Docker

Docker Compose is the recommended method for servers and NAS installs. Save this as docker-compose.yml, replacing /path/to/downloads with your own folder and choosing your own password:

services:
  weaver:
    image: ghcr.io/scryer-media/weaver:latest
    container_name: weaver
    restart: unless-stopped
    environment:
      # The login Weaver creates on its first start. Pick your own password.
      WEAVER_BOOTSTRAP_LOGIN_USERNAME: "admin"
      WEAVER_BOOTSTRAP_LOGIN_PASSWORD: "choose-a-password"
      WEAVER_INTERMEDIATE_DIR: /downloads/intermediate
      WEAVER_COMPLETE_DIR: /downloads/complete
    ports:
      - "9090:9090"
    volumes:
      - weaver-config:/config
      - /path/to/downloads:/downloads

volumes:
  weaver-config:

Start it:

docker compose up -d

Open http://localhost:9090 — or http://<server-ip>:9090 from another machine — and sign in with the username and password you just set.

A native install runs a setup wizard in the browser and accepts it only from the machine Weaver runs on. Inside a container no browser is ever that machine: requests arrive over Docker’s network, never on the container’s own loopback. So there is no wizard to run, and the first login comes from the environment instead. Start a container without one and the page says so rather than showing a form nobody could submit.

Those two variables are read only while no login exists. Changing them later does nothing — change the password in Settings → Security. Once you have signed in they can be deleted from the compose file, as long as you keep the /config volume.

Every browser signs in, from any network. See Security And Access.

Advanced First-Run Options

Skip these unless you want them. Configuration documents every variable in full.

Keeping The Password Out Of The Compose File

WEAVER_BOOTSTRAP_LOGIN_PASSWORD_FILE reads the password from a file instead — a Docker secret, or any file you mount:

services:
  weaver:
    environment:
      WEAVER_BOOTSTRAP_LOGIN_USERNAME: "admin"
      WEAVER_BOOTSTRAP_LOGIN_PASSWORD_FILE: /run/secrets/weaver-login
    secrets:
      - weaver-login

secrets:
  weaver-login:
    file: ./weaver-login.txt

The file holds the password and nothing else; one trailing newline is stripped. Set exactly one of WEAVER_BOOTSTRAP_LOGIN_PASSWORD and WEAVER_BOOTSTRAP_LOGIN_PASSWORD_FILE — both together stop startup.

Remembering Browsers Only On Your Own Network

Any browser can tick Remember this browser for 30 days at sign-in. To honour that only on your own network, list the network under Remembered-session CIDRs in Settings → Security → Network access, or pin it from the compose file. The two variables go together:

WEAVER_ACCESS_MODE: authenticated
WEAVER_TRUSTED_CIDRS: "192.168.1.0/24"

Browsers outside the list still sign in, but their session ends when the browser closes.

Before relying on the list, check Current connection at the bottom of the Network access section. A container sees addresses from inside its own network, so a browser arriving through a published port shows up as Docker’s gateway, and a LAN range matches nothing. If that’s what you see, put a reverse proxy in front and trust it, as Reverse Proxy explains. Don’t trust the Docker gateway itself.

Reaching Weaver By Hostname

Weaver answers any hostname: weaver from another container, a NAS name like nas.local, or a public name a reverse proxy forwards. Nothing needs to be listed.

To refuse unknown names, set WEAVER_HTTP_ALLOWED_HOSTS. Weaver then answers only the listed names, plus localhost and plain IP addresses, and refuses the rest with 421 request Host is not allowed:

WEAVER_HTTP_ALLOWED_HOSTS: "weaver,nas.local,weaver.example.com"

List names only, without https:// or a path. Matching is exact: no wildcards, and a subdomain is a different name. Adding :9090 to an entry pins it to that port and refuses requests without one, so leave ports off unless you mean to require them.

Each address you open Weaver at needs its own sign-in. Signing in at http://nas.local:9090 doesn’t sign you in at http://192.168.1.20:9090.

What The Image Already Sets

The image runs --config /config serve --port 9090 and ships WEAVER_HTTP_BIND_ADDRESS=0.0.0.0. A native install listens on 127.0.0.1 so it is never exposed by accident; in a container that would only make the published port unreachable, because a container’s loopback is its own network namespace. The ports: mapping is what decides exposure here.

WEAVER_INTERMEDIATE_DIR and WEAVER_COMPLETE_DIR are first-run seeds: Weaver stores them the first time it starts with nothing configured and ignores them afterwards, so change paths in Settings → General from then on. Leave them out and downloads land under /config, in the volume meant for the database. See Configuration.

Unraid

Weaver is on the Unraid Community Applications store. It runs the same image, including its bind address, so the first-run rule is the same: the login has to come from the template. Install it, set your paths, fill in Login Username and Login Password, then open the WebUI and sign in. Those two fields set WEAVER_BOOTSTRAP_LOGIN_USERNAME and WEAVER_BOOTSTRAP_LOGIN_PASSWORD.

Upgrading An Unraid Install To 0.12.0

Pull the new image from the Docker tab as usual. An install that existed before 0.12.0 keeps its previous access settings, so nothing changes about who gets in. Your login, sessions, API keys, and download client connections carry over. Two things are different once it’s back up:

The interface is new. The previous one is still available as a per-browser choice in Settings.
Weaver refuses to be framed. A dashboard that embedded the WebUI in an iframe now shows an empty panel. Open Weaver in its own tab.

Moving to the new access model is optional. Set Access Mode to authenticated under the template’s advanced settings and restart the container. If your copy of the template predates that field, add WEAVER_ACCESS_MODE with that value as a new variable instead. See Installs That Predate 0.12.0 for what changes.

Give Weaver and Scryer the same host path at the same container path, so Scryer can import from the complete directory without copying:

  weaver:
    environment:
      WEAVER_INTERMEDIATE_DIR: /data/intermediate
      WEAVER_COMPLETE_DIR: /data/downloads
    volumes:
      - weaver-config:/config
      - /path/to/media:/data

Storage Layout explains why one mount matters.

Container Runtime

The entrypoint applies UMASK, re-owns /config to PUID and PGID (default 1000), and drops to that user. All of that is skipped when the container does not start as root. TZ sets the timezone for bandwidth windows and quota resets.

Subpath

To host Weaver at https://example.com/weaver/, override the command:

command: ["--config", "/config", "serve", "--port", "9090", "--base-url", "/weaver"]

See Reverse Proxy for the proxy side and allowed hostnames.

Upgrading

docker compose pull
docker compose up -d

For all install methods, see Upgrading.