From scratch: Debian, Docker and Node64

No Docker host yet? This guide takes you from an empty server or an empty Proxmox VM to your first sign-in to Node64 – step by step, with copy-ready commands. If Docker is already running, go straight to the installation.

The path in five steps

Decide where Node64 runs – your own machine, a Proxmox VM or an LXC.
Install and prepare Debian 13.
Install Docker from the official repository.
Start Node64 with docker compose.
Sign in in the browser and switch on the first modules.

Time needed: about 20 minutes. You need access via SSH or console and sudo rights.

Where does Node64 run? Machine, VM or LXC

Node64 needs little: 1–2 CPU cores, 1 GB of RAM and 8–16 GB of disk are enough for health checks, DNS64, PROXY64 and DynDNS. What matters is a fixed IP address in your home network – easiest as a DHCP reservation in the router.

Where	Rating	Notes
Own machine, mini PC	very good	Install Debian directly, then continue as below.
Proxmox VM	recommended	Docker runs as on real hardware, host network and port 53 without special rights, UDP buffers can be set inside the VM. Use Debian 13 as guest with `qemu-guest-agent`.
Proxmox LXC (unprivileged)	works	Docker inside the container needs the features `nesting` and `keyctl`. The UDP buffers (`net.core.*`) can't be set inside the LXC – you set them on the Proxmox host. Proxmox updates occasionally bring quirks with Docker.
Proxmox LXC (privileged)	not recommended	Works, but isolates much less from the host.
NAS (Synology, Unraid, QNAP …)	good	The vendor ships Docker or a container manager – continue with the installation. Unraid with `br0` gives the container its own LAN address.

For an LXC, switch on both features on the Proxmox host (101 is the ID of your container) and restart it:

bash (Proxmox host)

pct set 101 --features nesting=1,keyctl=1
pct reboot 101

Preparing Debian 13

Install Debian 13 ("trixie") as a minimal system – no desktop, with SSH server. Then, as a user with sudo:

bash

sudo apt update && sudo apt full-upgrade -y
sudo apt install -y ca-certificates curl
sudo timedatectl set-timezone Europe/Berlin

The correct time matters: certificates and sign-ins check it. Debian keeps it in sync via NTP by itself.

Installing Docker (official repository)

Take Docker from Docker's own repository, not the older docker.io package from Debian. That way you get current versions and docker compose right away:

bash

sudo install -m 0755 -d /etc/apt/keyrings
sudo curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
sudo chmod a+r /etc/apt/keyrings/docker.asc
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt update
sudo apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
sudo docker run --rm hello-world

If "Hello from Docker!" appears, everything works. The commands below use sudo. If you don't want that, add your user to the docker group (sudo usermod -aG docker $USER, then sign in again) – but that is equivalent to root rights.

UDP buffers for fast connections

The CDN64 tunnel and DNS over QUIC run over UDP. Linux has small default buffers for that, which slow down fast connections. Set larger values permanently (in a VM or on the machine itself; for an LXC on the Proxmox host):

bash

printf 'net.core.rmem_max = 7500000\nnet.core.wmem_max = 7500000\n' | sudo tee /etc/sysctl.d/90-node64.conf
sudo sysctl --system

Starting Node64

Create a folder and the file compose.yaml in it:

bash

sudo mkdir -p /opt/node64 && cd /opt/node64
sudo nano compose.yaml

To get started we recommend the host network: DNS64 then sees the real addresses of your devices, and PROXY64 can open ports without publishing each one.

compose.yaml

services:
  node:
    image: ghcr.io/ipv64net/node64:latest
    container_name: node64
    restart: unless-stopped
    network_mode: host        # web UI on port 8080
    volumes:
      - node64-data:/data     # database, keys, certificates
    environment:
      NODE64_LOG_LEVEL: info
    read_only: true
    tmpfs:
      - /tmp
    cap_add:
      - NET_RAW               # ping checks
volumes:
  node64-data:

bash

sudo docker compose up -d
sudo docker ps --filter name=node64

After a short while docker ps shows (healthy). Other variants:

Bridge network (Docker's default): you publish every port with ports: – templates under Installation with docker compose.
Macvlan or IPvlan (e.g. Unraid br0): the container gets its own LAN address and needs no published ports (Ports).
Monitoring Docker containers with Monitor64 or using Docker labels: Node64 additionally gets the Docker socket – see the variant with Docker socket.

First sign-in

Open http://<server-IP>:8080 in the browser.
The setup wizard asks for language, admin account (password at least 10 characters), time zone and the node's name and location.
Then you are signed in. Under Settings → Modules you switch on what you need – continue with the first steps.

Common pitfalls

Problem	Solution
DNS64 doesn't start, port 53 in use	On many systems `systemd-resolved` holds port 53 – see Port 53 is in use. A fresh Debian 13 without desktop is usually not affected.
Web UI not reachable from the network	A firewall on the server (`ufw`, `nftables`) or in Proxmox is blocking. Open `8080/tcp`, for DNS64 `53/udp` and `53/tcp`, for PROXY64 `80/tcp`, `443/tcp` and `443/udp`.
Docker in LXC: "operation not permitted"	The features `nesting` and `keyctl` are missing (see above); restart the LXC afterwards.
Checks over IPv6 fail	In the bridge network a container has no IPv6 by default – see IPv6 in the container. In the host network Node64 uses the server's IPv6.
Making it reachable from outside	With the CDN64 tunnel you need no port forwarding in the router. Otherwise forward 80 and 443 in the router to the server's fixed IP.
Slow tunnel on a fast connection	Set the UDP buffers (see above); the CDN64 self-test shows a hint when they are too small.
Disk runs full	Clean up old images: `sudo docker image prune`. Node64's data lives in the volume and stays.

Updates and backups are covered in Update & backup, more problems in the FAQ.

Something unclear, missing, or a question about Node64? Ask in the official forum v64.tech.