For AI agents: a documentation index is available at /llms.txt. Markdown versions of pages are available by appending .md to any documentation URL.
Skip to main content
Version: stable (26.10.2)

Run Web3Signer from Docker image

Web3Signer publishes two Docker images. Both include Eclipse Temurin JRE 25 and the same Web3Signer application. Images before 26.10.2 trust the compromised eMudhra certificate authority roots. Use 26.10.2 or later. See the October 2026 eMudhra CA compromise.

  • Ubuntu image (consensys/web3signer:<version>). Includes a shell and runs as the web3signer user.
  • Distroless image (consensys/web3signer:<version>-distroless). Based on Google Distroless. Has no shell and no package manager, and runs as UID 65532.

Replace <version> with latest or a release tag.

Prerequisites​

Important

The Docker image does not run on Windows.

Run Docker image​

Display the Web3Signer command line help:

docker run consensys/web3signer:<version> --help

Expose listening port​

To use the default listening port (9000) or the port specified using --http-listen-port, you must expose the listening port.

docker run -p <listenPort>:9000 consensys/web3signer:<version> [options] [subcommand] [options]

Use the distroless image​

The distroless image does not require --read-only. For optional read-only root filesystem hardening, passing JVM options, and key manager imports that skip disk writes, see Run the distroless Docker image.