{"id":13683434,"url":"https://github.com/gnzsnz/ib-gateway-docker","last_synced_at":"2026-05-27T11:08:03.224Z","repository":{"id":186477227,"uuid":"675229764","full_name":"gnzsnz/ib-gateway-docker","owner":"gnzsnz","description":"Docker image with IB Gateway/TWS and IBC ","archived":false,"fork":false,"pushed_at":"2026-02-18T10:28:32.000Z","size":491,"stargazers_count":795,"open_issues_count":1,"forks_count":182,"subscribers_count":34,"default_branch":"master","last_synced_at":"2026-02-18T15:05:58.823Z","etag":null,"topics":["algorithmic-trading","docker","ibgateway","ibkr","quant","quantitative-finance","trading","trading-bot","tws","tws-api"],"latest_commit_sha":null,"homepage":"https://github.com/users/gnzsnz/packages/container/package/ib-gateway","language":"Go Template","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/gnzsnz.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2023-08-06T08:10:50.000Z","updated_at":"2026-02-18T14:32:56.000Z","dependencies_parsed_at":null,"dependency_job_id":"83d6b69f-b243-418f-9962-23a2136e652e","html_url":"https://github.com/gnzsnz/ib-gateway-docker","commit_stats":null,"previous_names":["gnzsnz/ib-gateway-docker"],"tags_count":362,"template":false,"template_full_name":null,"purl":"pkg:github/gnzsnz/ib-gateway-docker","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gnzsnz%2Fib-gateway-docker","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gnzsnz%2Fib-gateway-docker/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gnzsnz%2Fib-gateway-docker/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gnzsnz%2Fib-gateway-docker/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/gnzsnz","download_url":"https://codeload.github.com/gnzsnz/ib-gateway-docker/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/gnzsnz%2Fib-gateway-docker/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30076159,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-04T08:01:56.766Z","status":"ssl_error","status_checked_at":"2026-03-04T08:00:42.919Z","response_time":59,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["algorithmic-trading","docker","ibgateway","ibkr","quant","quantitative-finance","trading","trading-bot","tws","tws-api"],"created_at":"2024-08-02T13:02:11.343Z","updated_at":"2026-05-27T11:08:03.216Z","avatar_url":"https://github.com/gnzsnz.png","language":"Go Template","funding_links":[],"categories":["Shell"],"sub_categories":[],"readme":"# Interactive Brokers Gateway Docker\n\n[![Build](https://github.com/gnzsnz/ib-gateway-docker/actions/workflows/on-push-n-pr.yml/badge.svg?branch=master)](https://github.com/gnzsnz/ib-gateway-docker/actions) [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT) [![GitHub Discussions](https://img.shields.io/github/discussions/gnzsnz/ib-gateway-docker)](https://github.com/gnzsnz/ib-gateway-docker/discussions) [![GitHub Repo stars](https://img.shields.io/github/stars/gnzsnz/ib-gateway-docker)](#repo-stats) [![GitHub forks](https://img.shields.io/github/forks/gnzsnz/ib-gateway-docker)](https://github.com/gnzsnz/ib-gateway-docker/network/members)\n\n\u003cimg src=\"https://github.com/gnzsnz/ib-gateway-docker/blob/master/logo.png\" height=\"300\" class=\"center\" alt=\"IB Gateway Docker\"/\u003e\n\n## What is it?\n\nA docker image to run Interactive Brokers Gateway and TWS without any human\ninteraction on a docker container\n\nIt includes:\n\n- [IB Gateway](https://www.interactivebrokers.com/en/index.php?f=16457) ([stable](https://www.interactivebrokers.com/en/trading/ibgateway-stable.php) or [latest](https://www.interactivebrokers.com/en/trading/ibgateway-latest.php))\n- Trader Workstation [TWS](https://www.interactivebrokers.com/en/trading/tws-offline-installers.php) ([stable](https://www.interactivebrokers.com/en/trading/tws-offline-stable.php) or [latest](https://www.interactivebrokers.com/en/trading/tws-offline-latest.php)), from `10.26.1h`\n- [IBC](https://github.com/IbcAlpha/IBC) - to control TWS/IB Gateway (simulates user input).\n- [Xvfb](https://www.x.org/releases/X11R7.6/doc/man/man1/Xvfb.1.xhtml) - a X11\n  virtual framebuffer to run IB Gateway Application without graphics hardware.\n- [x11vnc](https://wiki.archlinux.org/title/x11vnc) - a VNC server to interact\n  with the IB Gateway user interface (optional, for development / maintenance purpose).\n- xrdp/xfce enviroment for TWS. Build on top of [linuxserver/rdesktop](https://github.com/linuxserver/docker-rdesktop/).\n- [socat](https://manpages.ubuntu.com/manpages/noble/en/man1/socat.1.html) a\n  tool to accept TCP connection from non-localhost and relay it to IB Gateway\n  from localhost (IB Gateway restricts connections to container's 127.0.0.1 by\n  default).\n- Optional remote [SSH tunnel](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html)\n  to provide secure connections for both IB Gateway and VNC. Only available for\n  `10.19.2g-stable` and `10.25.1o-latest` or greater.\n- Support parallel execution of `live` and `paper` trading mode.\n- [Secrets](#credentials) support (latest `10.29.1e`, stable `10.19.2m` or greater)\n- Experimental [aarch64](#aarch64-support) support, ex raspberry pi, M1,M2,M3,.., since `10.37.1l`/`10.39.1e`\n- Execution of custom scripts during [star-up process](#start-up-scripts).\n- Works well together with [Jupyter Quant](https://github.com/quantbelt/jupyter-quant)\n  docker image.\n\n## Supported Tags\n\nImages are provided for [IB gateway][1] and [TWS][2]. With the following tags:\n\n| Image| Channel  | IB Gateway Version  | IBC Version      | Docker Tags                                    |\n| --- | -------- | ------------------- | ---------------- | ---------------------------------------------- |\n| [ib-gateway][1] | `latest` | `10.47.1b` | `3.23.0` | `latest` `10.47` `10.47.1b` |\n| [ib-gateway][1] |`stable` | `10.45.1f` | `3.23.0` | `stable` `10.45` `10.45.1f` |\n| [tws-rdesktop][2] | `latest` | `10.47.1b` | `3.23.0` | `latest` `10.47` `10.47.1b` |\n| [tws-rdesktop][2] |`stable` | `10.45.1f` | `3.23.0` | `stable` `10.45` `10.45.1f` |\n\nAll tags are available in the container repository for [ib-gateway][1] and\n[tws-rdesktop][2]. IB Gateway and TWS share the same version numbers and tags.\n\n## How to use it?\n\nCreate a `docker-compose.yml` file (or include ib-gateway services on your existing\none). The sample files provided can be used as starting point,\n[ib-gateway-compose](https://github.com/gnzsnz/ib-gateway-docker/blob/master/docker-compose.yml) and\n[tws-rdesktop-compose](https://github.com/gnzsnz/ib-gateway-docker/blob/master/tws-docker-compose.yml).\n\n```yaml\nname: algo-trader\nservices:\n  ib-gateway:\n    restart: always\n    build:\n      context: ./stable\n      tags:\n        - \"ghcr.io/gnzsnz/ib-gateway:stable\"\n    image: ghcr.io/gnzsnz/ib-gateway:stable\n    environment:\n      TWS_USERID: ${TWS_USERID}\n      TWS_PASSWORD: ${TWS_PASSWORD}\n      TWS_PASSWORD_FILE: ${TWS_PASSWORD_FILE}\n      TRADING_MODE: ${TRADING_MODE:-paper}\n      TWS_SETTINGS_PATH: ${TWS_SETTINGS_PATH:-}\n      TWS_ACCEPT_INCOMING: ${TWS_ACCEPT_INCOMING:-}\n      TWS_MASTER_CLIENT_ID: ${TWS_MASTER_CLIENT_ID:-}\n      READ_ONLY_API: ${READ_ONLY_API:-}\n      VNC_SERVER_PASSWORD: ${VNC_SERVER_PASSWORD:-}\n      TWOFA_TIMEOUT_ACTION: ${TWOFA_TIMEOUT_ACTION:-exit}\n      BYPASS_WARNING: ${BYPASS_WARNING:-}\n      AUTO_RESTART_TIME: ${AUTO_RESTART_TIME:-}\n      AUTO_LOGOFF_TIME: ${AUTO_LOGOFF_TIME:-}\n      TWS_COLD_RESTART: ${TWS_COLD_RESTART:-}\n      SAVE_TWS_SETTINGS: ${SAVE_TWS_SETTINGS:-}\n      RELOGIN_AFTER_TWOFA_TIMEOUT: ${RELOGIN_AFTER_TWOFA_TIMEOUT:-no}\n      TWOFA_EXIT_INTERVAL: ${TWOFA_EXIT_INTERVAL:-60}\n      TWOFA_DEVICE: ${TWOFA_DEVICE:-}\n      EXISTING_SESSION_DETECTED_ACTION: ${EXISTING_SESSION_DETECTED_ACTION:-primary}\n      ALLOW_BLIND_TRADING: ${ALLOW_BLIND_TRADING:-no}\n      TIME_ZONE: ${TIME_ZONE:-Etc/UTC}\n      TZ: ${TIME_ZONE:-Etc/UTC}\n      CUSTOM_CONFIG: ${CUSTOM_CONFIG:-NO}\n      JAVA_HEAP_SIZE: ${JAVA_HEAP_SIZE:-}\n      SSH_TUNNEL: ${SSH_TUNNEL:-}\n      SSH_OPTIONS: ${SSH_OPTIONS:-}\n      SSH_ALIVE_INTERVAL: ${SSH_ALIVE_INTERVAL:-}\n      SSH_ALIVE_COUNT: ${SSH_ALIVE_COUNT:-}\n      SSH_PASSPHRASE: ${SSH_PASSPHRASE:-}\n      SSH_REMOTE_PORT: ${SSH_REMOTE_PORT:-}\n      SSH_USER_TUNNEL: ${SSH_USER_TUNNEL:-}\n      SSH_RESTART: ${SSH_RESTART:-}\n      SSH_VNC_PORT: ${SSH_VNC_PORT:-}\n      START_SCRIPTS: ${START_SCRIPTS:-}\n      X_SCRIPTS: ${X_SCRIPTS:-}\n      IBC_SCRIPTS: ${IBC_SCRIPTS:-}\n#    volumes:\n#      - ${PWD}/jts.ini:/home/ibgateway/Jts/jts.ini\n#      - ${PWD}/config.ini:/home/ibgateway/ibc/config.ini\n#      - ${PWD}/tws_settings/:${TWS_SETTINGS_PATH:-/home/ibgateway/Jts}\n#      - ${PWD}/ssh/:/home/ibgateway/.ssh\n#      - ${PWD}/init-scripts:/home/ibgateway/init-scripts\n    ports:\n      - \"127.0.0.1:4001:4003\"\n      - \"127.0.0.1:4002:4004\"\n      - \"127.0.0.1:5900:5900\"\n\n```\n\nCreate an .env on root directory. You can use the provided [.env-dist](https://github.com/gnzsnz/ib-gateway-docker/blob/master/.env-dist) as a starting point. Example .env file:\n\n```bash\nTWS_USERID=myTwsAccountName\nTWS_PASSWORD=myTwsPassword\n# see credentials section\n#TWS_PASSWORD_FILE\n#TWS_USERID_PAPER=\n#TWS_PASSWORD_PAPER=\n#TWS_PASSWORD_PAPER_FILE=\n# ib-gateway\n#TWS_SETTINGS_PATH=/home/ibgateway/Jts\n# tws\n#TWS_SETTINGS_PATH=/config/tws_settings\nTWS_SETTINGS_PATH=\nTWS_ACCEPT_INCOMING=\nTRADING_MODE=paper\nREAD_ONLY_API=no\nVNC_SERVER_PASSWORD=myVncPassword\nTWOFA_TIMEOUT_ACTION=restart\nTWOFA_DEVICE=\nBYPASS_WARNING=\nAUTO_RESTART_TIME=11:59 PM\nAUTO_LOGOFF_TIME=\nTWS_COLD_RESTART=\nSAVE_TWS_SETTINGS=\nRELOGIN_AFTER_TWOFA_TIMEOUT=yes\nEXISTING_SESSION_DETECTED_ACTION=primary\nALLOW_BLIND_TRADING=no\nTIME_ZONE=Europe/Zurich\nCUSTOM_CONFIG=\nSSH_TUNNEL=\nSSH_OPTIONS=\nSSH_ALIVE_INTERVAL=\nSSH_ALIVE_COUNT=\nSSH_PASSPHRASE=\nSSH_REMOTE_PORT=\nSSH_USER_TUNNEL=\nSSH_RESTART=\nSSH_VNC_PORT=\n#START_SCRIPTS=init-scripts/start_scripts\n#X_SCRIPTS=init-scripts/x_scripts\n#IBC_SCRIPTS=init-scripts/ibc_scripts\n\n```\n\nOnce `docker-compose.yml` and `.env` are in place you can start the container with:\n\n```bash\ndocker compose up\n```\n\nTo get a GUI you can use vnc for ib-gateway or RDP for TWS.\n\nLooking for help? Please keep reading below, or go to\n[discussion](https://github.com/gnzsnz/ib-gateway-docker/discussions) section for common\nproblems and solutions. If you have problems please go through the [troubleshooting guide](https://github.com/gnzsnz/ib-gateway-docker/discussions/245)\n\n## Configuration\n\nAll environment variables are common between ibgateway and TWS image, unless specifically stated. The container can be configured with the following environment variables:\n\n| Variable | Description | Default |\n| --- | --- | --- |\n| `TWS_USERID`  | The TWS **username**. |   |\n| `TWS_PASSWORD` | The TWS **password**.  |   |\n| `TWS_PASSWORD_FILE` | The file containing TWS **password**. See [credentials section](#credentials). |   |\n| `TRADING_MODE` | **live** or **paper**. From `10.26.1k` it supports **both** which will start ib-gateway or TWS in live AND paper mode in parallel within the container. | **paper** |\n| `TWS_USERID_PAPER`  | If `TRADING_MODE=both`, then this is required to pass paper account user  | **not defined** |\n| `TWS_PASSWORD_PAPER` | If `TRADING_MODE=both`, then this is required to pass paper account password  | **not defined**  |\n| `TWS_PASSWORD_PAPER_FILE` | If `TRADING_MODE=both`, then this is required to pass paper account password. See [credentials section](#credentials).  | **not defined**  |\n| `READ_ONLY_API`  | **yes** or **no**. [See IBC documentation](https://github.com/IbcAlpha/IBC/blob/master/userguide.md)  | **not defined** |\n| `VNC_SERVER_PASSWORD`  | VNC server password. If not defined, then VNC server will NOT start. Specific to ibgateway, ignored by TWS. See [credentials section](#credentials). | **not defined** (VNC disabled) |\n| `VNC_SERVER_PASSWORD_FILE`  | VNC server password. If not defined, then VNC server will NOT start. Specific to ibgateway, ignored by TWS. | **not defined** (VNC disabled) |\n| `TWOFA_TIMEOUT_ACTION`      | 'exit' or 'restart', set to 'restart if you set `AUTO_RESTART_TIME`. See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/master/userguide.md#second-factor-authentication)  | exit  |\n| `TWOFA_DEVICE` | second factor authentication device. See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/c98d0bcc2ead9b8ab3900a23a707f01f8fd7dfbc/resources/config.ini#L104) | **not defined** |\n| `TWOFA_EXIT_INTERVAL` | It controls how long (in seconds) IBC waits for login to complete after the user acknowledges the second factor authentication. See [IBC documentation](https://github.com/IbcAlpha/IBC/blob/38593af5193ccd634aa226cc66242adc8718b653/resources/config.ini#L147) | 60 seconds |\n| `BYPASS_WARNING` | Settings relate to the corresponding 'Precautions' checkboxes in the API section of the Global Configuration dialog. Accepted values `yes`, `no` if not set, the existing TWS/Gateway configuration is unchanged  | **not defined**                                      |\n| `AUTO_RESTART_TIME`  | time to restart IB Gateway, does not require daily 2FA validation. format hh:mm AM/PM. See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/master/userguide.md#ibc-user-guide) | **not defined**  |\n| `AUTO_LOGOFF_TIME` | Auto-Logoff: at a specified time, TWS shuts down tidily, without restarting   | **not defined**   |\n| `TWS_COLD_RESTART` | IBC \u003e= 3.19 set this value to \u003chh:mm\u003e | **not defined** |\n| `SAVE_TWS_SETTINGS`  | automatically save its settings on a schedule of your choosing. You can specify one or more specific times, ex `SaveTwsSettingsAt=08:00   12:30 17:30`  | **not defined**  |\n| `RELOGIN_AFTER_TWOFA_TIMEOUT` | support relogin after timeout. See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/master/userguide.md#second-factor-authentication) | no  |\n| `EXISTING_SESSION_DETECTED_ACTION` | Set Existing Session Detected Action. See IBC [documentation](https://github.com/gnzsnz/ib-gateway-docker/blob/master/latest/config/ibc/config.ini.tmpl#L296-L329) | primary |\n| `ALLOW_BLIND_TRADING` | TWS displays a dialog to warn you against blind trading.See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/c98d0bcc2ead9b8ab3900a23a707f01f8fd7dfbc/resources/config.ini#L702)| no |\n| `TIME_ZONE`  | Support for timezone, see your TWS jts.ini file for [valid values](https://ibkrguides.com/tws/usersguidebook/configuretws/configgeneral.htm) on a [tz database](https://en.wikipedia.org/wiki/List_of_tz_database_time_zones). This sets time zone for IB Gateway. If jts.ini exists it will not be set. if `TWS_SETTINGS_PATH` is set and stored in a volume, jts.ini will already exists so this will not be used. Examples `Europe/Paris`, `America/New_York`, `Asia/Tokyo` | \"Etc/UTC\"  |\n| `TWS_SETTINGS_PATH` | Settings path used by IBC's parameter `--tws_settings_path`. Use with a volume to preserve settings in the volume. If `TRADING_MODE=both` this will be the prefix four your settings. ex `/config/tws_settings_live` and `/config/tws_settings_paper`. |  |\n| `TWS_ACCEPT_INCOMING` | See IBC documentation, possible values `accept`, `reject`, `manual` | `manual` |\n| `TWS_MASTER_CLIENT_ID` | See IBC [documentation](https://github.com/IbcAlpha/IBC/blob/b866a263afec948c70352ce077e1560f3ad2b152/resources/config.ini#L349) | **not defined** |\n| `CUSTOM_CONFIG` | If set to `yes`, then `run.sh` will not generate config files using env variables. You should mount config files. Use with care and only if you know what you are doing. | NO |\n| `JAVA_HEAP_SIZE` | Set Java heap, default 768MB, TWS might need more. Proposed value 1024. Enter just the number, don't enter units, ex mb. See [Increase Memory Size for TWS](https://ibkrguides.com/tws/usersguidebook/priceriskanalytics/custommemory.htm) | **not defined**  |\n| `SSH_TUNNEL` | If set to `yes` then `socat` won't start, instead a remote ssh tunnel is started. if set to `both` then `socat` AND remote ssh tunnel are started. SSH keys should be provided to container through ~/.ssh volume.  | **not defined**                                      |\n| `SSH_OPTIONS` | additional options for [ssh](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html) client | **not defined** |\n| `SSH_ALIVE_INTERVAL`   | [ssh](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html) `ServerAliveInterval` setting. Don't set it in `SSH_OPTIONS` as this behavior is undefined. | 20   |\n| `SSH_ALIVE_COUNT`  | [ssh](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html) `ServerAliveCountMax` setting. Don't set it in `SSH_OPTIONS` as this behavior is undefined. | **not defined** |\n| `SSH_PASSPHRASE`   | passphrase for ssh keys. If set the container will start ssh-agent and add ssh keys   | **not defined**   |\n| `SSH_PASSPHRASE_FILE`   | file containing passphrase for ssh keys. If set the container will start ssh-agent and add ssh keys   | **not defined**   |\n| `SSH_REMOTE_PORT`   | Remote port for ssh tunnel. If `TRADING_MODE=both` then `SSH_REMOTE_PORT` is set to paper port `4002/7498`  | Same port than IB gateway `4001/4002` or `7497/7498` |\n| `SSH_USER_TUNNEL`   | `user@server` to connect to    | **not defined**   |\n| `SSH_RESTART`  | Number of seconds to wait before restarting tunnel in case of disconnection.  | 5  |\n| `SSH_VNC_PORT`   | If set, then a remote ssh tunnel will be created with remote port equal to `SSH_VNC_PORT`. Specific to ibgateway, ignored by TWS.  | **not defined**   |\n| `SSH_RDP_PORT`  | If set, then a remote ssh tunnel will be created with remote port equal to `SSH_RDP_PORT`. Specific to TWS, ignored by ibgateway.  | **not defined** |\n| `PUID` | User `uid` for user `abc` (linuxserver default user name). Specific to TWS, ignored by ibgateway. | 1000   |\n| `PGID` | User `gid` for user `abc` (linuxserver default user name). Specific to TWS, ignored by ibgateway.  | 1000   |\n| `PASSWD` | Password for user `abc` (linuxserver default user name). Specific to TWS, ignored by ibgateway. | abc  |\n| `PASSWD_FILE` | File containing password for user `abc` (linuxserver default user name). Specific to TWS, ignored by ibgateway. See [credentials section](#credentials). | abc  |\n| `START_SCRIPTS` | Directory with bash scripts to run **before** X environment is up. See [start-up scripts](#start-up-scripts) | **not defined** |\n| `X_SCRIPTS` | Directory with bash scripts to run **after** X environment is running. See [start-up scripts](#start-up-scripts) | **not defined** |\n| `IBC_SCRIPTS` | Directory with bash scripts to run **after** IBC is running. See [start-up scripts](#start-up-scripts) | **not defined** |\n\n## Ports\n\nThe following ports will be ready for usage on the ib-gateway container and docker host:\n\n| Port | Description  |\n| ---- | ---- |\n| 4003 | TWS API port for live accounts. Through socat, internal TWS API port 4001. Mapped **externally** to 4001 in sample `docker-compose.yml`.  |\n| 4004 | TWS API port for paper accounts. Through socat, internal TWS API port 4002. Mapped **externally** to 4002 in sample `docker-compose.yml`. |\n| 5900 | When `VNC_SERVER_PASSWORD` was defined, the VNC server port. |\n\nTWS image uses the following ports\n\n| Port | Description   |\n| ---- | --- |\n| 7498 | TWS API port for live accounts. Through socat, internal TWS API port 7496. Mapped **externally** to 7496 in sample `tws-docker-compose.yml`.  |\n| 7499 | TWS API port for paper accounts. Through socat, internal TWS API port 7497. Mapped **externally** to 7497 in sample `tws-docker-compose.yml`. |\n| 3389 | Port for RDP server. Mapped **externally** to 3370 in sample `tws-docker-compose.yml`.  |\n\nUtility [socat](https://manpages.ubuntu.com/manpages/noble/en/man1/socat.1.html) is used to publish TWS API port from container's `127.0.0.1:4001/4002` to container's `0.0.0.0:4003/4004`, the sample `docker-file.yml` maps ports to the host back to `4001/4002`. This way any application can use the \"standard\" IB Gateway ports. For TWS `127.0.0.1:7496/7497` to container's `0.0.0.0:7498/7499`, and `tws-docker-file.yml` will map ports to host back to `7496/7497`.\n\nNote that with the above `docker-compose.yml`, ports are only exposed to the docker host (127.0.0.1), but not to the host network. To expose it to the host network change the port mappings on accordingly (remove the '127.0.0.1:'). **Attention**: See [Leaving localhost](#leaving-localhost)\n\n## Using TWS\n\nFrom `10.26.1h` it's possible to run TWS in a container. [tws-rdesktop](https://github.com/gnzsnz/ib-gateway-docker/pkgs/container/tws-rdesktop) image provides a desktop environment that allows to use TWS.\n\n### Performance considerations for TWS\n\n[tws-rdesktop](https://github.com/gnzsnz/ib-gateway-docker/pkgs/container/tws-rdesktop) has the following recomended settings.\n\nIn [tws-docker-compose.yml](https://github.com/gnzsnz/ib-gateway-docker/blob/master/tws-docker-compose.yml):\n\n- set `/dev/dri:/dev/dri`\n- shm_size: \"1gb\"\n- `seccomp:unconfined`\n- `JAVA_HEAP_SIZE`, depending your TWS you might need to increase it. See [Increase Memory Size for TWS](https://ibkrguides.com/tws/usersguidebook/priceriskanalytics/custommemory.htm)\n- Volumes, set a volume for `/tmp`. ex `tws_tmp:/tmp`\n- Volumes, set a volumen for `/config`\n\nThe start up script will disable xfce compositing, as this has a significant impact on performance.\n\n## Customizing the image\n\nMost if not all of the settings needed to run IB Gateway in a container are available as environment variables.\n\nHowever, if you need to go beyond what's available, the image can be customized by overwriting the default configuration files with custom ones. To do this you must set environment variable `CUSTOM_CONFIG=yes`. By setting `CUSTOM_CONFIG=yes` `run.sh` script will not replace environment variables on config files. You must provide config files ready to be used by IB gateway/TWS and IBC, please make sure that you are familiar with [IBC](https://github.com/IbcAlpha/IBC/blob/master/userguide.md) settings.\n\nImage IB Gateway and IBC config file locations:\n\n| App  | Config file  | Default  |\n| --- | --- | --- |\n| IB Gateway | /home/ibgateway/Jts/jts.ini    | [jts.ini](https://github.com/gnzsnz/ib-gateway-docker/blob/master/image-files/config/ibgateway/jts.ini.tmpl) |\n| IBC  | /home/ibgateway/ibc/config.ini | [config.ini](https://github.com/gnzsnz/ib-gateway-docker/blob/master/image-files/config/ibc/config.ini.tmpl) |\n\nFor TWS image config file locations are:\n\n| App | Config file  | Default  |\n| --- | --- | --- |\n| TWS | /opt/ibkr/jts.ini   | [jts.ini](https://github.com/gnzsnz/ib-gateway-docker/blob/master/image-files/config/ibgateway/jts.ini.tmpl) |\n| IBC | /opt/ibc/config.ini | [config.ini](https://github.com/gnzsnz/ib-gateway-docker/blob/master/image-files/config/ibc/config.ini.tmpl) |\n\nSample settings:\n\n```yaml\n...\n    environment:\n      - CUSTOM_CONFIG: yes\n...\n    volumes:\n      - ${PWD}/config.ini:/home/ibgateway/ibc/config.ini\n      - ${PWD}/jts.ini:/home/ibgateway/Jts/jts.ini # for IB Gateway\n      - ${PWD}/jts.ini:/opt/ibkr/jts.ini # for TWS\n      - ${PWD}/config.ini:/opt/ibc/config.ini # for TWS\n...\n```\n\n### Preserve settings across containers\n\nYou can preserve IB Gateway configuration by setting environment variable\n`$TWS_SETTINGS_PATH` and setting a volume\n\n```yaml\n...\n    environment:\n      - TWS_SETTINGS_PATH: /home/ibgateway/tws_settings # IB Gateway\n      - TWS_SETTINGS_PATH: /config/tws_settings # tws rdesktop\n...\n    volumes:\n      - ${PWD}/tws_settings:/home/ibgateway/tws_settings # IB Gateway\n      - ${PWD}/config:/config # for TWS we use linuxserver /config volume\n...\n\n```\n\nFor TWS it's recommended to use `TWS_SETTINGS_PATH`, as there is a good amount\nof data written to disk.\n\n**Important**: when you save your config in a volume, file `jts.ini` will be\nsaved. `TIME_ZONE` will only be applied to `jts.ini` if the file does not\nexists (first run) but not once the file exists. This is to avoid overwriting\nyour settings.\n\n## Start-up scripts\n\nYou can run scripts during start up to automate tasks or install additional\ntools. This can be done by setting environment variables `START_SCRIPTS`,\n`X_SCRIPTS` and `IBC_SCRIPTS` with a path containing start-up scripts.\nScripts files should have `.sh` extension. Files will be executed in\norder, so `00-script.sh` will be executed before that `99-other-script.sh`.\nStart-up directory should be available in the container through a volume.\n\nFor example for `ibgateway`:\n\n```bash\n# .env file\nSTART_SCRIPTS=init-scripts/start_scripts\nX_SCRIPTS=init-scripts/x_scripts\nIBC_SCRIPTS=init-scripts/ibc_scripts\n```\n\nand a volume in `docker-compose.yml`\n\n```yaml\n  volume:\n    - ${PWD}/init-scripts:/home/ibgateway/init-scripts\n```\n\nFor TWS you can set your `.env` file as in the example and create a directory\nwith your scripts in `/config/init-scripts/`. In TWS `$HOME=/config/`, while\nib-gateway uses `$HOME=/home/ibgateway`.\n\nThe start up process will search for start-up scripts in `$HOME/START_SCRIPTS`,\n`$HOME/X_SCRIPTS` and `$HOME/IBC_SCRIPTS`.\n\nScripts in directory `$HOME/START_SCRIPTS` will run before the X environment is\nup. Scripts in `$HOME/X_SCRIPTS` will run once X environment is up, and\n`$HOME/IBC_SCRIPTS` once IBC runs. Take into account that scripts will run as\nsoon as possible, so you might need to wait for X environment to be fully up or\nIBC to complete ibgateway/TWS start-up process.\n\n## Security Considerations\n\n### Leaving localhost\n\nThe IB API protocol is based on an unencrypted, unauthenticated, raw TCP socket\nconnection between a client and the IB Gateway. If the port to IB API is open\nto the network, every device on it (including potential rogue devices) can access\nyour IB account via the IB Gateway.\n\nBecause of this, the default `docker-compose.yml` only exposes the IB API port\nto the **localhost** on the docker host, but not to the whole network.\n\nIf you want to connect to IB Gateway from a remote device, consider adding an\nadditional layer of security (e.g. TLS/SSL or SSH tunnel) to protect the\n'plain text' TCP sockets against unauthorized access or manipulation.\n\n#### Possible IB API port configurations\n\nSome examples of possible configurations\n\n- Available to `localhost`, this is the default setup provided in [docker-compose.yml](https://github.com/gnzsnz/ib-gateway-docker/blob/master/docker-compose.yml).\nSuitable for testing. It does not expose API port to host network, host must be trusted.\n- Available to the host network. Unsecure configuration, suitable for short\n  tests in a secure network. **Not recommended**.\n\n  ```yaml\n  ports:\n    - \"4001:4003\"\n    - \"4002:4004\"\n    - \"5900:5900\"\n  ```\n\n- Available for other services in same docker network. Services with access to\n  `trader` network can access IB Gateway through hostname `ib-gateway` (same\n  than service name). Secure setup, although host should be trusted.\n\n  ```yaml\n  services:\n    ib-gateway:\n      networks:\n        - trader\n  #    ports: # commented out\n  #      - \"4001:4003\"\n  #      - \"4002:4004\"\n  #      - \"5900:5900\"\n  networks:\n    trader:\n  ```\n\n- SSH Tunnel, enable ssh tunnel as explained in [ssh tunnel](#ssh-tunnel)\n  section. This will only make IB API port available through a secure SSH\n  tunnel. Secure option if utilized correctly.\n\n### SSH Tunnel\n\nYou can optionally setup an SSH tunnel to avoid exposing IB Gateway port. The\ncontainer DOES NOT run an SSH server (sshd), what it does is to create a\n[remote tunnel](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html)\nusing ssh client. So basically it will connect to an ssh server and expose IB\nGateway port there.\n\nAn example setup would be to run\n[ib-gateway-docker](https://github.com/gnzsnz/ib-gateway-docker) with a\nsidecar [ssh bastion](https://github.com/gnzsnz/docker-bastion) and a\n[jupyter-quant](https://github.com/gnzsnz/jupyter-quant), which provides a\nfully working algorithmic trading environment. In simple terms ib gateway opens\na **remote** port on ssh bastion and listen to connections on it. While\n[jupyter-quant](https://github.com/gnzsnz/jupyter-quant) will open a **local**\nport that is tunneled into bastion on the same port opened by\nib-gateway-docker. This combination of tunnels will expose IB API port into\n[jupyter-quant](https://github.com/gnzsnz/jupyter-quant) making it available\nfor use with [ib_insync](https://github.com/erdewit/ib_insync). The only port\navailable to the outside world is the\n[ssh bastion](https://github.com/gnzsnz/docker-bastion) port, which has hardened\nsecurity defaults and cryptographic key authentication.\n\nSample ssh tunnels for reference.\n\n```bash\n# on ib gateway - this is managed by the container\nssh -NR 4001:localhost:4001 ibgateway@bastion\n# on juypter-quant container.\neval $(ssh-agent) # start agent\nssh-add # add keys to agent\n#  -f will send it to foreground\nssh -o ServerAliveInterval=20 -o ServerAliveCountMax=3 -fNL 4001:localhost:4001 jupyter@bastion\n# on desktop connect to VNC\nssh -o ServerAliveInterval=20 -o ServerAliveCountMax=3 -NL 5900:localhost:5900 trader@bastion\n```\n\nIt would look like this\n\n```text\n       _____________\n      |  IB Gateway | \\   :4001\n       -------------  |\n                      |\n      _____________   |\n      | SSH Bastion | /   :4001\n      -------------   \\\n                       |\n                       |\n      _______________  |\n     | Jupyter Quant |/  :4001\n      ---------------\n```\n\n`ib-gateway-docker` is using `ServerAliveInterval` and `ServerAliveCountMax`\nssh settings to keep the tunnel open. Additionally it will restart the tunnel\nautomatically if it's stopped, and will keep trying to restart it.\n\n**Minimal ssh tunnel setup**:\n\n- `SSH_TUNNEL`: set it to `yes`. This will NOT start `socat` and only start an\n  ssh tunnel.\n- `SSH_USER_TUNNEL`: The user name that ssh should use. It should be in the\n  form `user@server`\n- `SSH_PASSPHRASE`: Not mandatory, but strongly recommended. If set it will\n  start `ssh-agent` and add ssh keys to agent. `ssh` will use `ssh-agent`.\n\nIn addition to the environment variables listed above you need to pass ssh keys\nto `ib-gateway-docker` container. This is achieved through a volume mount\n\n```yaml\n...\n    volumes:\n      - ${PWD}/ssh:/home/ibgateway/.ssh # IB Gateway\n      - ${PWD}/config/ssh:/config/.ssh # TWS\n...\n```\n\nTWS image will search ssh keys on `HOME` directory, so store keys on `/config/.ssh`\n\nMake sure that:\n\n- you copy ssh keys with a standard name, ex ~/.ssh/id_rsa, ~/.ssh/id_ecdsa,\n  ~/.ssh/id_ecdsa_sk, ~/.ssh/id_ed25519, ~/.ssh/id_ed25519_sk, or ~/.ssh/id_dsa\n- keys should have proper permissions. ex `chmod 600 -R $PWD/ssh/*`\n- you would need a `$PWD/ssh/known_hosts` file. Or pass `SSH_OPTIONS=-o\n  StrictHostKeyChecking=no`, although this last option is **NOT recommended**\n  for a production environment.\n- and please make sure that you are familiar with\n  [ssh tunnels](https://manpages.ubuntu.com/manpages/noble/en/man1/ssh.1.html)\n\n### Credentials\n\nThis image does not contain nor store any user credentials.\n\nThey are provided as environment variable during the container startup and\nthe host is responsible to properly protect it.\n\nFrom `10.29.1e` and `10.19.2m` it's possible to use `docker secrets`. If the\n`_FILE` environment variable is defined, then that file will be used to get\ncredentials.\n\nSample `docker-compose.yml`:\n\n```yml\nname: algo-trader\nservices:\n  ib-gateway:\n  ...\n  environment:\n    ...\n    TWS_PASSWORD_FILE: /run/secrets/tws_password\n    SSH_PASSPHRASE_FILE: /run/secrets/ssh_passphrase\n    VNC_SERVER_PASSWORD_FILE: /run/secrets/vnc_password\n    ...\n  secrets:\n    - tws_password\n    - ssh_passphrase\n    - vnc_password\n  ...\nsecrets:\n  tws_password:\n    file: tws_password.txt\n  ssh_passphrase:\n    file: ssh_password.txt\n  vnc_password:\n    file: vnc_password.txt\n\n```\n\nIn \"discussion\" section you will find full examples for [ib-gateway](https://github.com/gnzsnz/ib-gateway-docker/discussions/103) and [tws-rdesktop](https://github.com/gnzsnz/ib-gateway-docker/discussions/105)\n\n### RDP\n\n[tws-rdesktop][2] will create a new TLS certificate every time the container\nstarts. You can create your own certificate following this\n[instructions](https://github.com/gnzsnz/ib-gateway-docker/discussions/104).\nOnce this steps are put in place the same TLS certificate will be used every\ntime, which will allow you to trust it in your RDP client.\n\n## Troubleshooting socat and ssh\n\nIn case you experience problems with the API connection, you can restart the `socat` process\n\n```bash\ndocker exec -it algo-trader-ib-gateway-1 pkill -x socat\n```\n\nAfter `SSH_RESTART` seconds socat will restart the connection. If `SSH_RESTART`\nis not set, by default the restart period will be 5 seconds.\n\nFor ssh tunnel,\n\n```bash\ndocker exec -it algo-trader-ib-gateway-1 pkill -x ssh\n```\n\nThe ssh tunnel will restart after 5 seconds if `SSH_RESTART` is not set, or the\nvalue in seconds defined in `SSH_RESTART`.\n\n## aarch64 support\n\nThis is experimental, so expects bugs.\n\nPlease go to discussions section to see common problems. Avoid creating issues unless\nyou have empirically probed that is a bug, ie it does not work to me is not a bug.\n\nTo use aarch64 you just need to run:\n\n```bash\n# ib-gateway\ndocker compose up\n\n# TWS\ndocker compose -f tws-docker-compose.yml up\n```\n\nThis will pull the right image for aarch64 architecture.\n\n## IB Gateway installation files\n\nNote that the\n[Dockerfile](https://github.com/gnzsnz/ib-gateway-docker/blob/master/Dockerfile)\n**does not download IB Gateway installer files from IB homepage but from the\n[github-releases](https://github.com/gnzsnz/ib-gateway-docker/releases) of this\nproject**.\n\nThis is because it shall be possible to (re-)build the image, targeting a\nspecific Gateway version,\nbut IB only provide download links for the `latest` or `stable` version (there\nis no 'old version' download archive).\n\nThe installer files stored on\n[releases](https://github.com/gnzsnz/ib-gateway-docker/releases) have been\ndownloaded from IB homepage and renamed to reflect the version.\n\nIF you feel adventurous and you want to download Gateway installer from IB\nhomepage directly, or use your local installation file, change this line\non [Dockerfile](https://github.com/gnzsnz/ib-gateway-docker/blob/master/Dockerfile)\n`RUN curl -sSL\nhttps://github.com/gnzsnz/ib-gateway-docker/raw/gh-pages/ibgateway-releases/ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh\n--output ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh` to download\n(or copy) the file from the source you prefer.\n\n**Example:** change to `RUN curl -sSL https://download2.interactivebrokers.com/installers/ibgateway/stable-standalone/ibgateway-stable-standalone-linux-x64.sh --output ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh` for using current stable version from IB homepage.\n\n### How to build locally step by step\n\n1. Clone this repo\n\n    ```bash\n      git clone https://github.com/gnzsnz/ib-gateway-docker\n    ```\n\n1. Change docker file to use your local IB Gateway installer file, instead of\n   Loading it from this project releases: Open `Dockerfile` on editor and\n   replace this lines:\n\n   ```docker\n   RUN curl -sSL https://github.com/gnzsnz/ib-gateway-docker/raw/gh-pages/ibgateway-releases/ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh \\\n       --output ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh\n   RUN curl -sSL https://github.com/gnzsnz/ib-gateway-docker/raw/gh-pages/ibgateway-releases/ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh.sha256 \\\n       --output ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh.sha256\n   ```\n\n   with\n\n   ```docker\n   COPY ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh\n   ```\n\n1. Remove `RUN sha256sum --check\n   ./ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh.sha256` from\n   Dockerfile (unless you want to keep checksum-check)\n1. Download IB Gateway and name the file\n   `ibgateway-${IB_GATEWAY_VERSION}-standalone-linux-x64.sh`, where\n   `{IB_GATEWAY_VERSION}` must match the version as configured on Dockerfile\n   (first line)\n1. Download IBC and name the file `IBCLinux-3.23.0.zip`, where\n   `{IBC_VERSION}` must match the version as configured on Dockerfile\n1. Build and run: `docker-compose up --build`\n\n[1]: https://github.com/users/gnzsnz/packages/container/package/ib-gateway \"ib-gateway\"\n[2]: https://github.com/gnzsnz/ib-gateway-docker/pkgs/container/tws-rdesktop \"tws-rdesktop\"\n\n## Repo stats\n\nRepository stars overtime.\n\n[![Stargazers over time](https://starchart.cc/gnzsnz/ib-gateway-docker.svg?variant=adaptive)](https://starchart.cc/gnzsnz/ib-gateway-docker)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgnzsnz%2Fib-gateway-docker","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgnzsnz%2Fib-gateway-docker","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgnzsnz%2Fib-gateway-docker/lists"}