Shell-Eggs.siteShell-Eggs Docs · Configuration
Startup variables
The complete table from egg-shell-multi.json - 24 variables, every one with a working default. SHELL_USERS (the login users) is mandatory in practice; auto password slots generate crypto-random secrets that are shown once and persisted mode-600.
| Variable | Name | Description | Default |
|---|---|---|---|
SHELL_TYPEoptional | Shell Type | Which shell(s) to run. 'auto' opens an interactive paginated picker in the console on first boot. Otherwise a comma-separated list of ids: | auto |
SHELL_USERSrequired | Shell Usernames | MANDATORY in practice: comma-separated login users created inside the container (e.g. 'alice,bob'). Each gets a private home + bash. Invalid names are skipped with a warning. | empty |
SHELL_PASSWORDSoptional | Shell User Passwords | Positionally matched to Shell Usernames ('S3cretA,S3cretB'). Empty or 'auto' slots generate cryptographically random secrets (recorded in .env and .sh-users/credentials, mode 600, shown once in console). | auto |
SHELL_EXTRA_TYPESoptional | Extra Shell Types | OPTIONAL: additional shell ids to run alongside the primary (same catalog as Shell Type). Example: 'socat,tmux' to also run a socat reverse shell and a tmux session. | empty |
SHELL_EXTRA_PORTSoptional | Extra Ports | OPTIONAL: comma-separated extra panel ports for additional PORTED shells (the primary shell always binds this server's default port). Positionally matched to Extra Shell Types order. Reverse shells and multiplexers need no port. | empty |
SHELL_REVERSE_HOSToptional | Reverse Target Host | OPTIONAL: where reverse shells connect OUT to (your public IP / listener host). Required only when running reverse shells. | empty |
SHELL_REVERSE_PORToptional | Reverse Target Port | OPTIONAL: port of your listener (nc -lvnp). Default 4444. | 4444 |
SHELL_REVERSE_TLSoptional | TLS Reverse Shells | OPTIONAL: 1 = TLS-capable reverse profiles (ncat, socat) wrap the channel with TLS when both sides support it. | 0 |
SHELL_SSH_PUBKEY_RAWoptional | SSH Public Key | OPTIONAL: your public key (one line, e.g. ssh-ed25519 AAAA... comment). Installed into authorized_keys; the ONLY way in for the ssh-hardened profile. | empty |
SHELL_SSH_PASSWORD_AUTHoptional | SSH Password Auth | OPTIONAL: yes/no for the standard ssh + ssh-cert profiles (ssh-hardened is always keys-only). | yes |
SHELL_MOSH_UDP_STARToptional | MOSH UDP Start Port | OPTIONAL: first UDP port for Mosh roaming (opens SHELL_MOSH_UDP_COUNT ports downward range). Default 60000. | 60000 |
SHELL_WEB_USERoptional | Web Shell User | OPTIONAL: basic-auth user for ttyd/gotty web terminals (password below). Empty = first generated credential is used. | empty |
SHELL_WEB_PASSoptional | Web Shell Password | OPTIONAL: basic-auth password for ttyd/gotty. | empty |
SHELL_WEB_TOKENoptional | Web Shell Token | OPTIONAL: bearer token for php/node web shells (auto-generated when empty, shown once in console). | empty |
SHELL_MOTDoptional | MOTD Banner | OPTIONAL: message shown on every shell login. | Welcome to the Multi-Shell Universal Egg (Pot... |
SHELL_MUX_SESSIONoptional | Multiplexer Session Name | OPTIONAL: tmux/screen session name. Default 'shell-eggs'. | shell-eggs |
DEFAULT_SHELL_MUXoptional | Default Login Multiplexer | OPTIONAL: tmux|screen - drop SSH/Telnet logins straight into the persistent session. | empty |
SHELL_SHOW_CREDENTIALSoptional | Show Credentials in Console | OPTIONAL: 1 = print generated credentials on the boot console (they are always written to .env and .sh-users/credentials, mode 600). | 1 |
AUTO_GENERATE_CREDENTIALSoptional | Auto Generate Credentials | 1 = generate crypto-random secrets for empty/'auto' password slots and persist them. Credentials are the one mandatory input of this egg - everything else is optional. | 1 |
PANEL_STOP_WATCHERoptional | Panel Stop Watcher | Watch console stdin for stop commands ('stop', '^C', 'exit', ...) delivered as text by TTY daemons. auto = on for all consoles; 0 = disable; 1 = force on. | auto |
CLI_THEMEoptional | Console Theme | Console output style. 'sh' = agent theme (</> shell-eggs prefixes); 'classic' = [PotenFYR] bracket style. | sh |
CLI_BANNER_GRADIENToptional | Banner Gradient | Boot banner gradient: auto (random per boot), aurora, candy, citrus, forest, sunset, ocean, or none. | auto |
EGG_UPDATE_URLoptional | Egg Update URL | Check on startup and self-update the launcher when the upstream egg changed (raw GitHub egg JSON or entrypoint URL). | https://raw.githubusercontent.com/PotenFYR-St... |
AUTO_UPDATE_EGGoptional | Auto Update Egg | 1 = check EGG_UPDATE_URL on startup and self-update. 0 = disable the check entirely. | 1 |
Port pairing rule: the primary ported shell binds the panel port (SERVER_PORT); extra ported shells consume SHELL_EXTRA_PORTS positionally in the order of SHELL_EXTRA_TYPES. Reverse shells and multiplexers never need an inbound port. See the install guide for the panel allocation walkthrough.