Pocket ID on Ubuntu 24.04 LTS

Why the cloudimg image

cloudimg delivers Pocket ID fully installed behind an nginx reverse proxy, listening on loopback so it is never exposed directly, with an unauthenticated health endpoint for load balancer probes. Because this image is the identity plane itself, it is secure by default in a way that matters: no user, no passkey, no signing key and no secret ship in it. Pocket ID's initial administrator route is open to whoever reaches it first while no user exists, so on the first boot of every instance a sole administrator is created for that instance alone, which closes that route before the machine is ever reachable and removes the window in which someone else could claim your identity provider. That administrator has no password and no passkey: entry is a one time sign in link written to a file only the root user can read, so your SSH key is the root of trust. The encryption key is generated per instance too. The base OS is fully patched, the release is pinned, and every image is paired with a step by step deploy guide and 24/7 support.