Skip to content

README.md

Latest commit

 

History

History
35 lines (25 loc) · 1.78 KB

README.md

File metadata and controls

35 lines (25 loc) · 1.78 KB

docker-TinyFileManager

CI

The simplest way to run TinyFileManager in a Docker environment.

Status

This repo ships a hardened docker-compose.yml starting point and the security checklist below. TinyFileManager itself (tinyfilemanager.php) is not bundled — you provide a pinned copy (see Quick start).

⚠️ Security

TinyFileManager is a powerful single-file PHP file manager. Misconfigured, it exposes your filesystem. Before exposing it:

  • Change the default credentials immediately. Stock builds ship with admin / admin@123 and user / 12345 — anyone who finds the page can log in otherwise.
  • Pin a recent release. Older versions have known authentication-bypass / upload CVEs; always run an up-to-date tinyfilemanager.php.
  • Never expose it directly on the Internet. Put it behind a VPN or a reverse proxy with its own authentication (e.g. basic-auth / SSO), and serve it over HTTPS.
  • Scope the mounted directory. Only mount the folder it must manage — never / or your whole home directory.
  • Disable it if unused. It is an interactive shell-into-your-files; treat it accordingly.

Quick start

A hardened starting point is in docker-compose.yml (bound to 127.0.0.1, scoped volumes, restart: unless-stopped). Then:

  1. Download a pinned tinyfilemanager.php release into ./app/.
  2. Edit its config to set strong credentials (and a per-deployment $auth_users / salt).
  3. docker compose up -d, then reach it only through your authenticated proxy.