Pocket ID 2.19.2 on AWS User Guide

Overview

This guide covers launching and using the Pocket ID 2.19.2 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg identity, secrets and PKI listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Pocket ID is an open source OpenID Connect (OIDC) provider with one defining idea: people sign in with passkeys (a fingerprint reader, face unlock, a phone or a hardware security key) instead of passwords. You register your applications with Pocket ID as OIDC clients, and your users sign in to all of them through it. There are no passwords to choose, rotate, leak or phish.

The cloudimg image is a hardened, ready-to-use Pocket ID server:

• nginx in front, Pocket ID behind it. nginx is the only public listener (ports 80 and 443). Pocket ID listens on 127.0.0.1:1411, the loopback address only.
• HTTPS from the first boot, on a DNS name. Pocket ID needs a DNS name, not an IP address (the passkey standard ties every passkey to a domain). First boot names the instance after its EC2 public DNS name and serves HTTPS with a certificate generated on your instance (an end-entity certificate, not a certificate authority). Port 80 redirects to HTTPS. Requests for any other host name are dropped.
• No setup page for strangers. A fresh Pocket ID lets the first visitor create the administrator. On this image, first boot creates the admin account itself, over the loopback address, before nginx opens the web port, and proves the setup route is closed; nginx refuses to start while it is open. You sign in once with a one-time link (single use, valid one hour) written to a file only root can read, then add your passkey.
• Your instance's own keys. First boot generates this instance's own database encryption key, kept in a file that only the pocket-id service account can read (never in an environment variable or a command line), and Pocket ID generates its own token signing key. The image ships an empty database: no users, no OIDC clients, no default login.
• Sign-in limits per client. nginx allows 30 requests a minute per client address (bursts of 20) on every sign-in, one-time-code, signup and token endpoint, and 20 requests a second per client address (bursts of 100) on everything else, except the web interface's own script and style files, which get 100 a second (bursts of 600) so that a first page load is never refused. The limit and Pocket ID's audit log use the real TCP peer address: Pocket ID trusts only the local nginx as a proxy, and nginx overwrites X-Forwarded-For and X-Real-IP, so a forged header changes nothing.
• Quiet by default. Pocket ID's anonymous usage analytics and its version check are switched off, and the service makes no outbound connection on boot.
• Server-side fetches can't reach inside. The one feature where Pocket ID fetches a URL itself (an OIDC client's logo from a URL) refuses the instance metadata service, the instance's own VPC, private and loopback addresses, and every non-HTTP scheme. Below the application, systemd denies Pocket ID every private, link-local and metadata range and this VPC's own range (read from the instance metadata at every boot).
• Browser hardening. Pocket ID's own Content-Security-Policy (frame-ancestors 'none'), X-Frame-Options: DENY, Strict-Transport-Security, and an nginx guard that refuses a state-changing request from another website. The access log records paths only, with one-time codes redacted, and Pocket ID logs at warn.
• Locked down. TLS 1.2 and 1.3 only; the AMI requires IMDSv2, and Pocket ID, nginx and the first-boot service are blocked from the instance metadata service.
• Pinned and verified, on a fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on. See Step 13 for exactly what is installed.

What is on the image: Pocket ID 2.19.2 (the official release binary from the upstream v2.19.2 release, checked against a fixed SHA-256, in /usr/local/bin/pocket-id), SQLite (built into Pocket ID), nginx from Ubuntu 24.04, cloud-init and the AWS Systems Manager agent.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet that gives the instance a public IPv4 address and a public DNS name (the default VPC does; in your own VPC, turn on DNS hostnames).
• A security group that allows TCP 22 (SSH) from your own networks only, and TCP 443 (Pocket ID) and TCP 80 (redirects to HTTPS) from the networks whose people sign in through Pocket ID and whose applications use it. To get a certificate from Let's Encrypt (Step 6), port 80 must be reachable from the internet while it is issued. Do not open 1411 or 1414: Pocket ID listens on the loopback address only.
• For passkeys: a DNS name you control (for example id.example.com) and a certificate that browsers trust for it. Until then you can sign in with the one-time link and look around, but a browser will not create a passkey for a site whose certificate it does not trust.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Pocket ID 2.19.2 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, and a security group as above.

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --image-id <ami-id-from-the-listing> --instance-type m5.large \
  --key-name <your-key-pair> --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --associate-public-ip-address \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=pocket-id}]'

First boot takes a few seconds after the instance is running: it generates the keys and the certificate, starts Pocket ID, creates the admin account and only then opens the web port. If you want the instance to use your own name from the start, put it in /etc/cloudimg/pocket-id-domain.preset with user data (for example a cloud-init write_files entry); otherwise first boot uses the instance's public DNS name (or its private DNS name if it has no public one).

Step 2: Connect to your instance

Operating system	SSH user
Ubuntu 24.04	ubuntu

ssh -i <your-key.pem> ubuntu@<public-ip>

The login message shows the address of Pocket ID and the commands this guide uses.

Step 3: Check the services

systemctl is-active pocket-id nginx

active
active

(pocket-id-firstboot runs once, on the first boot, and shows inactive on every later boot.)

Only SSH, HTTP and HTTPS are public. Pocket ID and its internal actor port listen on the loopback address:

sudo ss -tln | grep -E ':(22|80|443|1411|1414) '

LISTEN 0      511          0.0.0.0:443       0.0.0.0:*          
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*          
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*          
LISTEN 0      128        127.0.0.1:1411      0.0.0.0:*          
LISTEN 0      511             [::]:443          [::]:*          
LISTEN 0      511             [::]:80           [::]:*          
LISTEN 0      4096            [::]:22           [::]:*

A built-in self-test checks the OIDC discovery document and the signing keys over HTTPS, that the setup route is closed, that the admin API refuses a request without a session, and that the token endpoint refuses an unknown client:

sudo pocket-id-selftest

pocket-id-selftest: discovery (issuer https://ec2-198-51-100-24.compute-1.amazonaws.com), JWKS 1 signing key(s), setup closed, admin API 401, unknown client invalid_client
POCKET_ID_SELFTEST_OK

Step 4: Read the credentials file and the certificate fingerprint

sudo cat /root/pocket-id-credentials.txt

The file (root only, mode 0600) holds this instance's address, the SHA-256 fingerprint of its certificate and the one-time sign-in link for the admin account. There is no administrator password: Pocket ID has none.

# Pocket ID 2.19.2 on this instance (cloudimg). Sign in once with POCKET_ID_ADMIN_LINK, then add a passkey.
# The certificate is self-signed for this instance: compare its SHA-256 fingerprint with POCKET_ID_TLS_SHA256.
# Passkeys need a DNS name with a trusted certificate: sudo pocket-id-set-domain (see the guide) BEFORE adding one.
# A new one-time link at any time: sudo pocket-id-admin-link
POCKET_ID_URL=https://ec2-198-51-100-24.compute-1.amazonaws.com/
POCKET_ID_HOST=ec2-198-51-100-24.compute-1.amazonaws.com
POCKET_ID_ADMIN_USERNAME=admin
POCKET_ID_TLS_SHA256=10:D6:AA:F8:...:(64 hex digits in pairs)
POCKET_ID_NAME_SOURCE=public-dns-name
POCKET_ID_ADDRESS=198.51.100.24
POCKET_ID_ADDRESS_SOURCE=imdsv2-public-ipv4
GUIDE=https://www.cloudimg.co.uk/guides/pocket-id-2-19-2-on-ubuntu-24-04-aws/
POCKET_ID_ADMIN_LINK_USER=admin
POCKET_ID_ADMIN_LINK=https://ec2-198-51-100-24.compute-1.amazonaws.com/lc/<12-character one-time code>
POCKET_ID_ADMIN_LINK_EXPIRES=2026-11-08T15:10:32Z

Treat the link like a password until you have used it: whoever opens it first becomes the admin's session. It works once and expires at POCKET_ID_ADMIN_LINK_EXPIRES. To make a new one at any time (for example after it expired, or for another user by username):

sudo pocket-id-admin-link

pocket-id-admin-link: a one-time sign-in link for 'admin' (valid until 2026-11-08T15:23:04Z, single use) is in /root/pocket-id-credentials.txt (POCKET_ID_ADMIN_LINK)

The certificate is self-signed and unique to your instance, so your browser warns about it. Open the certificate details in the browser, check that its SHA-256 fingerprint matches POCKET_ID_TLS_SHA256, and only then continue. Do not add the certificate to your operating system's trust store; Step 6 replaces it with a trusted one. Copy it to your home directory so that the commands in this guide can use it as their trust anchor:

sudo cat /etc/ssl/pocket-id/pocket-id.crt > ~/pocket-id-instance.crt
openssl x509 -in ~/pocket-id-instance.crt -noout -subject -ext basicConstraints,keyUsage,extendedKeyUsage,subjectAltName

subject=CN = ec2-198-51-100-24.compute-1.amazonaws.com, O = cloudimg
X509v3 Subject Alternative Name: 
    DNS:ec2-198-51-100-24.compute-1.amazonaws.com, IP Address:198.51.100.24, IP Address:172.31.16.20, DNS:ip-172-31-16-20.ec2.internal, IP Address:127.0.0.1
X509v3 Basic Constraints: critical
    CA:FALSE
X509v3 Key Usage: critical
    Digital Signature, Key Encipherment
X509v3 Extended Key Usage: 
    TLS Web Server Authentication

Step 5: Sign in with the one-time link

Open the POCKET_ID_ADMIN_LINK URL in your browser and accept the certificate once you have checked its fingerprint. Pocket ID signs you in as admin and, because the account has no passkey yet, opens Set up your passkey. Choose Skip for now: a passkey belongs to the name in your address bar, so add it once Pocket ID has the name you will keep and a certificate your browser trusts (Steps 6 and 7):

The link is now used up. Opened again, in any browser, it is refused and signs nobody in (the spent code is masked here):

The same check from the instance (pocket-id-admin-link above made a new link, so this uses that one and then tries it a second time):

L=$(sudo sed -n 's|^POCKET_ID_ADMIN_LINK=.*/lc/||p' /root/pocket-id-credentials.txt)
H=$(sudo sed -n 's/^POCKET_ID_HOST=//p' /root/pocket-id-credentials.txt)
for try in first second; do
  printf '%s use: ' "$try"
  curl -s -o /dev/null -w '%{http_code}\n' --cacert ~/pocket-id-instance.crt -X POST -H "Origin: https://$H" "https://$H/api/one-time-access-token/$L"
done
unset L

first use: 200
second use: 401

(200 is a sign-in; 401 is the refusal.) Before you add a passkey, give Pocket ID a DNS name with a trusted certificate (next step), and replace the admin's placeholder email address: open Settings > My Account, change Email from admin@pocket-id.invalid to your own address and save. First boot uses that placeholder because Pocket ID requires an email for every account; nothing is ever sent to it.

Step 6: Your domain and a trusted certificate

Passkeys belong to a domain: a passkey registered at ec2-...amazonaws.com only works there, and browsers create passkeys only for a site whose certificate they trust. So before your users add passkeys, point your own name at Pocket ID:

1. Create a DNS record for your name (for example an A record id.example.com to the instance's Elastic IP address).
2. Point Pocket ID at it. The first name becomes Pocket ID's URL; any names after it keep working too:

sudo pocket-id-set-domain id.example.com "$(sudo sed -n 's/^POCKET_ID_HOST=//p' /root/pocket-id-credentials.txt)"

1. Get a certificate for it. With Let's Encrypt, nginx already serves the HTTP challenge directory, so certbot's webroot mode works without stopping anything (port 80 must be reachable from the internet while it runs):

sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/cloudimg-acme -d id.example.com --email you@example.com --agree-tos -n \
  --deploy-hook 'pocket-id-set-domain --tls-cert /etc/letsencrypt/live/id.example.com/fullchain.pem --tls-key /etc/letsencrypt/live/id.example.com/privkey.pem id.example.com'

The deploy hook installs the certificate now and again after every automatic renewal. With a certificate from another authority, run sudo pocket-id-set-domain --tls-cert <fullchain.pem> --tls-key <private-key.pem> id.example.com yourself; it checks that the key matches and that the certificate covers the name.

1. Make a new one-time link for the new name with sudo pocket-id-admin-link (links made before the change point at the old name).

Changing the name later invalidates every passkey registered for the old one, so choose the name you will keep. Without --tls-cert, pocket-id-set-domain issues a new self-signed certificate for the names you give, and refuses an IP address as the first name:

sudo pocket-id-set-domain --no-restart 203.0.113.9 || true

[2026-11-08T14:23:09+0000] pocket-id-set-domain: FATAL: '203.0.113.9' is an IP address: Pocket ID needs a DNS name for its URL (the passkey relying-party ID must be a domain; Pocket ID refuses to start with an IP). Give a DNS name first; an address may follow as an extra name

Step 7: Register your passkey

At https://id.example.com/, open Settings > My Account and choose Add Passkey. Your browser or operating system asks which authenticator to use (this computer, a phone, a security key), and the new passkey appears under Passkeys. Rename it from its menu (here Laptop) so that you can tell your passkeys apart:

Sign out and sign back in: the sign-in page has one button, Authenticate, which asks for your passkey:

Add a second passkey (another device or a security key) so that losing one does not lock you out. If you are ever locked out, sudo pocket-id-admin-link on the instance gives you a new one-time link.

Step 8: Add your users and your first OIDC application

Under Settings > Administration, Users adds people (each user gets a one-time link or code to register their own passkey) and User Groups groups them, so that you can restrict an application to a group.

To connect an application, open OIDC Clients, choose Add OIDC Client, give it a name and the callback URL your application documents:

After Create, Pocket ID shows the client ID and, once only, the client secret (masked here). Copy the secret into your application's configuration now:

Your application needs the issuer URL and, if it does not read the discovery document itself, the endpoints in it:

H=$(sudo sed -n 's/^POCKET_ID_HOST=//p' /root/pocket-id-credentials.txt)
curl -s --cacert ~/pocket-id-instance.crt "https://$H/.well-known/openid-configuration" \
  | jq '{issuer, authorization_endpoint, token_endpoint, userinfo_endpoint, jwks_uri, end_session_endpoint}'
curl -s --cacert ~/pocket-id-instance.crt "https://$H/.well-known/jwks.json" | jq '.keys[] | {kty, alg, use, kid}'

{
  "issuer": "https://ec2-198-51-100-24.compute-1.amazonaws.com",
  "authorization_endpoint": "https://ec2-198-51-100-24.compute-1.amazonaws.com/authorize",
  "token_endpoint": "https://ec2-198-51-100-24.compute-1.amazonaws.com/api/oidc/token",
  "userinfo_endpoint": "https://ec2-198-51-100-24.compute-1.amazonaws.com/api/oidc/userinfo",
  "jwks_uri": "https://ec2-198-51-100-24.compute-1.amazonaws.com/.well-known/jwks.json",
  "end_session_endpoint": "https://ec2-198-51-100-24.compute-1.amazonaws.com/api/oidc/end-session"
}
{
  "kty": "RSA",
  "alg": "RS256",
  "use": "sig",
  "kid": "ZArsZwkzSq0"
}

The JSON Web Key Set holds only the public half of this instance's signing key. To check a client's credentials from the instance (replace the values in angle brackets with your client's ID and secret), ask for a token with the client credentials grant; a wrong secret is refused:

curl -s --cacert ~/pocket-id-instance.crt -u '<client-id>:<client-secret>' -d grant_type=client_credentials \
  "https://$(sudo sed -n 's/^POCKET_ID_HOST=//p' /root/pocket-id-credentials.txt)/api/oidc/token" | jq '{token_type, expires_in}'

{
  "token_type": "bearer",
  "expires_in": 3599
}

Step 9: Sign-in limits and who can reach Pocket ID

Pocket ID's sign-in, one-time-code, signup and token endpoints are limited by nginx to 30 requests a minute per client address, with a burst of 20; past that a client gets HTTP 429 until its allowance refills, while other clients carry on. All other requests are limited to 20 a second per client address (bursts of 100), and the web interface's own script and style files under /_app/immutable/ to 100 a second (bursts of 600), since a browser fetches about 120 of them on its first visit. The limits are in /etc/nginx/conf.d/cloudimg-pocket-id.conf:

grep -E '^limit_req' /etc/nginx/conf.d/cloudimg-pocket-id.conf

limit_req_zone $binary_remote_addr zone=pid_auth:10m rate=30r/m;
limit_req_zone $binary_remote_addr zone=pid_all:10m rate=20r/s;
limit_req_zone $binary_remote_addr zone=pid_static:10m rate=100r/s;
limit_req_status 429;

The limits and Pocket ID's audit log (Settings > Audit Log) use the address of the TCP connection that reached nginx: Pocket ID trusts only the local nginx as a proxy (TRUST_PROXY=127.0.0.1/32,::1/128), and nginx replaces any X-Forwarded-For or X-Real-IP a client sends. If you put a load balancer in front of the instance, every request then comes from the load balancer's address: add its addresses to nginx's set_real_ip_from (with real_ip_header X-Forwarded-For) so that the limits apply per real client again.

Who can sign in is decided by your security group and by who has a passkey or a one-time link. Pocket ID has no open registration: Settings > Administration > Application Configuration controls whether people may sign up on their own (off by default).

Step 10: Settings

Pocket ID reads its settings from /etc/pocket-id/pocket-id.env (mode 0640, root:pocket-id), which holds no secret; most options are also in Application Configuration in the admin UI. The file the image ships:

sudo grep -vE '^(#|$)' /etc/pocket-id/pocket-id.env

APP_URL=https://ec2-198-51-100-24.compute-1.amazonaws.com
ENCRYPTION_KEY_FILE=/etc/pocket-id/encryption.key
DB_CONNECTION_STRING=/var/lib/pocket-id/data/pocket-id.db
FILE_BACKEND=filesystem
UPLOAD_PATH=/var/lib/pocket-id/data/uploads
GEOLITE_DB_PATH=/var/lib/pocket-id/data/GeoLite2-City.mmdb
HOST=127.0.0.1
PORT=1411
ACTORS_HOST=127.0.0.1
ACTORS_PORT=1414
TRUST_PROXY=127.0.0.1/32,::1/128
ANALYTICS_DISABLED=true
VERSION_CHECK_DISABLED=true
ALLOW_INSECURE_CALLBACK_URLS=false
OUTBOUND_ALLOWED_HOSTS_SCIM=none
OUTBOUND_ALLOWED_HOSTS_BACKCHANNEL_LOGOUT=none
OUTBOUND_ALLOWED_HOSTS_FEDERATED_JWKS=none
OTEL_TRACES_EXPORTER=none
OTEL_METRICS_EXPORTER=none
OTEL_LOGS_EXPORTER=none
LOG_LEVEL=warn

APP_URL is set by pocket-id-set-domain; do not edit it by hand. After changing anything else, run sudo systemctl restart pocket-id. Email (sign-in codes by email, notifications) is off until you configure SMTP under Application Configuration > Email; MAXMIND_LICENSE_KEY adds city lookups to the audit log (it makes Pocket ID download the GeoLite database, so allow that outbound connection in your security group and network ACLs).

Step 11: The encryption key, the database and backups

Pocket ID keeps users, passkeys (their public keys), clients and the audit log in the SQLite database /var/lib/pocket-id/data/pocket-id.db. Secrets inside it (the token signing key, client secrets) are encrypted with this instance's key in /etc/pocket-id/encryption.key. Only the pocket-id user can read either:

sudo stat -c '%a %U:%G %n' /etc/pocket-id/encryption.key /etc/pocket-id/pocket-id.env /var/lib/pocket-id/data /var/lib/pocket-id/data/pocket-id.db

600 pocket-id:pocket-id /etc/pocket-id/encryption.key
640 root:pocket-id /etc/pocket-id/pocket-id.env
700 pocket-id:pocket-id /var/lib/pocket-id/data
600 pocket-id:pocket-id /var/lib/pocket-id/data/pocket-id.db

Back up the key with the database, and protect both: without the key, the database's secrets cannot be read, and with it they can. To back up, stop Pocket ID briefly and copy both (replace <backup-dir> with a directory only root can read):

sudo systemctl stop pocket-id
sudo install -d -m 0700 <backup-dir>
sudo cp -p /etc/pocket-id/encryption.key /var/lib/pocket-id/data/pocket-id.db <backup-dir>/
sudo systemctl start pocket-id

Step 12: Security notes

• Metadata service and private addresses. The AMI requires IMDSv2. systemd denies Pocket ID, nginx and the first-boot service the instance metadata addresses, and denies Pocket ID every private, link-local, shared and reserved range plus this VPC's own range, which a small service reads from the instance metadata at every boot. This fails closed: the service retries the metadata service six times over about 30 seconds, and if it still cannot read this VPC's range, Pocket ID does not start and nginx answers 502 until you run sudo systemctl restart cloudimg-pocket-id-metadata pocket-id once the metadata service answers. A VPC inside the private ranges (as here, 172.31.0.0/16) is already covered by them; a VPC range outside them is added to the list:

systemctl show -p IPAddressDeny --value pocket-id | tr ' ' '\n' | sort -V | tr '\n' ' '; echo
cat /run/cloudimg-pocket-id/vpc-cidrs

0.0.0.0/8 10.0.0.0/8 100.64.0.0/10 168.63.129.16/32 169.254.0.0/16 172.16.0.0/12 192.0.0.0/24 192.168.0.0/16 198.18.0.0/15 224.0.0.0/4 240.0.0.0/4 ::/0
# written by pocket-id-metadata from EC2 metadata at 2026-11-08T14:10:19Z
source imds
4 172.31.0.0/16

• No outbound connections. Pocket ID's analytics (ANALYTICS_DISABLED=true) and version check (VERSION_CHECK_DISABLED=true) are off, and the outbound features (SCIM provisioning, back-channel logout, federated JWKS) are restricted to no hosts until you allow them. A client logo given as a URL is the only fetch Pocket ID makes by itself, and it is refused for metadata, loopback, private and VPC addresses.
• Where the key lives. Pocket ID reads its encryption key from /etc/pocket-id/encryption.key (mode 0600, pocket-id); the environment only names the file (ENCRYPTION_KEY_FILE), so the key is in no process environment, command line, journal or log. It is generated on your instance at first boot. Core dumps are off for Pocket ID and nginx, and the instance has no swap.
• The setup route. Pocket ID's initial-setup route creates the first admin on an empty database. First boot uses it before the web port opens and checks that it is closed; nginx's start-up gate refuses to start while it is open, so the route is never reachable from the network.
• Response headers. Pocket ID's Content-Security-Policy with frame-ancestors 'none', X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy: same-origin, a Permissions-Policy and Strict-Transport-Security.
• Upgrades. Ubuntu security updates (including nginx) install automatically. Pocket ID is a pinned release binary, so cloudimg publishes new versions of this AMI for new Pocket ID releases. Pocket ID 2.19.2 has no open security advisory; earlier releases, including those some marketplace images still ship, have critical ones.

Step 13: Licences and source

Pocket ID is licensed under the BSD 2-Clause licence. The image ships its licence and records exactly what it was built from:

cat /usr/share/doc/cloudimg-pocket-id/SOURCE.txt
pocket-id version

Pocket ID 2.19.2 (BSD-2-Clause)
release asset: https://github.com/pocket-id/pocket-id/releases/download/v2.19.2/pocket-id_linux_amd64
sha256: 85881ea87d78710c34f127b2d849d27dd7e69963723d9e590f66de26e87fc4fb
checksums.txt sha256: 555c06bf2d32e58f759fc0710737fa56e59b3a2a74b11e7d4eca96ea49180a85
tag v2.19.2 = commit 2b2750ed61e0016f4c15630322d15ca22143cdb6
source: https://github.com/pocket-id/pocket-id/tree/v2.19.2
pocket-id 2.19.2

cloudimg installs the official pocket-id_linux_amd64 binary from the upstream v2.19.2 release on GitHub, checked against a fixed SHA-256 and against the release's own checksum list (also pinned); a different file stops the build. The licence text is in /usr/share/doc/cloudimg-pocket-id/LICENSE-pocket-id-BSD-2-Clause.txt; nginx is the Ubuntu package (/usr/share/doc/nginx/copyright). Pocket ID is a trademark of its respective owner. All product and company names are trademarks or registered trademarks of their respective holders; cloudimg is not affiliated with or endorsed by them.

Support

cloudimg supports this image: email support@cloudimg.co.uk. See the identity, secrets and PKI listing guide for the other versions in this listing.