Skip to content

Put your server to work

Run apps on your hardware with backups, monitoring and your own domains.

Ask for runner access

Connect your server

Public runner downloads are not available yet; these commands require an existing runner installation.

  • Linux with Docker Engine and Compose
  • Outbound HTTPS to usesetup.app
  • Permission to add runners

  1. Runners → Add runner → copy token

    srt_Token shown once

  2. Start the runner

    shell
    setup-runner run --server https://usesetup.app --token srt_…

    Docker Hub pull limits--registry-mirror mirror.gcr.io

  3. Restart automatically with systemd

    /etc/systemd/system/setup-runner.service
    [Unit]
Description=Setup runner
Requires=docker.service
After=docker.service network-online.target

[Service]
ExecStart=/usr/local/bin/setup-runner run --server https://usesetup.app --token srt_…
Restart=always
RestartSec=5

[Install]
WantedBy=multi-user.target
    shell
    sudo systemctl daemon-reload && sudo systemctl enable --now setup-runner

  4. Check it appears online

Give apps an address

Apps such as Vaultwarden need HTTPS; custom domains are free on your own runners.

shell
setup-runner run --server https://usesetup.app --token srt_… \
  --public-host 203.0.113.7 \
  --domain apps.example.com --tls acme --acme-email ops@example.com
Without a domain
http://192.0.2.10:20004
Wildcard DNS to your server
*.apps.example.comhttps://wiki.apps.example.com
Public access: ports 80 and 443
80443
Certificates from Let’s Encrypt
--tls acme
Internal certificates: trust on each device
--tls internal
Custom domains: DNS checked first
wiki.example.com

Bring your existing apps

Enable imports, then review your selection in Runners → Bring apps from this server.

shell
setup-runner run --server https://usesetup.app --token srt_… --allow-import
  1. Stop the original app
  2. Copy data into new volumes
  3. Start and check the copy
  • Compose, Portainer, CasaOS, Umbrel, containers
  • Settings read for selected apps only
  • Checks fail: restart the original
  • Original kept, stopped; folders never deleted
  • Unavailable on Setup Cloud runners

Know your server’s limits

Apps have no Setup usage charges or plan quota; hardware, workspace rules and team plan controls still apply.

  • Runner connection: outbound HTTPS
  • Apps need their own reachable address
  • Job requests: up to 30 seconds
  • Runner token stored as hash
  • Default containers share the host kernel
  • gVisor or Kata: automatic when installed
  • Builds can reach your LAN
  • Separate VM or block private ranges
  • Revoked: exit on next request