Skip to content

Networking & Deploy Modes

Every app you deploy in Eight.ly uses one of several networking modes. Three cover the vast majority of setups and are the ones to understand first. Advanced modes — host networking (for apps that need mDNS/broadcast discovery, like Home Assistant or Plex GDM), macvlan, and a custom Docker network — are also available in the deploy dialog for cases that need them.

The Three Deploy Modes

Standard

The default. The app binds directly to a port on your server.

Browser → http://192.168.1.100:8096 → Jellyfin container
  • No extra setup
  • Access at http://YOUR-SERVER-IP:PORT
  • Works immediately after deploy
  • No SSL, no domain needed

Use when: You access apps only from your local network and don't have a domain.

Traefik

A reverse proxy sits in front of your apps, routing by hostname and handling SSL automatically.

Browser → https://jellyfin.yourdomain.com → Traefik → Jellyfin container
  • Requires a domain name and Traefik setup
  • Automatic Let's Encrypt SSL certificates
  • Each app gets its own subdomain
  • Apps join the shared proxy Docker network instead of binding ports

Use when: You have a domain and want clean URLs with HTTPS.

Traefik + Authelia

Same as Traefik, but every request hits a login gate before reaching the app.

Browser → https://radarr.yourdomain.com → Traefik → Authelia (login) → Radarr container
  • Everything from Traefik mode, plus authentication
  • Users must log in before accessing the app
  • Optional two-factor authentication (TOTP, push, WebAuthn)
  • Authelia session is shared — log in once, access all protected apps

Use when: You're exposing apps to the internet and want to prevent unauthorized access.

Decision Guide

flowchart TD
    A[Deploying an app] --> B{Do you have a domain?}
    B -->|No| C[Standard mode]
    B -->|Yes| D{Will it face the internet?}
    D -->|No, LAN only| E{Do you want clean URLs?}
    E -->|Yes| F[Traefik mode]
    E -->|No| C
    D -->|Yes| G[Traefik + Authelia mode]
Situation Recommended mode
Home network only, no domain Standard
Home network, have a domain, want https://app.home.lab Traefik
Accessible from the internet Traefik + Authelia
Testing or temporary apps Standard

Start with Standard, add Traefik later

You can always redeploy an app in a different mode. Start with Standard to get things working, then switch to Traefik when you're ready for domains and SSL. No data is lost — container volumes persist across redeploys.

How Requests Flow

Standard Mode

sequenceDiagram
    participant Client
    participant Server as Server :PORT
    participant App as Container

    Client->>Server: http://192.168.1.100:8096
    Server->>App: Forward to bound port
    App-->>Client: Response

Traefik Mode

sequenceDiagram
    participant Client
    participant CF as Cloudflare DNS
    participant Traefik as Traefik :443
    participant App as Container

    Client->>CF: https://jellyfin.example.com
    CF->>Traefik: Route to server IP
    Traefik->>Traefik: Match Host header, terminate SSL
    Traefik->>App: Forward via proxy network
    App-->>Client: Response (encrypted)

Traefik + Authelia Mode

sequenceDiagram
    participant Client
    participant Traefik as Traefik :443
    participant Auth as Authelia
    participant App as Container

    Client->>Traefik: https://radarr.example.com
    Traefik->>Auth: ForwardAuth check
    Auth-->>Traefik: 401 Not authenticated
    Traefik-->>Client: Redirect to login page
    Client->>Auth: Username + password + 2FA
    Auth-->>Client: Session cookie
    Client->>Traefik: Retry with session cookie
    Traefik->>Auth: ForwardAuth check
    Auth-->>Traefik: 200 OK
    Traefik->>App: Forward request
    App-->>Client: Response

Docker Network Management

The Network page in the sidebar shows all Docker networks on your server.

  • bridge — the default Docker network. Standard mode apps use this.
  • proxy — the shared network for Traefik-mode apps. Created during Traefik setup.
  • Custom networks — create additional networks to isolate groups of containers (e.g., a media network for your *arr stack).

Creating a Network

  1. Go to Network in the sidebar
  2. Click Create Network
  3. Name it and choose a driver (bridge is almost always correct)
  4. Click Create

Port Conflict Detection

Eight.ly tracks which ports are in use across all containers and checks for conflicts before deploying.

The Port Manager button in the dashboard header shows:

  • All ports currently bound by containers
  • Which container owns each port
  • Available ports for new deployments

If you try to deploy an app on a port that's already taken, the deploy modal warns you and suggests an alternative.