ziklag/chainos-edge repository overview

⁠Ziklag ChainOS — Edge

The Edge is the component of Ziklag ChainOS⁠ that runs inside your network. It derives addresses, holds key material and signs transactions. Everything else — indexing ten chains, tracking confirmations, scheduling sweeps, fanning out webhooks — happens in ChainOS Cloud, which orchestrates all of it without ever being able to move your funds.

The BIP-39 mnemonic exists only here. Cloud holds extended public keys and this Edge's identity public key, and nothing else. No private key, seed or mnemonic for any customer is ever held by Ziklag. A compromised Cloud cannot move your money; it can only ask this container to sign, and this container re-derives and verifies every destination before it does.

Chains: Bitcoin · Ethereum · BNB Smart Chain · Polygon · Avalanche · Base · Tron · Solana · XRP Ledger · Stellar.

Using this image requires a ChainOS account and an API key. Start here⁠.

⁠Quick start

Generate a mnemonic offline. Ziklag never receives it and cannot recover it:

docker run --rm ziklag/chainos-edge:1.0 mnemonic

Write it to a file readable only by the container:

mkdir -p secrets && chmod 700 secrets
printf '%s' "your twenty four words here" > secrets/mnemonic.txt
chmod 400 secrets/mnemonic.txt

Then run it:

services:
  chainos-edge:
    image: ziklag/chainos-edge:1.0
    ports: ["127.0.0.1:8787:8787"]
    environment:
      PASS_PHRASE_FILE: /run/secrets/chainos_mnemonic
      API_KEY: ${CHAINOS_API_KEY}
      CHAINOS_CLOUD_URL: https://api.chainos.cloud
      EDGE_STREAM_ENDPOINT: ${CHAINOS_STREAM_ENDPOINT}
    secrets: [chainos_mnemonic]
    volumes: [edge_data:/var/lib/chainos]
    restart: unless-stopped

secrets:
  chainos_mnemonic:
    file: ./secrets/mnemonic.txt

volumes:
  edge_data:

Use PASS_PHRASE_FILE, never PASS_PHRASE. An environment variable leaks through docker inspect, /proc/<pid>/environ, process listings, crash dumps and most orchestrator UIs. A file mounted at 0400 does not.

The console generates this file with your API key and stream endpoint already filled in, under Settings → Edge. Start from that rather than from the snippet above.

⁠Tags

Versions are MAJOR.MINOR.PATCH, and every tag on this repository is the same image that Ziklag's CI built and tested — it is copied here by digest, not rebuilt.

⁠Configuration

The full set, including spend caps, address-pool sizing and outbox durability modes, is in the configuration reference⁠.

⁠Commands

docker run --rm ziklag/chainos-edge:1.0 <command>

Every command that touches key material is a CLI verb on purpose. There is no HTTP route that reaches a seed — not for the console, not for support, not for automation — because a route that could be attacked is better not to exist.

⁠What is in the image

A scratch image containing one static binary and a CA bundle. No shell, no package manager, no interpreter: if the container is compromised there is nothing to pivot with, and the only thing worth stealing is supplied at runtime and never written to disk.

• Runs as 65534:65534 (nobody). Needs no privileges and no capabilities.
• Exposes 8787 — your application's API, not a public one. Bind it to localhost or a private network.
• No inbound connection from the internet is ever required. The Edge dials Cloud outbound, so it needs no ingress, no public DNS record and no open firewall port.
• linux/amd64.
• Persist /var/lib/chainos. It holds the delivery outbox; losing it loses undelivered webhooks, not keys.

⁠Support

• Documentation — docs.chainos.cloud⁠
• Console — app.chainos.cloud⁠
• Troubleshooting — docs.chainos.cloud/edge/troubleshooting⁠
• Security — [email protected]⁠. Please report privately.
• Sales — [email protected]⁠

Proprietary software. © Ziklag Software Services. Use is governed by your ChainOS agreement.