Docker

docker compose up -d

docker-compose.yml pulls the prebuilt makershop/llamanexus-webui image by name/tag (makershop/llamanexus-webui:${TAG:-latest}) - no build step. Set TAG= in your environment (or a .env file next to docker-compose.yml) to pin a specific version instead of latest.

Uses network_mode: host by default so LAN server auto-discovery (UDP broadcast) actually works - Docker's default bridge network doesn't relay that traffic in. If you don't need auto-discovery (you can always type your LlamaNexus proxy's URL directly in Settings), switch to the commented-out ports: mapping in docker-compose.yml instead.

./data (bind-mounted to backend/data) persists Settings and every session across container recreation. On first boot, docker-entrypoint.sh seeds it with bindHost: 0.0.0.0 - the app's own default (127.0.0.1) would otherwise make it unreachable from outside the container entirely, with no way to fix it via the Settings UI since you could never reach that UI to begin with. ./workspace is an optional mount for read_file/write_file/patch_file/run_bash to operate against - point Settings → Connection → "Workspace root" at /workspace once the container's up. Gated/private Hugging Face repo search is configured on the LlamaNexus proxy itself (HF_TOKEN, see LlamaNexus Docker setup) - this backend doesn't read an HF token of its own.

A .env file next to docker-compose.yml can set LLAMANEXUS_LICENSE_KEY (overrides the Settings UI value, disabling that field), LLAMANEXUS_PORT, and LLAMANEXUS_BIND_HOST - see Settings.

Reference docker-compose.yml

services:
  llamanexus-webui:
    container_name: llamanexus-webui
    image: makershop/llamanexus-webui:${TAG:-latest}
    network_mode: host
    # ports:
    #   - "8787:8787"
    volumes:
      - ./data:/app/backend/data:z
      - ./workspace:/workspace:z
    environment:
      - LLAMANEXUS_LICENSE_KEY=${LLAMANEXUS_LICENSE_KEY:-}
      - LLAMANEXUS_PORT=${LLAMANEXUS_PORT:-}
      - LLAMANEXUS_BIND_HOST=${LLAMANEXUS_BIND_HOST:-}
    restart: unless-stopped

:z relabels the bind mounts for container access under SELinux (Fedora/RHEL) - a harmless no-op on hosts without SELinux.