# Enterprise qURL Connector Docker Requirements > Deploy the enterprise qURL Connector in Docker. Plan CPU, RAM, persistent storage, outbound networking, enrollment, and container updates. Source: https://layerv.ai/docs/connector-requirements/ --- [About qURL](https://layerv.ai/qurl/) qURL™ Connector / Enterprise deployment # Connector requirements CPU, memory, storage, and network requirements for the enterprise qURL Connector, typically deployed in Docker beside your app. **Sharing an app from your own machine?** [Start with the qURL CLI](https://layerv.ai/cli/). Continue here for enterprise-managed container deployments. **Start with 1 vCPU and 256 MiB RAM for the Connector.** Runs on Linux AMD64 and ARM64\. Add your app’s resources separately. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") [See resource requirements](https://layerv.ai/docs/connector-requirements/#resources) [Get the container image](https://layerv.ai/docs/connector-requirements/#get-connector) Your Docker host **App container** **Connector container** Shared network namespace. Separate resource budgets. Outbound connection Admitted tunnel **LayerV** Approved traffic returns through the tunnel For an app in Docker, use `--network container:APP_CONTAINER` to share its network namespace. The Connector can then reach the app on localhost without a published host port. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [CPU & RAM](https://layerv.ai/docs/connector-requirements/#resources) [Host & container](https://layerv.ai/docs/connector-requirements/#platform) [Storage](https://layerv.ai/docs/connector-requirements/#storage) [Network](https://layerv.ai/docs/connector-requirements/#network) [Sources](https://layerv.ai/docs/connector-requirements/#specification-sources) ## CPU and memory Choose a starting allocation for the Connector container. These allocations were tested on Linux AMD64 and ARM64 with the same controlled workload. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") Light workloads ### 0.25 vCPU 128 MiB RAM A compact allocation for small HTTP responses. Recommended starting point ### 1 vCPU 256 MiB RAM Start here for more CPU and memory headroom. Additional capacity ### 2 vCPU 512 MiB RAM A larger budget as your deployment grows. These are planning allocations, not production capacity guarantees. The tests exercise the Connector runtime with small responses, loopback networking, and scripted admission; they do not measure the complete deployed service or live enrollment. Load-test your deployment before production. Payload size, concurrent connections, and sustained request rate affect resource use. Temporary files share the RAM budget. Reserve separate capacity for Linux, Docker, your app, and other containers. [\[7\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/proof%5Froutes%5Ftest.go "[7] Source: Runtime workload test") ## Host and container requirements OS & CPU Docker with 64-bit Linux containers. The released image includes `linux/amd64` (x86-64) and `linux/arm64`. Docker selects the matching platform from the multi-platform image digest. [\[8\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/.github/workflows/cli.yml "[8] Source: Two-platform image checks") [Measured v2.5.3 image manifest.](https://layerv.ai/docs/connector-evidence/image-verification.json) Container image `ghcr.io/layervai/qurl`, published in GitHub Container Registry. This public image contains the Connector runtime. Configure the container to run the service with `daemon run`; the image alone does not start or enroll a Connector. No source build is required. Pin an approved release digest in your deployment manifest. [\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v2.5.4/qurl-image.txt "[9] Source: Published container image digest (text download)") [\[1\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/Dockerfile "[1] Source: Released container definition") Host software A Linux Docker host and permission to create containers and persistent storage. The image contains no shell or package manager. Use host tools for diagnostics. [\[1\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/Dockerfile "[1] Source: Released container definition") [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") Runtime user UID/GID `65532:65532`. Use a read-only root filesystem, `--cap-drop=ALL`, and `--security-opt=no-new-privileges:true`. A privileged container is not required. [\[1\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/Dockerfile "[1] Source: Released container definition") [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") GPU None required. [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") Process & file limits Start with `--pids-limit=512` and `--ulimit nofile=4096:4096`. These are tested allocations; increase them if your measured workload needs more. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[14\]](https://layerv.ai/docs/connector-evidence/README.md "[14] Source: CPU and RAM sizing basis (Markdown download)") Keep it running Use `--restart=unless-stopped` or your orchestrator’s restart policy. If you use `--network container:APP_CONTAINER`, recreate the Connector with the new app container’s network namespace when you replace the app container. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") ### Get the Connector container Use your container registry workflow and deployment pipeline. The published release includes `qurl-image.txt` with the immutable image reference. Review the release, then pin that reference in Docker, Compose, or your orchestrator.[\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v2.5.4/qurl-image.txt "[9] Source: Published container image digest (text download)") This example pulls release v2.5.4. It downloads the image without starting a service. Docker pull ``` docker pull ghcr.io/layervai/qurl@sha256:1e4ed51568f40794d553c52b44dedb58fe1f30e60c123bcf0a58fbe73926e785 ``` ### Before you deploy 1. Obtain the version 2 share configuration for your account and protected resource. It must contain exactly one share. Mount it read-only; its identifiers must match the resource registered with LayerV. [\[15\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/state/headless.go "[15] Source: Container configuration schema") 2. Provide a one-time enrollment-token file for first startup. Mount it read-only and make it readable only by UID 65532 or its dedicated group. Do not put the token in image layers, command arguments, or source control. [\[5\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") 3. Mount a separate persistent state directory for each Connector instance. Use these container arguments and mount the configuration and token files at the specified paths. With plain Docker, use bind mounts for those files. [\[5\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") Container arguments ``` daemon run --state-dir /var/lib/qurl --headless-config /etc/qurl/share.yaml --enrollment-token-file /run/secrets/qurl/enrollment-token ``` 4. Confirm outbound access and the local app connection. After enrollment, verify access to the protected app with an authorized qURL link. A running container alone does not confirm that the route serves traffic. Need the account configuration or enrollment token for an enterprise deployment? [Contact LayerV](https://layerv.ai/contact/) before starting the container. ## Storage requirements __Connector storage budget__ | Storage | Allocate | Why | | ---------------- | -------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Image cache | 128 MiB | Planning allowance for the measured v2.5.3 image plus a second copy during an update. Check the image size again when selecting a newer release. Measured Docker image storage: arm64 39.4 MiB ; amd64 43.8 MiB. This excludes Docker’s own data and your app image. [Image details.](https://layerv.ai/docs/connector-evidence/image-verification.json) | | Persistent state | 1 GiB per deployment | Suggested starting allowance, not measured state consumption. Mount persistent state at /var/lib/qurl and pass that path as \--state-dir. Monitor disk use. Keep it across restarts and upgrades. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[3\]](https://docs.docker.com/engine/storage/bind-mounts/ "[3] Source: Persistent container storage") | | Temporary files | 64 MiB maximum | Mount /tmp as memory-backed storage with size=64m. This is a ceiling, not a permanent 64 MiB allocation, and it shares the container RAM budget. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[11\]](https://docs.docker.com/engine/storage/tmpfs/ "[11] Source: Docker memory-backed temporary storage") | | Container logs | 3 files × 10 MB | Use Docker’s JSON logging driver with max-size=10m and max-file=3 for a bounded local starting policy. This is separate from persistent state; use your log platform for longer retention. [\[10\]](https://docs.docker.com/engine/logging/drivers/json-file/ "[10] Source: Docker log rotation") | Create the Docker state directory with owner `65532:65532` and mode `0700`. Store it on persistent storage and treat it as secret material. Give each independent deployment its own state directory. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") **Keep state. Remove the one-time enrollment secret after a verified warm start.** First startup uses the supplied enrollment-token file. Follow the documented transition: remove the token argument, verify a warm start with saved state, then remove the secret mount and delete the secret. [\[5\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go "[5] Source: Container enrollment and warm-start implementation") ## Network requirements The Connector opens a reverse tunnel to LayerV and forwards approved requests to your app. Do not publish the app port just to make the Connector work. An app port you already expose still needs to be closed separately. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") __Network checklist__ | Connection | Destination | Requirement | | ------------------------ | ---------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DNS | Your configured resolver | Resolve the API, Hub, and assigned tunnel endpoints. [\[4\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/hub/hub.go "[4] Source: Hub and UDP port requirements") [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") | | Outbound HTTPS (TCP 443) | api.layerv.ai | Allow account and sharing-state requests to the configured qURL API endpoint. Use the endpoint for your deployment environment. [\[16\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go#L53 "[16] Source: Container account and sharing-state requests") | | Outbound UDP 443 | hub.nhp.layerv.ai and assigned NHP cells | Direct UDP for admission and registration. An HTTP-only proxy is not sufficient. Use the endpoint and trust settings for your deployment environment. [\[4\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/hub/hub.go "[4] Source: Hub and UDP port requirements") | | Outbound TCP tunnel | Assigned server host and port | Allow direct TCP to the endpoint returned by authenticated admission. Do not assume its port is 443 or hard-code an address copied from another deployment. UDP and TCP must use the same source-IP egress path. [\[6\]](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go "[6] Source: Assigned tunnel and local app connection") [\[12\]](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/daemon/runtime.go "[12] Source: Direct tunnel egress") [\[13\]](https://github.com/layervai/frp/blob/9a0e4ee61964/pkg/config/v1/client.go#L148 "[13] Source: Pinned tunnel TCP default") | | Local HTTP | Your app’s localhost port | With \--network container:APP\_CONTAINER, the app and Connector share a network namespace. The configured HTTP port must accept connections there. [\[2\]](https://docs.docker.com/reference/cli/docker/container/run/ "[2] Source: Docker runtime, networking, and resource options") | | Image downloads | Container registry | The Docker host must be able to pull the pinned image. This is host access for installation and updates, separate from the running Connector’s tunnel. [\[9\]](https://github.com/layervai/qurl-integrations/releases/download/v2.5.4/qurl-image.txt "[9] Source: Published container image digest (text download)") | Bandwidth must cover the application traffic carried through the Connector. There is no fixed Mbps requirement independent of payload size and request rate. Include any additional endpoints required by your account setup or optional cloud key provider. ## Sources Review the Connector container release assets on the [container releases page](https://github.com/layervai/qurl-integrations/releases/latest). Deploy the exact image digest approved for your deployment pipeline. The specification sources record the versions behind each measurement. Specification sources [CPU and RAM sizing basis (Markdown download)](https://layerv.ai/docs/connector-evidence/README.md) · [Container image manifest](https://layerv.ai/docs/connector-evidence/image-verification.json) 1. [Released container definition](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/Dockerfile) 2. [Docker runtime, networking, and resource options](https://docs.docker.com/reference/cli/docker/container/run/) 3. [Persistent container storage](https://docs.docker.com/engine/storage/bind-mounts/) 4. [Hub and UDP port requirements](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/hub/hub.go) 5. [Container enrollment and warm-start implementation](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go) 6. [Assigned tunnel and local app connection](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/frp.go) 7. [Runtime workload test](https://github.com/layervai/qurl-connector/blob/1ea78386bfc63118e91269f7d501d64b35b7e0e2/pkg/share/proof%5Froutes%5Ftest.go) 8. [Two-platform image checks](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/.github/workflows/cli.yml) 9. [Published container image digest (text download)](https://github.com/layervai/qurl-integrations/releases/download/v2.5.4/qurl-image.txt) 10. [Docker log rotation](https://docs.docker.com/engine/logging/drivers/json-file/) 11. [Docker memory-backed temporary storage](https://docs.docker.com/engine/storage/tmpfs/) 12. [Direct tunnel egress](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/daemon/runtime.go) 13. [Pinned tunnel TCP default](https://github.com/layervai/frp/blob/9a0e4ee61964/pkg/config/v1/client.go#L148) 14. [CPU and RAM sizing basis (Markdown download)](https://layerv.ai/docs/connector-evidence/README.md) 15. [Container configuration schema](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/internal/connector/state/headless.go) 16. [Container account and sharing-state requests](https://github.com/layervai/qurl-integrations/blob/34644e5ada5bcc8cf1bbb06953a755b19f6a0f2f/apps/cli/cmd/daemon.go#L53) [Discuss your deployment](https://layerv.ai/contact/) --- *This markdown version is auto-generated from [https://layerv.ai/docs/connector-requirements/](https://layerv.ai/docs/connector-requirements/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*