UniFi Protect UNVR Docker ARM64

To enable cloud remote access, the primary network interface on the host must be named enp0s2.

Steps to rename interface:

1. Create /etc/systemd/network/98-enp0s2.link on the host.
2. Add the following content, replacing xx:xx:xx:xx:xx:xx with your actual MAC address:

[Match]
MACAddress=xx:xx:xx:xx:xx:xx

[Link]
Name=enp0s2

3. Update network settings: Update your firewall rules and /etc/network/interfaces to reflect the new interface name.
4. Apply changes: Run sudo update-initramfs -u and reboot the host.

Note: Remote access via the cloud does not work with Docker on macOS. Use a Debian VM instead.

To run the container, you must first build the image using build.sh or the Dockerfile (see Building). Once built, use docker compose with the provided configuration files.

Standard Linux/ARM64 usage:

docker compose -f docker-compose.yml -f docker-compose.override.yml up -d

macOS usage: On macOS, use the specific macOS compose file:

docker compose -f docker-compose.macos.yml -f docker-compose.override.yml up -d

Important Requirements:

• RAM: Requires at least 4 GB RAM.
• Network: Requires IPv6 to be enabled (even if blocked/unrouted).
• Ports: Ensure ports 80 and 443 are not in use by other services.
• VMs: If running inside a VM, bridge the network adapter or forward ports from the host to the VM.

Initial Console Setup

1. Disconnect Internet: Disconnect the Docker host from the internet during the initial console setup. If connected, the console may auto-update and break the container.
2. Offline Mode: Proceed with the offline mode setup.
3. Disable Auto-Updates: Once setup is complete, navigate to console settings and disable auto-update for the console and applications.

Updating Protect

To update, rebuild the image using build.sh or Dockerfile, then run docker compose up -d. Protect will handle the migration automatically.

WARNING:

• Never downgrade versions. Downgrading can break Protect and may make camera firmware updates irreversible.
• Always maintain regular backups of the host and its data before updating.

Custom configurations should be placed in a docker-compose.override.yml file.

Key Configuration Options:

• STORAGE_DISK: Must point to the disk holding the storage folder volume.
• devices: If the container cannot access the disk directly, you must mount it using the devices key (e.g., /dev/sda:/dev/sda).
• DEVICE: Set this to change the default device type (e.g., UNVR_PRO).
• DEBUG: Enable all debug options.
• DEBUG_STORAGE: Enable storage disk operations logging.
• DEBUG_UNIFI_CORE: Enable unifi-core debug log level.

Example docker-compose.override.yml:

services:
  unifi-protect:
    # devices:
    #   - /dev/sda:/dev/sda
    environment:
      - STORAGE_DISK=/dev/sda
      # - DEVICE=UNVR_PRO
      # - DEBUG=true
      # - DEBUG_STORAGE=true
      # - DEBUG_UNIFI_CORE=true

If you encounter errors related to /init.scope or manager object (e.g., Failed to create /init.scope control group: Read-only file system), it is likely a systemd issue within Docker.

Solution: Boot the host system with the following kernel parameter: systemd.unified_cgroup_hierarchy=0

Note: If docker compose logs produces no output, this systemd error is the most likely cause.

RTSP streams can be accessed by modifying the URL found in the camera settings under Advanced.

1. Locate the RTSP URL in the camera settings.
2. Remove ?enableSrtp from the end of the string.
3. Change the protocol to rtsp and ensure it uses port 7447.

Format: rtsp://host-ip:7447/camera-id

Depending on your host operating system, you should use different volume mounting strategies to persist UniFi Protect data.

Linux (Bind Mounts)

Use bind mounts to map local directories to the container. This is recommended for Linux users:

• ./storage/srv maps to /srv (Protect video)
• ./storage/data maps to /data
• ./storage/persistent maps to /persistent

macOS (Named Volumes)

Because bind mounts behave differently on macOS, use named volumes instead:

• storage-srv maps to /srv
• storage-data maps to /data
• storage-persistent maps to /persistent

# Linux Bind Mounts
volumes:
  - ./storage/srv:/srv
  - ./storage/data:/data
  - ./storage/persistent:/persistent

# macOS Named Volumes
# volumes:
#   storage-srv:/srv
#   storage-data:/data
#   storage-persistent:/persistent

The unifi-protect service supports the following environment variables for configuration:

• STORAGE_DISK: Specifies the device path for the UNVR storage disk. The default is /dev/sda.
• DEBUG: A boolean flag to enable or disable debug mode. Set to false by default.
• container: Set to docker to indicate the runtime environment.

environment:
  - container=docker
  - STORAGE_DISK=/dev/sda
  - DEBUG=false

You can inspect logs using standard Docker commands or by looking at specific files inside the container.

Docker Commands:

• docker compose logs -f
• Inside the container: journalctl -f

File Locations (Inside Container):

• General logs: /var/log
• unifi-protect logs: /srv/unifi-protect/logs
• unifi-core logs: /data/unifi-core/logs
• Storage debug logs: /var/log/storage_disk_debug.log (only if DEBUG_STORAGE=true is set).

Running ustorage rwfs check returns a JSON object indicating whether the Read-Write File System (RWFS) has been migrated and if it is currently migratable.

{
    "isMigrated": false,
    "migratable": {"canMigrate": false, "reason": "not-support"}
}