WND Terminal browser gateway: Docker deployment example
October 18, 2026

This example builds an image from the released Linux x64 gateway binary.
Use an x64 Linux server/VM with Docker Engine and the Compose plugin. The
server needs access to approved hosts; users need HTTPS access to this server.
Use the native Linux or Windows service for those deployment choices.

1. Download WND-Gateway-Linux-x64.tar.gz from your verified customer portal
   downloads page. Extract it. Put its wnd-gateway executable beside this
   Dockerfile and compose.yaml. The binary is licensed software; obtain your
   own trial or production license through WND.
2. Create config/ here. Copy gateway.example.toml from the gateway download
   into config/gateway.toml. Put your certificate and private key (PEM),
   policy.json, license and required identity-provider secret files there.
3. In gateway.toml set:
   [server]
   listen = "0.0.0.0:8443"
   public_url = "https://terminal.example.com"    # your actual DNS name
   tls_certificate = "/etc/wnd-gateway/terminal.crt"
   tls_key = "/etc/wnd-gateway/terminal.key"
   data_dir = "/var/lib/wnd-gateway"

   Use your own files and public URL. Set policy.file and license.file to the
   appropriate /etc/wnd-gateway paths. Configure your OpenID Connect provider
   or local users according to the supplied guide. Set allowed networks and
   policy connections to your approved host addresses. Keep secrets out of
   the Docker image; the config directory is mounted read-only at run time.
4. The process uses UID/GID 10001. Let that group read the config directory
   and files, including the private key, without making them world-readable.
   Keep ownership and write access with your administrators.
5. Build and check:
   docker compose build
   docker compose run --rm --no-deps gateway check-config
6. Start it:
   docker compose up -d
   docker compose logs -f gateway
7. Point your DNS name at the server and allow HTTPS on port 443 through the
   appropriate network controls. Open its HTTPS URL from Safari or Chrome
   on a phone/tablet and sign in. The same URL serves desktop browsers.

The container listens on 8443; Compose maps server port 443 to it. gateway-data
keeps audit logs, recordings and other gateway state. Keep and back up this
volume when updating the image. Size CPU, memory and disk for concurrent
sessions, file handling, retention and recording settings in your environment.

Full configuration: https://wndsoftware.com/docs/gateway-configuration
Browser setup: https://wndsoftware.com/browser#how
Mobile controls: https://wndsoftware.com/docs/mobile
