SELF-HOSTING
Your circle. Your hardware. Free forever.
Run the BanditKin relay yourself, on a machine you control. Your circle keeps end-to-end encrypted location sharing and messaging, plus signed public map and routing data — and no BanditKin cloud subscription, ever.
You provide the hardware, electricity, Internet connection, storage, and any domain, VPN, or reverse proxy you choose. BanditKin provides the software.
WHAT CHANGES, WHAT DOESN'T
The relay you run still can't read your circle
Self-hosting doesn't change how BanditKin protects you. It changes who owns the box.
Your phone encrypts circle information end to end before it leaves the device. The self-hosted relay stores and forwards opaque encrypted records. It does not receive your circle encryption key or readable location history.
The key never leaves your devices
Your circle key is created on your device and shared in person by QR scan. No relay — ours or yours — ever receives it.
Ciphertext in, ciphertext out
The relay's job is to hold and pass along opaque encrypted records, so members who were offline still get them later.
The metadata stays home too
Self-hosting keeps connection metadata on hardware you control rather than on a BanditKin server. See exactly what a relay can and can't see.
BEFORE YOU START
What you bring, what we ship
Self-hosting is free, but it isn't free of work. Here's the honest split.
You provide
The hardware, the electricity, the Internet connection and the storage. Docker. And an HTTPS address — plus any domain, VPN, or reverse proxy you choose in order to get one. You run the box, and you keep the backups.
BanditKin provides
The relay server, the installer, the updater and the self-host web interface — plus publisher-signed public map, routing, search, road, U-turn and reviewed ALPR data, delivered automatically. Free forever, with no subscription. Compare with cloud circles.
DOWNLOAD
Start here: the online installer
Recommended for most people. The download is small; the installer fetches the exact signed container during setup.
Online installer
BanditKin-SelfHost-Online-29680266.zip
SHA-256b95fb8258797aefa4f4600632f986ebb1dfd47ee69ab7857aa86afaf63ca7d9f
Signed container imageghcr.io/auditurbo2/banditkin-selfhost@sha256:9287b95aba5ad658dddddafe49d1459bab1c340d2e0d9ca7e0f13d5599c56802
OFFLINE AND ADVANCED
Slow link or air-gapped? Take the whole image.
Each offline package includes the complete container image, so installation needs no download from GitHub.
Intel / AMD offline package
BanditKin-SelfHost-Offline-amd64-29680266.zip
SHA-25608eecdee679ac894d97b3c8ad996a4318f19fc915242a4ba07f083292158871a
ARM64 offline package
BanditKin-SelfHost-Offline-arm64-29680266.zip
SHA-256569145e2ff9da6d3c9e8c0fe3f026334bda97eaf01c2e244e61e3537dd02c3be
32-bit ARM systems are not supported. If you aren't sure which package you need, use the online installer above — it selects the right image for your machine automatically.
HOW IT WORKS
Six steps from download to paired
Docker and an HTTPS address are still required. This isn't a one-click install — but it is a documented one.
STEP 1
Download the installer
Take the online installer above, or an offline package if the machine can't reach the Internet during setup.
STEP 2
Install Docker
Docker Desktop on Windows and macOS, Docker Engine on Linux, or the built-in container manager on Synology, QNAP and Unraid.
STEP 3
Run it and pick your regions
Choose the map regions your relay should keep current. You can change the selection later.
STEP 4
Give the relay an HTTPS address
Tailscale with HTTPS and MagicDNS, or a domain you control behind a maintained HTTPS reverse proxy.
STEP 5
Pair the BanditKin app
Use the app's QR-based self-host option and scan. Your circle key stays on your devices — the relay never sees it.
STEP 6
Let it keep itself current
The relay checks BanditKin's publisher-signed catalog roughly every six hours and retrieves only the regions you selected.
SUPPORTED SYSTEMS
Where the relay runs
Anything that runs Docker on 64-bit Intel, AMD, or ARM hardware. The guide has step-by-step instructions for each of these.
Windows and macOS
With Docker Desktop, including Apple Silicon Macs.
Linux servers
Docker Engine on any modern 64-bit distribution.
Raspberry Pi
64-bit Raspberry Pi OS on Pi hardware that supports it.
Synology DSM 7
Through Container Manager, on x86-64 and ARM64 models.
QNAP
Through Container Station.
Unraid
As a standard Docker container.
Proxmox and hypervisors
In a VM or container guest running Docker.
Not supported
32-bit ARM systems. Older Pi models and 32-bit operating systems can't run the image.
HTTPS IS REQUIRED
Give your relay a real HTTPS address
The BanditKin app requires an HTTPS relay address. There are two well-trodden ways to get one.
Tailscale, if you want the short path
Tailscale with HTTPS and MagicDNS gives the relay a valid certificate and keeps it reachable from your phone without opening a port on your router.
Your own domain, if you'd rather
Point a domain you control at the relay and terminate HTTPS with Caddy, Nginx Proxy Manager, or another maintained HTTPS reverse proxy.
Do not expose unencrypted port 8090 directly to the Internet. Docker and HTTPS setup are genuinely required here — we'd rather tell you that up front than promise a one-click install and leave you on an open port.
SIGNED PUBLIC DATA
Maps that update themselves, verifiably
The installed updater checks BanditKin's publisher-signed catalog roughly every six hours and retrieves only the regions you selected.
What it verifies
The Ed25519 catalog signature, the generation number, the file size, the SHA-256 digest, and the expected data format — before anything is installed.
What it can update
Maps, address search and geocoding, road information, offline routing grids, U-turn information, and reviewed public ALPR snapshots.
What it can't touch
The updater has no access to your private circle-data volume. An interrupted or invalid update leaves the last known-good generation active.
Live catalog: maps.banditkin.com/v1/catalog.json · current public-data generation 2026072401. The catalog digest is listed in the release information below.
DOCUMENTATION
The full installation guide
Covers Windows and macOS with Docker Desktop, Linux, Raspberry Pi, Synology DSM 7 Container Manager, QNAP Container Station, Unraid, Proxmox and other hypervisors, online and offline installation, HTTPS and remote access, pairing BanditKin, automatic public-data updates, backup and recovery, container updates, and troubleshooting.
HTML guide
Markdown
SOURCE AND LICENSING
The self-host release is licensed AGPL-3.0-only
Corresponding source ships alongside every release, in the same folder as the installers.
The BanditKin self-host server, installer, updater, and included self-host web interface are licensed under AGPL-3.0-only. BanditKin trademarks, the Android app, managed hosted service, infrastructure, signing keys, production configuration, and private data pipeline are not included in the self-host source release.
Corresponding source
BanditKin-SelfHost-Source-29680266.zip
SHA-2569bbedba5b810f0d1bc0c04a3d1276e88144e037384741a97760e3e913d2212e2
VERIFY YOUR DOWNLOAD
Don't trust the download. Check it.
Every file in this release is listed in SHA256SUMS.txt and ships with its own Sigstore bundle. Here's how to confirm you got exactly what we published.
STEP 1
Compare the checksum
Hash the file you downloaded and compare it against SHA256SUMS.txt — and against the digests printed on this page.
STEP 2
Verify the signature
Every file has a matching .sigstore.json bundle. Verify it with cosign against the identity and issuer below.
STEP 3
Read the bill of materials
The SPDX SBOMs list every component inside each architecture's image; the vulnerability summaries record what scanners flagged, and why.
Signature identity
Expected Cosign identityhttps://github.com/auditurbo2/banditkin-app/.github/workflows/sign-banditkin-release.yml@refs/heads/codex/build251-hardening
Expected issuerhttps://token.actions.githubusercontent.com
Verify a download (swap in any filename)cosign verify-blob --bundle BanditKin-SelfHost-Online-29680266.zip.sigstore.json --certificate-identity "https://github.com/auditurbo2/banditkin-app/.github/workflows/sign-banditkin-release.yml@refs/heads/codex/build251-hardening" --certificate-oidc-issuer "https://token.actions.githubusercontent.com" BanditKin-SelfHost-Online-29680266.zip
Release information
BanditKin version0.2.15
Build / version code29680266
Platformslinux/amd64 and linux/arm64
Container digestsha256:9287b95aba5ad658dddddafe49d1459bab1c340d2e0d9ca7e0f13d5599c56802
Public-data generation2026072401
Public-data catalog SHA-256b4afdd3f5ced12a25545dea04dd7fc828d4d92ad909c048b87153e3250f016d0
Container vulnerability summaries for this release report 0 critical findings and 3 high scanner matches. All three are documented as not affected — the implicated Python modules and execution paths are not used by BanditKin. The raw scanner output and the policy that classifies them are both below, so you can check that call yourself.
Every file in this release, including a Sigstore bundle for each one, is listed in SHA256SUMS.txt.
FAQ
Self-hosting questions
Is self-hosting really free forever?
Yes. Self-hosting the BanditKin relay is free forever — no subscription, and no device cap imposed by us. Cloud circles are the paid option: a 30-day full free trial with no card and no account, then $4.99/month, $39.99/year, or a one-time $99.99 for lifetime access, one plan for the whole circle. See pricing.
Do I still need the BanditKin app?
Yes. The relay is the server half. Install BanditKin on your phones as usual and pair them to your own relay using the app's QR-based self-host option.
Can BanditKin read anything on my relay?
No. Your phone encrypts circle information end to end before it leaves the device. The self-hosted relay stores and forwards opaque encrypted records; it does not receive your circle encryption key or readable location history.
What hardware do I need?
Anything 64-bit that runs Docker — a spare PC, a Linux server or VPS, a modern NAS, or a 64-bit Raspberry Pi. You provide the hardware, electricity, Internet connection and storage; 32-bit ARM systems are not supported.
Why does the relay need HTTPS?
The BanditKin app requires an HTTPS relay address. The quickest route is Tailscale with HTTPS and MagicDNS; a domain you control behind Caddy, Nginx Proxy Manager, or another maintained reverse proxy also works. Don't expose unencrypted port 8090 directly to the Internet.
Is BanditKin open source?
Not as a whole, and we won't claim otherwise. The self-host release is licensed AGPL-3.0-only and ships with its corresponding source. The Android app, managed hosted service, infrastructure, signing keys, production configuration and private data pipeline are not included in that release. Here's what is public, and what isn't.
Do I get map and camera data on my own relay?
Yes. The installed updater checks BanditKin's publisher-signed catalog roughly every six hours and retrieves the regions you selected — maps, address search and geocoding, road information, offline routing grids, U-turn information, and reviewed public ALPR snapshots.
What happens if an update fails partway through?
Nothing breaks. An interrupted or invalid update leaves the last known-good generation active, and the updater has no access to your private circle-data volume.
Run it yourself.
Download the installer, follow the guide, and your circle's relay lives on hardware you control — free, forever.
Stuck? The guide's troubleshooting section covers the common cases first. If it doesn't, write to privacy@banditkin.com.