Kylth’s container has the Docker socket, and access to the Docker socket is equivalent to root on the server. With it, Kylth can start any container, mount any folder and read any file on the server. Install Kylth only on a server where you’re willing to grant that.
Kylth needs this access because its job is to create and run containers. Each Supabase project is a set of containers, and there’s no narrower Docker permission that allows creating containers without also allowing everything else. Portainer and similar tools need the same access for the same reason.
What the container is given
| Access | Why Kylth needs it |
|---|---|
The Docker socket, /var/run/docker.sock |
To create, start, stop and back up project containers |
| Runs as root | To manage the folders and containers above |
| The host’s network | So Caddy, also on the host’s network, can reach Kylth on 127.0.0.1:8383. Kylth isn’t reachable from outside except through Caddy. |
| The host’s hostname | So the dashboard shows the server’s real name |
NET_ADMIN and /etc/wireguard |
Only used when this server connects other hosts to Kylth over WireGuard. It’s granted on every install, but unused on a single server. |
| Folders mounted at identical paths | See below |
Folders mounted at identical paths
These folders are mounted at the same path inside the container as on the server:
/opt/kylth/opt/supabase-projects/opt/kylth-backups/etc/wireguard
This matters because Kylth hands these paths to Docker, which looks them up on the server. With a different path inside the container, nothing would fail: Docker would quietly use an empty folder, and backups would contain nothing.
Kylth checks this every time it starts. It writes a file into each folder, then reads it back through a short-lived container that Docker starts. If a folder doesn’t match, Kylth refuses to start and names the folder.
What Kylth connects to
Kylth only makes outbound connections for work you ask it to do:
| Connection | When |
|---|---|
| Docker image registries | To download and update Kylth’s, Caddy’s and Supabase’s images |
| Let’s Encrypt | Made by Caddy, to issue and renew certificates |
| Your S3-compatible storage | If you add it as a backup destination |
| Your SMTP server | If you set up email |
| GitHub | If you connect the GitHub integration |
Kylth sends no usage data, and never contacts Kylth to check its licence.
Secrets on the server
- Each project’s secrets are in its
.envfile under/opt/supabase-projects/<project>/, and inside every backup of that project. - The installer makes
/opt/kylthand/etc/kylthreadable by root only./opt/kylthholds the keys Kylth uses to encrypt the credentials it stores. - Protect backups and server snapshots as you’d protect the server itself.