ShellCN

One self-hosted gateway for everything you log into.

---

ShellCN is a single Go binary that gives you one secure, audited place to reach all your servers, containers, databases, and desktops. Run it, open a browser, and you're in.

It ships with 20 built-in protocols. Add more via plugins or Marketplace:

• Shells: SSH
• File transfer: SFTP, FTP/FTPS, SMB, WebDAV, S3
• Containers & clusters: Docker, Swarm, Podman, Kubernetes, Proxmox
• Remote desktops: VNC, RDP
• Databases: PostgreSQL, MySQL, MongoDB, Redis
• Observability: server monitoring
• Directory: LDAP

Quick start

Each needs a master key (it encrypts stored credentials) and a first admin login, then open http://localhost:8081 and sign in. Reuse the same master key on restart, or stored credentials can't be decrypted.

Docker, one command

Data and session recordings live in /data, so mount a volume there.

docker run -d --name shellcn -p 8081:8081 \
  -v shellcn-data:/data \
  -e SHELLCN_MASTER_KEY="$(openssl rand -base64 32)" \
  -e SHELLCN_BOOTSTRAP_ADMIN_USERNAME=admin \
  -e SHELLCN_BOOTSTRAP_ADMIN_PASSWORD=change-me \
  ghcr.io/charlesng35/shellcn:latest

Docker Compose

Save this as docker-compose.yml:

services:
  shellcn:
    image: ghcr.io/charlesng35/shellcn:latest
    ports:
      - "8081:8081"
    environment:
      SHELLCN_MASTER_KEY: ${SHELLCN_MASTER_KEY}
      SHELLCN_BOOTSTRAP_ADMIN_USERNAME: admin
      SHELLCN_BOOTSTRAP_ADMIN_PASSWORD: change-me
    volumes:
      - shellcn-data:/data
    restart: unless-stopped

volumes:
  shellcn-data:

Generate a key once with openssl rand -base64 32, put it in a .env file beside the compose file as SHELLCN_MASTER_KEY=..., then run docker compose up -d.

The /data volume also persists private plugins placed in /data/plugins.d.

Single binary

Grab the build for your platform from the releases page, then run it with the same three settings:

export SHELLCN_MASTER_KEY="$(openssl rand -base64 32)"
export SHELLCN_BOOTSTRAP_ADMIN_USERNAME=admin
export SHELLCN_BOOTSTRAP_ADMIN_PASSWORD=change-me
./shellcn

It serves on :8081 and keeps its data in the working directory.

For the full configuration surface, see config.example.yaml or .env.sample.

Early days. ShellCN is in active development, so expect a few rough edges. Take it for a spin and tell us what breaks. Issues, feedback, and contributions are very welcome.

Extending it

ShellCN keeps the built-in protocol set small. Extra protocols are external plugins:

• Install ShellCN-maintained plugins from the Marketplace.
• Build your own with the plugin starter.
• To publish a plugin, release its binary and submit a manifest to shellcn-plugin-registry.
• For private plugins, skip the registry and drop the binary in the gateway plugin directory.

The default plugin directory is /data/plugins.d in Docker and ./plugins.d when running the single binary. You can override it with plugins.dir or SHELLCN_PLUGINS_DIR.

Build from source

Requires Go 1.26+ and Node 24+.

make build    # single binary at bin/shellcn
make dev      # live-reloading dev server

Screenshots

Features

• One audited cockpit for shells, files, containers, clusters, databases, and desktops.
• AI assistant for supported operations workflows.
• Session recording for terminal and desktop sessions.
• Plugin extension model for private protocols and Marketplace-installed plugins.
• Agent transport for targets that cannot be reached directly from the gateway.
• Role-based access control with per-route permissions, risk levels, and audit events.

Upcoming

• OAuth2 / OIDC login
• SAML login
• LDAP authentication

Related repositories

ShellCN is developed across a small family of repos we maintain:

Repository	What it is
shellcn	The gateway: core, SDK, and the built-in protocol set.
shellcn-plugin-registry	The plugin registry that powers the in-app Marketplace.
shellcn-contrib	ShellCN-maintained external plugins, installable from the Marketplace.
shellcn-plugin-starter	Template + docs for writing your own plugin.

License

GPL-3.0