege setup.

Get started

One binary, one command — home in under a minute.

Full install guide Clone on GitHub

→ then open http://localhost:8080

copied