FAQ

Do I need to know anything about I2P? No. You point i2pforge at your service and it hands you an address. The router and the I2P details are handled for you.

Is this the same as a Tor onion service? It is the same idea on a different network. Tor gives you a .onion address; i2pforge gives you a .b32.i2p address on I2P. The sibling project HiddenForge does the Tor version, and you can run both side by side.

How long until my address works? The address itself appears in under a minute, because it is computed from the key. Being reachable by visitors takes a little longer while the router announces itself to the network, usually a couple of minutes.

Can I choose a pretty address? You can brute-force a short prefix. A five character prefix takes minutes on a normal machine, six characters takes hours, seven takes days. Use the vanity option in the wizard, or ./scripts/i2pforge vanity --prefix sam. The rest of the address is still random.

Can I run more than one service? Yes. Use the full form, <NAME>_I2P_SERVICE_HOSTS, once per service, each with its own name. Each name gets its own address. The command-line setup supports this directly with --services.

What if I lose the key folder? The address is gone and cannot be recovered. There is no central registry and no reset. This is why backing up ./i2p-keys is the one thing you must not skip. See Backing up your key.

Does upgrading change my address? No. The key lives in the folder you mount, not in the image, so pulling a newer image and recreating the container keeps the same address. The repository ships a test that proves this.

Can someone take my address? Not without your key. The address is a fingerprint of a key only you hold. The only way someone impersonates you is if they steal eepsite.dat, which is why you protect that file and can encrypt it at rest.

Does it keep logs? The generated setup turns off host-side logging for the router, and the router itself writes nothing sensitive to disk. The only persistent file is your key.

Why does it need to run as root at all? Only for a moment at startup, to set ownership on the mounted key folder. It then drops to an unprivileged user with no capabilities before the router does any real work. You can confirm this with the doctor command.

Can I use Podman instead of Docker? Yes. Use the podman-compose.yml file. It differs only in how ownership of the data folder is handled, which the entrypoint takes care of.

Is the image safe to trust? You do not have to trust it. Every release is signed three ways and the build is reproducible, so you can rebuild from source and confirm you get the exact same image. See Verifying the image.

Where do I report a security problem? Privately, not in a public issue. See the security policy in the repository for how to reach the maintainer.