SD-WebUI-Forge-Neo-Unraid ghcr.io/aegisnir/sd-webui-forge-neo-unraid:latest latest Stable: tested releases (recommended) dev Testing: every change as soon as it builds, may break https://ghcr.io https://raw.githubusercontent.com/aegisnir/unraid-templates/main/icon.png --runtime=nvidia --read-only --tmpfs /tmp:rw,noexec,nosuid,nodev,size=2g --security-opt no-new-privileges:true --cap-drop=ALL --cap-add=CHOWN --cap-add=FOWNER --cap-add=SETUID --cap-add=SETGID --pids-limit=2048 Forge Neo (Stable Diffusion WebUI) by Haoming02, packaged for Unraid by Aegisnir, with security hardening. Forge Neo is Haoming02's work: https://github.com/Haoming02/sd-webui-forge-classic/tree/neo This container only packages it for Unraid. Please report WebUI bugs upstream. Image: ghcr.io/aegisnir/sd-webui-forge-neo-unraid, tag latest (stable, recommended) or dev (testing, may break), chosen at install. README: https://github.com/aegisnir/sd-webui-forge-neo-unraid/blob/dev/README.md ## Extra Parameters (advanced view), flag by flag - --runtime=nvidia: gives the container your NVIDIA GPU. Don't remove it; GPU choice is the GPU (NVIDIA_VISIBLE_DEVICES) setting. - --read-only: the container's own files can't be changed; only /data, /config and /tmp are writable. - --tmpfs /tmp:rw,noexec,nosuid,nodev,size=2g: a 2 GB scratch area in RAM; nothing can be run from it; cleared on restart. - --security-opt no-new-privileges:true: processes can never gain more rights than they started with. - --cap-drop=ALL: removes root's special powers inside the container. - --cap-add=CHOWN, FOWNER: gives back only what startup needs to fix /data and /config ownership. - --cap-add=SETUID, SETGID: lets startup switch from root to the WebUI user (99:100). Removing them stops the container from starting. - --pids-limit=2048: at most 2048 processes, so a runaway extension can't freeze Unraid. Full explanation, with what happens if you remove each one: README, Security Hardening Defaults. DATA DIRECTORY WARNING: The path used with --data-dir grows very large very quickly because it can hold models, outputs, extensions, caches, and other working data. I recommend storing it outside of appdata when possible. You can still place it inside appdata if you want the convenience, but it may consume space very quickly and can fill the location you use for Docker-related storage. The default host path is set to /mnt/user/ai/data/ so the large working set lives outside appdata by default. Self-healing data directory: The container automatically corrects /data ownership on startup if it is owned by another user (for example, after deleting the host data path, or data copied from another container). Folders mapped in separately (the optional Models and Outputs directories) are never re-owned; the log warns if they aren't writable. In most cases no user action is needed. A log message will confirm when ownership was corrected. If the auto-fix fails (NFS root squash, unusual host permissions), the log will explain the manual fix. Authentication defaults: This container uses auth-file based login by default. On first launch, startup creates /config/auth/webui-auth.txt if missing, with a random password for admin. First login: the password is shown once in the container log, after the [READY] box. Change it after first login, and do not post that log publicly until you have. Forgot it? Delete the auth file and restart: a new password is generated. Use WEBUI_AUTH_FILE to override the auth-file path if needed. Recommended auth file path: /config/auth/webui-auth.txt Example syntax: - one per line: admin:strong-password - or comma-separated: admin:strong-password,viewer:another-password - lines starting with # are ignored as comments Model checkpoint note: Forge Neo never downloads a model on its own. Add a .safetensors file under /data/models/Stable-diffusion. Log safety: Sensitive auth flags (--gradio-auth, --gradio-auth-path, --api-auth) have their values replaced with <redacted> in startup log output. The one exception is the first-launch login box. Built-in healthcheck: The image includes a Docker HEALTHCHECK that probes port 7860. It uses generous timers (5 min start grace, 5 retries) to avoid false positives during model loading or heavy extension operations. Unhealthy status is informational only and does not auto-restart the container. Forge Neo (Stable Diffusion WebUI) by Haoming02, packaged for Unraid by Aegisnir, with security hardening. Requires an NVIDIA GPU. Image: ghcr.io/aegisnir/sd-webui-forge-neo-unraid, tag latest (stable, recommended) or dev (testing, may break), chosen at install. Extra Parameters (advanced view) hold --runtime=nvidia (the GPU) and the security options; each is explained in the Description and the README. Full setup and usage docs: https://github.com/aegisnir/sd-webui-forge-neo-unraid/blob/dev/README.md This template passes Forge Neo data storage through --data-dir. - Models, outputs, extensions, caches, and other working data are stored in the mapped data share instead of the container filesystem. - Python, PyTorch and all WebUI dependencies are built into the image, so startup needs no downloads (extensions may still install their own packages). - The data directory can grow very large very quickly, so I recommend storing it outside of appdata when possible. - Launch flags are options in this template (common ones visible, the rest under Show more settings). Anything else goes in Extra Launch Flags. - If startup fails with a Torch GPU check error, you can temporarily add --skip-torch-cuda-test to Extra Launch Flags for troubleshooting. - If an extension breaks torch, delete /data/python-user on the host and restart. It holds only packages installed by extensions. - WebUI login is enabled by default unless you explicitly set your own --gradio-auth or --gradio-auth-path in Extra Launch Flags. - Container logs annotate known harmless warnings inline and display a [READY] box when the WebUI is accepting connections. - A built-in Docker healthcheck monitors port 7860 with conservative timers to avoid false positives during heavy operations. AI: stable diffusion forge neo a1111 flux image generation An NVIDIA GPU and the Nvidia Driver plugin from Community Applications (the template uses --runtime=nvidia). AGPL-3.0 https://[IP]:[PORT:7860] bridge false https://github.com/Haoming02/sd-webui-forge-classic/tree/neo https://forums.unraid.net/topic/201112-support-aegisnir-sd-webui-forge-neo-unraid/ https://github.com/aegisnir/sd-webui-forge-neo-unraid/blob/dev/CHANGELOG.md https://raw.githubusercontent.com/aegisnir/unraid-templates/main/templates/sd-webui-forge-neo-unraid.xml