Docker Deployment (TKE)

TKE (ThinkLink Enterprise) is the self-hosted ThinkLink edition and runs with Docker Compose. Linux servers with internet access can use the official one-command installer; disconnected servers can use an offline bundle generated by the same installer. Both modes automatically deploy MinIO object storage and initialize a private bucket.

Updated: 2026-09-11. The new installer is published and supports online installation, offline bundle download, bundle verification, and offline installation.

Architecture restriction: The ThinkLink installation edition supports only x64 (x86_64 / amd64). ARM, ARM64, and 32-bit x86 are not supported. This applies to both online one-command installation and scripted offline installation.

1. Requirements

Item	Requirement
Permissions	root access (the command uses sudo)
CPU	x64 (x86_64 / amd64) only, at least 2 cores; other architectures are not supported
Memory	At least 4 GiB
Disk	At least 20 GiB free on the filesystem containing /opt
Network	Online installation and bundle downloads require HTTPS access to package.think-link.net and the artifact URLs it returns; the offline target needs no public internet connection

Support level	Distribution	Docker requirement
Automatic installation	Debian 11/12/13, Ubuntu 22.04, Rocky/AlmaLinux 9	Online mode can install Docker; offline mode requires it to be preinstalled
Compatibility mode	Ubuntu 20.04, CentOS 7/8	Docker Engine and Docker Compose V2 must already be installed

2. Open Ports

Open the ports you need in both the cloud security group and the server firewall:

Port	Protocol	Purpose
80	TCP	ThinkLink web UI; if occupied, the installer can offer port 8080 interactively
1883	TCP	MQTT
8083	TCP	MQTT over WebSocket
8084	TCP	MQTT over Secure WebSocket
18083	TCP	EMQX management UI
1700	UDP	LoRaWAN GWMP gateway traffic
9000	TCP	MinIO S3 API for the object storage service
9001	TCP	MinIO management console; restrict access to trusted administrator networks

MinIO is configured during installation. Normal ThinkLink use does not require access to the MinIO console. Compose publishes both MinIO ports on the host; restrict allowed sources to suit the deployment network. Neither port needs to be opened to the entire internet by default. During a first installation, the installer stops if another service occupies port 9000 or 9001; it does not select alternative MinIO ports.

PostgreSQL port 5432 and Redis port 6379 are container-internal and should not be exposed publicly. The installer does not configure HTTPS; use a reverse proxy and certificate if public HTTPS access is required.

3. Online One-Command Installation

For a target server without internet access, follow Scripted Offline Installation.

Run this command in the server terminal:

curl --tlsv1.2 --tls-max 1.2 -fsSL https://package.think-link.net/install.sh | sudo bash

No additional arguments are required. The installer will:

1. Check the operating system, architecture, CPU, memory, disk, and required ports.
2. Install Docker on supported systems, or reuse an existing working installation.
3. Download the application archive, Compose file, and 7 container image archives (9 files in total), including tkl-minio.tar, from the official ThinkLink package service.
4. Install everything under /opt/thinklink, load the images, and start the Docker Compose services. MinIO automatically creates the private thinklink bucket on first startup.
5. Check ThinkLink HTTP, MinIO readiness, and bucket initialization, then record the release and access information. The installer also writes a MinIO client configuration reference; see Built-in Object Storage for application settings.

If port 80 is already in use, the terminal offers port 8080 as an alternative. The installer does not stop or modify the existing service that owns port 80.

4. Access ThinkLink

After online or offline installation, the terminal displays access information for ThinkLink and its services. The installer saves its installation record in:

/opt/thinklink/install-info.txt

Only root can read this file. Sign in using the ThinkLink platform URL shown in the installation result and change the initial ThinkLink, EMQX, and MinIO passwords after first login. Update application client settings when changing MinIO credentials. The installer also writes /opt/thinklink/minio-client.json with permissions 0600 and the release record /opt/thinklink/.package-version.

The default URL is:

http://<server-IP>

If you selected the alternative web port during installation, use:

http://<server-IP>:8080

After signing in, create or join an organization before configuring gateways and devices.

5. Built-in Object Storage

For a fresh installation using the current online installer or a complete offline bundle, the installer configures MinIO and creates its private bucket automatically. No manual Compose merge or bucket creation is needed. /opt/thinklink/minio-client.json provides actual credentials and connection settings as a reference; it does not overwrite ThinkLink application configuration. Check and enter object storage settings for the ThinkLink version you install.

Item	Default behavior
Bucket	thinklink, created automatically on first startup
Access	Private bucket; files are accessed through authorized links
Suggested download link lifetime	604800 seconds (7 days); the actual application client setting applies
Persistent data	Compose named volume minio_data, mounted at /data in the MinIO container

A ThinkLink container on the same Docker network usually connects to http://minio:9000. The reference file's 127.0.0.1 address cannot directly connect a separate ThinkLink container to MinIO. Presigned URLs opened in a browser must use a server IP or hostname reachable from that browser.

After installation and checking the storage settings, generate a report and open or download it from Report Records to confirm that file storage works.

Objects reside in a Docker named volume. Include this volume in routine backups; backing up /opt/thinklink alone does not back up the object data. Restarting the container preserves existing buckets and objects.

These instructions apply to fresh online and offline installations. Offline mode rejects an existing installation directory, ThinkLink containers, or data volumes. Plan backups and a release-specific upgrade procedure for existing deployments.

6. Verify and Troubleshoot

Check all containers:

sudo docker compose -f /opt/thinklink/docker-compose.yml ps

Inspect a service log:

sudo docker compose -f /opt/thinklink/docker-compose.yml logs <service-name>

Check MinIO service readiness and bucket initialization:

curl --fail --silent --show-error http://127.0.0.1:9000/minio/health/ready
sudo docker compose -f /opt/thinklink/docker-compose.yml exec -T minio /thinklink-minio check-ready

The first command checks MinIO service readiness; the second checks completion of the initialization built into the image. If report generation or downloads fail, check container status, initialization results, relevant service logs, and whether the download link has expired.

Common installation failures include:

• The server is not x64 (x86_64 / amd64).
• CPU, memory, or free space under /opt is below the minimum.
• A compatibility-mode system does not already have Docker Engine and Compose V2.
• A required port is occupied and no available alternative was selected.
• A proxy or firewall prevents access to the official package service or interrupts a download.

Run bash thinklink-install.sh --help to see the new options. For offline or controlled-network deployments, follow Scripted Offline Installation to generate and use a complete bundle. Do not mix artifacts from different download batches.

7. Using TKE with the Cloud Platform

Do not keep the same LoRaWAN device profile enabled on two platforms at the same time. If TKE and the cloud platform both answer Join or Confirm messages, devices can experience Join failures and downlink conflicts. Disable or remove the profile on the platform that is not in use.

8. Scripted Offline Installation

The new installer supports downloading a bundle online, transferring and verifying it, and installing offline. No manual download API requests, Compose edits, or individual image imports are needed.

8.1. Prepare the Machines

Use a Linux download machine with Bash, curl, jq, tar, and sha256sum. Downloading and verification require neither root nor Docker. Allow enough space for the complete bundle; the 2.00.062 bundle tested on 2026-09-11 was approximately 2.45 GB. Future releases may differ in size.

The offline target must meet the installation requirements. Ubuntu 22.04, Debian 11/12/13, Rocky Linux 9, or AlmaLinux 9 is recommended. Prepare:

• Docker Engine installed and running, with Docker Compose V2.
• Bash, curl, jq, tar, sha256sum, ss, hostname, and basic system utilities.
• At least 20 GiB free on the filesystem containing /opt, plus space for the bundle, extraction, and image imports.
• A fresh installation environment with no /opt/thinklink, existing ThinkLink containers, or data volumes.

The bundle does not include Docker or operating-system dependencies. Prepare their offline installation materials separately for the target distribution, version, and x64 architecture. Offline mode does not run apt/dnf, download Docker, pull or build images, or report installation events.

Check the offline target:

uname -m
sudo docker version
sudo docker compose version

uname -m should report x86_64. Stop for other architectures. If an installation or residual data exists, prepare a backup, recovery, or upgrade plan first.

8.2. Download the Bundle on the Connected Machine

Save the public installer locally, then run download mode. Continue to the next command only after the previous one succeeds:

curl --fail --silent --show-error --proto '=https' \
  --tlsv1.2 --tls-max 1.2 --connect-timeout 10 --max-time 60 \
  https://package.think-link.net/install.sh -o thinklink-install.sh
bash thinklink-install.sh --help
bash thinklink-install.sh --download-only ./thinklink-offline

Help must list --download-only, --verify-only, and --offline. If it does not, download the new script again. Download mode must run from a local script file, not curl | bash, because the bundle must include the same complete installer.

The target directory ./thinklink-offline must not exist, and its parent must already exist. Do not run mkdir thinklink-offline first. The script downloads the application archive, Compose file, and seven images, and delivers the target directory only after verification succeeds:

thinklink-offline/
  application.tar
  docker-compose.yml
  tkl-emqx.tar
  tkl-nsbrg.tar
  tkl-postgres.tar
  tkl-redis.tar
  tkl-thinklink.tar
  tkl-thinkone.tar
  tkl-minio.tar
  install.sh
  install-offline.sh
  release.json
  SHA256SUMS
  README.txt

release.json records the release ID, version, channel, architecture, and offline format version. SHA256SUMS covers 13 files: nine artifacts, two scripts, the release record, and the bundled instructions. Download session responses and short-lived signed URLs are excluded from the delivered directory.

If a URL expires or an individual download fails, the script refreshes URLs using the original download session and retries once. It checks the release ID, version, and artifact paths to prevent mixing releases. Resuming across processes is not supported: rerunning after failure downloads the entire set again. Forced termination or a power outage may leave a .thinklink-offline.* staging directory; do not deliver it as a complete bundle.

8.3. Transfer and Verify

Transfer the entire thinklink-offline directory using removable media or an internal network, preserving all files unchanged. The generated directory has permissions 0700. The bundle may contain application configuration; keep access restricted after transfer.

On the offline target, enter the bundle directory and run:

cd thinklink-offline
bash install.sh --verify-only .

This mode needs neither root nor Docker and makes no network requests. It checks file integrity, manifest paths, and release format. Continue only after all checks pass. SHA-256 verifies transfer integrity; it is not a publisher signature and cannot independently establish provenance. Do not edit the manifest to bypass missing or damaged files.

8.4. Install with the Guided Installer

Run from the bundle directory:

sudo bash install-offline.sh

The installer performs these steps:

1. Verify the complete bundle and release information again.
2. Check the system, resources, Docker, existing installations, and ports. If port 80 is occupied, choose 8080 or exit. Other required port conflicts stop installation.
3. Display the release, installation directory, and HTTP port, then wait for y to confirm. Pressing Enter or entering n cancels.
4. Check application archive paths, extract the application, configure Compose and MinIO, and import seven images.
5. Confirm every image required by Compose exists locally, start with --pull never --no-build, and wait for ThinkLink HTTP, MinIO, and the private bucket to become ready.

To explicitly accept the final installation confirmation automatically, run:

sudo bash install-offline.sh --yes

--yes skips only the final confirmation. It does not bypass verification, existing-installation protection, or port selection. You can also specify the full bundle path from another directory:

sudo bash /path/to/thinklink-offline/install.sh --offline /path/to/thinklink-offline

Offline mode supports fresh installations only; it does not provide automatic upgrades or failure rollback. If an existing installation or residual data is detected, preserve and investigate it instead of deleting data to retry.

8.5. Verify the Installation

Successful installation displays the actual service URLs and writes the installation and release records. ThinkLink uses HTTP port 80 by default, or 8080 if selected. The EMQX console uses 18083; MinIO uses 9000 for the S3 API and 9001 for its console.

Check containers and the installed release. Change the HTTP check to port 8080 if selected:

sudo docker compose -f /opt/thinklink/docker-compose.yml ps
sudo cat /opt/thinklink/.package-version
curl --fail http://127.0.0.1:80/
curl --fail http://127.0.0.1:9000/minio/health/ready
sudo docker compose -f /opt/thinklink/docker-compose.yml exec -T minio /thinklink-minio check-ready

Then verify actual login, application workflows, and report generation/downloads. See Built-in Object Storage for connection requirements. Retain the complete bundle, including release.json and SHA256SUMS, for release traceability.

The 2026-09-11 release acceptance record confirms that 2.00.062 installed in an independent x64 Ubuntu 22.04 Docker virtual machine after its default route was removed. All seven containers ran; ThinkLink HTTP, MinIO, and private bucket checks passed; anonymous bucket access was denied. This acceptance covered installation infrastructure, excluding actual application login and business workflows. Complete those checks after deployment.

8.6. Common Errors

Message	Action
OFFLINE_OUTPUT_EXISTS	Choose a download directory that does not exist; preserve the old bundle
SCRIPT_FILE_REQUIRED	Save the public installer locally before running download mode
ARTIFACT_DOWNLOAD_FAILED	Check network access and disk space, then download the complete set again
DOWNLOAD_REFRESH_INVALID	The refreshed release or artifacts changed; download a new complete bundle
OFFLINE_BUNDLE_INVALID / OFFLINE_CHECKSUM_FAILED	Transfer the complete directory again; do not bypass the manifest
OFFLINE_RELEASE_INVALID / OFFLINE_ARCHIVE_UNSAFE	Release metadata or the application archive is invalid; obtain a complete bundle again and contact maintainers
OFFLINE_DOCKER_REQUIRED / COMMAND_REQUIRED	Supply offline dependencies, start Docker, and check Compose V2
OFFLINE_EXISTING_INSTALL	Prepare a backup and upgrade plan for the existing installation or data
PORT_IN_USE / ALTERNATE_PORT_IN_USE	Check occupied ports and arrange available ports before retrying
OFFLINE_CONFIRMATION_REQUIRED	Run in an interactive terminal, or explicitly use --yes for the final confirmation
OFFLINE_IMAGES_MISSING	Compose and images do not match; provide the complete bundle from one release
HEALTH_CHECK_FAILED	Check containers and logs, preserving installation data

Inspect local logs:

sudo docker compose -f /opt/thinklink/docker-compose.yml logs --tail=200

Review logs for application configuration or credentials before sharing them. Preserve existing data and the complete bundle after failure; the script cleans up only its own temporary directory.

8.7. Future Releases and Upgrades

Downloads use the release currently published on the stable channel. Check the download output and release.json for the selected version. The release tested on 2026-09-11 was 2.00.062; future downloads are not permanently pinned to it.

The package service checks upstream daily at 00:00 Beijing time and updates downloadable artifacts subject to release checks. If review is required or publication fails, the previous stable release remains available. Download requests do not build newly committed upstream code in real time. Updating server-side artifacts does not upgrade customer installations, and offline targets do not automatically check for or install updates. Prepare new artifacts, backups, and a release-specific upgrade plan before upgrading an existing deployment. Do not mix download batches.