# Netrinos for Docker v1.3.4 Release Notes

**Release Date**: 2026-10-29\
**Build**: b261029.1725\
**Image**: `netrinosnet/netrinos` on Docker Hub, amd64 and arm64

## Overview

Netrinos for Docker is a new edition of the Netrinos client: one image
that joins a NAS, a home server or any other Linux machine with Docker
to your Netrinos network. It is built for NAS units that cannot take a
native install. Your laptops, desktops and phones reach the host by
name, its shares, web pages and apps included, with no open ports and
no port forwarding. Installation instructions are in "Installing
Netrinos for Docker."

## Getting started

- **Log in from the container's console** with `netrinos login`. The
  password is used once and not stored; the login survives restarts
  and updates.
- **Or join with an invitation,** with no command to type. In the
  portal, the account owner chooses **Devices**, **Invite a Device**,
  optionally names the device, and copies a one-time code that expires
  after an hour. Set it in the container as `NETRINOS_INVITE`, and the
  host joins on its first start. No password goes into the container's
  settings.
- **Any way you create containers.** A compose file, a `docker run`
  command or a container app's form. "Installing Netrinos for Docker"
  lists the settings, with examples for QNAP Container Station,
  Synology Container Manager, Portainer, TrueNAS SCALE and Unraid.
- **Clear setup errors.** A container created without host networking,
  the `NET_ADMIN` capability or the `/dev/net/tun` device says what is
  missing in its log, in `netrinos status` and in `netrinos doctor`.

## What the host can do

- **Reachable by name** from every device in your account, including
  file shares, the admin page, and media and sync apps.
- **Reaches your network.** The host reaches your other devices and the
  Virtual Devices behind them, for backups to another site or a second
  NAS.
- **Gateway for its local network.** With `netrinos gateway yes`, your
  other devices add a route through the host and reach its whole local
  network.
- **Virtual Devices.** On plans that include them, the host gives
  devices on its local network, such as cameras and printers, a name
  and address on your Netrinos network. Manage them with
  `netrinos vdev` in the container's console.
- **Access control** set in the portal is enforced on the host,
  including on NAS kernels without nftables, such as QNAP's.
- **Kernel WireGuard** is used automatically when the host's kernel
  provides it, with no extra container privileges. Otherwise the
  built-in userspace WireGuard takes over.

## Operation

- **Updates come with the image.** `netrinos status` shows when a new
  version is available. Pull the image and recreate the container; the
  login and settings stay in the `./netrinos` folder.
- **`netrinos restart`** restarts the client, and Docker brings it
  back.
- **A stopped container leaves nothing behind.** Netrinos removes its
  network interface and firewall rules from the host when it stops.
- **`netrinos doctor`** checks the container's setup, WireGuard, the
  firewall and the connection to the relay.

## Limitations

- **On NAS kernels without nftables, such as QNAP's, the host cannot
  send its own traffic through another gateway.** It cannot add a route
  to another site's local network or send its Internet traffic through
  a gateway. Everything else in these notes works on those hosts,
  including the host as a gateway for your other devices. Hosts with
  nftables have no such limit.
- **The host is not listed under Network in File Explorer or in
  Finder's sidebar.** Those lists find devices by broadcasts on the
  local network, and broadcasts do not travel over Netrinos. Open the
  share by name instead: `\\nas.<your account domain>` in File Explorer,
  or `smb://nas.<your account domain>` in Finder's **Go > Connect to
  Server**. Map it as a drive or add it to Favorites to keep it.
- **No web interface.** Use the container's console for status and
  Virtual Devices.
- **Linux hosts only.** Docker Desktop on Windows and macOS runs
  containers in a virtual machine that cannot reach the host's
  network.

## Compatibility

- Works with every supported Netrinos client and Edge.
- Invitations need the current Netrinos portal. Password login works
  with every account.
- Image tags are `latest` for the current release, `1.3.4`, `beta`
  and `daily`.

## Getting it

```bash
docker pull netrinosnet/netrinos:latest
```

Then create the container as described in "Installing Netrinos for
Docker."