Connector requirements

CPU and memory

Choose a starting allocation for the Connector container. These allocations were tested on Linux AMD64 and ARM64 with the same controlled workload. [14]

These are planning allocations, not production capacity guarantees. The tests exercise the Connector runtime with small responses, loopback networking, and scripted admission; they do not measure the complete deployed service or live enrollment. Load-test your deployment before production. Payload size, concurrent connections, and sustained request rate affect resource use. Temporary files share the RAM budget. Reserve separate capacity for Linux, Docker, your app, and other containers. [7]

Host and container requirements

OS & CPU

Docker with 64-bit Linux containers. The released image includes linux/amd64 (x86-64) and linux/arm64. Docker selects the matching platform from the multi-platform image digest. [8] Measured v2.5.3 image manifest.

Container image

ghcr.io/layervai/qurl, published in GitHub Container Registry. This public image contains the Connector runtime. Configure the container to run the service with daemon run; the image alone does not start or enroll a Connector. No source build is required. Pin an approved release digest in your deployment manifest. [9] [1]

Host software

A Linux Docker host and permission to create containers and persistent storage. The image contains no shell or package manager. Use host tools for diagnostics. [1][2]

Runtime user

UID/GID 65532:65532. Use a read-only root filesystem, --cap-drop=ALL, and --security-opt=no-new-privileges:true. A privileged container is not required. [1][2]

GPU

None required. [14]

Process & file limits

Start with --pids-limit=512 and --ulimit nofile=4096:4096. These are tested allocations; increase them if your measured workload needs more. [2] [14]

Keep it running

Use --restart=unless-stopped or your orchestrator’s restart policy. If you use --network container:APP_CONTAINER, recreate the Connector with the new app container’s network namespace when you replace the app container. [2]

Get the Connector container

Use your container registry workflow and deployment pipeline. The published release includes qurl-image.txt with the immutable image reference. Review the release, then pin that reference in Docker, Compose, or your orchestrator.[9]

This example pulls release v2.5.4. It downloads the image without starting a service.

docker pull ghcr.io/layervai/qurl@sha256:1e4ed51568f40794d553c52b44dedb58fe1f30e60c123bcf0a58fbe73926e785

Before you deploy

1. Obtain the version 2 share configuration for your account and protected resource. It must contain exactly one share. Mount it read-only; its identifiers must match the resource registered with LayerV. [15]
2. Provide a one-time enrollment-token file for first startup. Mount it read-only and make it readable only by UID 65532 or its dedicated group. Do not put the token in image layers, command arguments, or source control. [5]
3. Mount a separate persistent state directory for each Connector instance. Use these container arguments and mount the configuration and token files at the specified paths. With plain Docker, use bind mounts for those files. [5]
   Container arguments

   Copy

   daemon run --state-dir /var/lib/qurl --headless-config /etc/qurl/share.yaml --enrollment-token-file /run/secrets/qurl/enrollment-token

4. Confirm outbound access and the local app connection. After enrollment, verify access to the protected app with an authorized qURL link. A running container alone does not confirm that the route serves traffic.

Need the account configuration or enrollment token for an enterprise deployment? Contact LayerV before starting the container.

Storage requirements

Create the Docker state directory with owner 65532:65532 and mode 0700. Store it on persistent storage and treat it as secret material. Give each independent deployment its own state directory. [2]

Network requirements

The Connector opens a reverse tunnel to LayerV and forwards approved requests to your app. Do not publish the app port just to make the Connector work. An app port you already expose still needs to be closed separately. [2][6]

Bandwidth must cover the application traffic carried through the Connector. There is no fixed Mbps requirement independent of payload size and request rate. Include any additional endpoints required by your account setup or optional cloud key provider.

Sources

Review the Connector container release assets on the container releases page. Deploy the exact image digest approved for your deployment pipeline. The specification sources record the versions behind each measurement.