Public | Automated Build

Last pushed: 8 hours ago
Short Description
Easy to use SFTP server
Full Description

Supported tags and respective Dockerfile links

Securely share your files

Easy to use SFTP (SSH File Transfer Protocol) server with OpenSSH.
This is an automated build linked with the debian and alpine repositories.


  • Required: define users as command arguments, STDIN or mounted in /etc/sftp/users.conf
    (syntax: user:pass[:e][:uid[:gid[:dir1[,dir2]...]]]...).
    • Set UID/GID manually for your users if you want them to make changes to
      your mounted volumes with permissions matching your host filesystem.
    • Add directory names at the end, if you want to create them under the user's
      home directory. Perfect when you just want a fast way to upload something.
  • Optional (but recommended): mount volumes.
    • The users are chrooted to their home directory, so you can mount the
      volumes in separate directories inside the user's home directory
      (/home/user/mounted-directory) or just mount the whole /home directory.
      Just remember that the users can't create new files directly under their
      own home directory, so make sure there are at least one subdirectory if you
      want them to upload files.
    • For consistent server fingerprint, mount your own host keys (i.e. /etc/ssh/ssh_host_*)


Simplest docker run example

docker run -p 22:22 -d atmoz/sftp foo:pass:::upload

User "foo" with password "pass" can login with sftp and upload files to a folder called "upload". No mounted directories or custom UID/GID. Later you can inspect the files and use --volumes-from to mount them somewhere else (or see next example).

Sharing a directory from your computer

Let's mount a directory and set UID (we will also provide our own hostkeys):

docker run \
    -v /host/upload:/home/foo/upload \
    -v /host/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key \
    -v /host/ \
    -p 2222:22 -d atmoz/sftp \

Using Docker Compose:

    image: atmoz/sftp
        - /host/upload:/home/foo/upload
        - /host/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key
        - /host/
        - "2222:22"
    command: foo:pass:1001

Logging in

The OpenSSH server runs by default on port 22, and in this example, we are
forwarding the container's port 22 to the host's port 2222. To log in with the
OpenSSH client, run: sftp -P 2222 foo@<host-ip>

Store users in config

docker run \
    -v /host/users.conf:/etc/sftp/users.conf:ro \
    -v mySftpVolume:/home \
    -v /host/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key \
    -v /host/ \
    -p 2222:22 -d atmoz/sftp



Encrypted password

Add :e behind password to mark it as encrypted. Use single quotes if using terminal.

docker run \
    -v /host/share:/home/foo/share \
    -p 2222:22 -d atmoz/sftp \

Tip: you can use atmoz/makepasswd to generate encrypted passwords:
echo -n "your-password" | docker run -i --rm atmoz/makepasswd --crypt-md5 --clearfrom=-

Logging in with SSH keys

Mount public keys in the user's .ssh/keys/ directory. All keys are
automatically appended to .ssh/authorized_keys (you can't mount this file
directly, because OpenSSH requires limited file permissions). In this example,
we do not provide any password, so the user foo can only login with his SSH

docker run \
    -v /host/ \
    -v /host/ \
    -v /host/share:/home/foo/share \
    -p 2222:22 -d atmoz/sftp \

Providing your own SSH host key

This container will generate new SSH host keys at first run. To avoid that your
users get a MITM warning when you recreate your container (and the host keys
changes), you can mount your own host keys.

docker run \
    -v /host/ssh_host_ed25519_key:/etc/ssh/ssh_host_ed25519_key \
    -v /host/ssh_host_rsa_key:/etc/ssh/ssh_host_rsa_key \
    -v /host/share:/home/foo/share \
    -p 2222:22 -d atmoz/sftp \

Tip: you can generate your keys with these commands:

ssh-keygen -t ed25519 -f /host/ssh_host_ed25519_key < /dev/null
ssh-keygen -t rsa -b 4096 -f /etc/ssh/ssh_host_rsa_key < /dev/null

Execute custom scripts or applications

Put your programs in /etc/sftp.d/ and it will automatically run when the container starts.
See next section for an example.

Bindmount dirs from another location

If you are using --volumes-from or just want to make a custom directory
available in user's home directory, you can add a script to /etc/sftp.d/ that
bindmounts after container starts.

# File mounted as: /etc/sftp.d/
# Just an example (make your own)

function bindmount() {
    if [ -d "$1" ]; then
        mkdir -p "$2"
    mount --bind $3 "$1" "$2"

# Remember permissions, you may have to fix them:
# chown -R :users /data/common

bindmount /data/admin-tools /home/admin/tools
bindmount /data/common /home/dave/common
bindmount /data/common /home/peter/common
bindmount /data/docs /home/peter/docs --read-only

What's the difference between Debian and Alpine?

The biggest differences are in size and OpenSSH version.
Alpine is 10 times smaller than
Debian. OpenSSH version can also differ, as
it's two different teams maintaining the packages. Debian is generally
considered more stable and only bugfixes and security fixes are added after
each Debian release (about 2 years). Alpine has a faster release cycle (about 6
months) and therefore newer versions of OpenSSH. As I'm writing this, Debian
has version 6.7 while Alpine has version 7.4. Recommended reading:
Comparing Debian vs Alpine for container & Docker apps

Docker Pull Command
Source Repository

Comments (13)
18 days ago

Hi, I'm using this image in docker-compose in the following way:

version: "2"
image: atmoz/sftp

  - /home/ftp:/home
  - /var/log:/var/log
  - ./users.conf:/etc/sftp-users.conf:ro
  - "2200:22"

I started the docker-compose in my local environment and I connect to it using sftp -P 2200 {{user}}@

However, I deployed the same docker-compose on a production server, and I get the following response:

sftp -P 2200 {{user}}@
{{user}}@'s password:
Connection to closed by remote host.
Couldn't read packet: Connection reset by peer

any suggestions?

10 months ago


I had problems with the last step "Bindmount dirs from another location". mount constantly showed "permission denied" error message. "chown", as suggested, did not help. I had to run your container as "--privileged", then everything was mounted as expected.
It would be nice if you could update the description of the last step with this info.


10 months ago

Hi, not work Rancher Labs

a year ago

Great image, working as intented. Dont forger if using SSH from linux that your private key rights be 400 or it will be ignored.

2 years ago

Are your private key in the right place? Check if it is found by running sftp command with verbose option (-v). Like: sftp -v user@host

2 years ago

No, nothing.

2 years ago

Does docker logs <container-id> tell you anything?

2 years ago

Yes, I'm mounting it like this:

-v /mnt/data/sftp/keys/
and to make sure this mounting is correct I check .ssh/authorized_keys files and it contains proper entry. Logging in with password works fine.
I tried to look for auth.log in /var/log/ of the container but it was not there.
Thanks for help,

2 years ago

First of all: are you mounting your key in .ssh/keys/? I would then check if logging in with just password works, just to be sure.

2 years ago

I'm having issues setting up SSH key authentication (I'm getting permission denided message). The authentication key seems to be in place (I checked authorized_keys file inside container). Any ideas how to debug the problem?