Docker Images
Klokk is available as a Docker image, the same in two registries:
| Registry | Image |
|---|---|
| Docker Hub | klokkme/klokk |
| GitHub Container Registry | ghcr.io/klokk-me/klokk |
| Tag | Description |
|---|---|
stable |
The current release. Recommended for self-hosting. |
latest |
Identical to stable. |
1.2.3 |
An exact release (X.Y.Z). Pin it for reproducible deployments and update deliberately — what changed is listed in the changelog. |
1.2 |
Follows the patch releases of one minor version (X.Y) without picking up new features. It stops moving once the next minor version is released. |
Security of the images
Section titled “Security of the images”The images contain nothing but the program, its files and the CA certificates — no operating system, no shell, no tools. Every file belongs to root and cannot be changed by Klokk, which runs as user 1001 and writes only to /app/data and /tmp. The health check is built into the image. Run the containers hardened, as in the examples: read_only: true, a /tmp tmpfs, cap_drop: [ALL] and no-new-privileges; pass secrets as files where possible (<NAME>_FILE).
Noticing new versions
Section titled “Noticing new versions”During the daily licence check Klokk learns the newest published version; the value is signed and only taken over when the signature holds. When it is newer than the installed one, the version in the page footer shows an “Update” badge to administrators.
The badge leads to “What’s new”: above the installed version it lists the changes of the new one — with explanations and links to the documentation, action items first. Klokk loads these release notes only when the page is opened, from https://klokk.me/api/releases, without any details about the installation, and keeps them for an hour. When klokk.me cannot be reached, the page links to klokk.me/changelog instead.