One container gives you the full dashboard, the SABnzbd/NZBGet API for Sonarr & Radarr, and the built-in indexer. Search, download, map three folders, done.
nzbfast runs on DSM 7 as a Docker container through Container Manager (on DSM 6 the same app is called Docker). The image is multi-arch, so it runs unchanged on both Intel and ARM Synology models.
nzbfast/nzbfast (the one Container Manager can search) and on GitHub as
ghcr.io/nzbfast/nzbfast. Use whichever you like. This guide uses the Docker Hub name.The container writes downloads as a specific user ID so the files belong to you, not to root. Find yours once:
Control Panel → Terminal & SNMP → tick Enable SSH service.
SSH in and run:
id your_dsm_username
Note the uid= and gid= numbers. On most Synology boxes the first user
is uid=1026 and the group users is gid=100, but use whatever
id prints. You can turn SSH back off afterwards.
One file you can back up, re-use, and update with a single click. This is the route to take if you want nzbfast to keep itself up to date.
docker-compose.yml,
upload it into a folder on your NAS with File Station (e.g. /docker/nzbfast), edit the three
values at the top, and create a Project pointing at that folder. The steps below are the same thing
done by hand.File Station → make the project folder, e.g. /docker/nzbfast. Then Container Manager →
Project → Create, name it nzbfast, path /docker/nzbfast,
source Create docker-compose.yml.
services:
nzbfast:
image: nzbfast/nzbfast:latest
container_name: nzbfast
restart: unless-stopped
ports:
- "6789:6789"
environment:
- PUID=1026 # your uid (id your_dsm_username)
- PGID=100 # your gid
- TZ=Europe/London # your timezone
# - NZBFAST_APIKEY=change-me # only if you'll connect Sonarr/Radarr
volumes:
- ./config:/config # settings + index database
- ./downloads:/downloads # finished files - change this line if you
# also run Sonarr or Radarr, see below
- ./watch:/watch # drop an .nzb here to auto-download
# Takes away powers the container has by default and does not use.
# The five it does need are added back by name: without them it
# cannot hand your folders to your DSM user and will not start.
cap_drop: [ALL]
cap_add: [CHOWN, DAC_OVERRIDE, FOWNER, SETGID, SETUID]
security_opt: [no-new-privileges:true]
# Optional: checks nightly for a newer nzbfast image and recreates
# the container when one ships. Needs the Docker socket; delete this
# service to update by hand, or on a DSM schedule instead.
watchtower:
image: nickfedor/watchtower
container_name: nzbfast-watchtower
restart: unless-stopped
environment:
- TZ=Europe/London # same timezone, so the schedule below is your 04:00
volumes:
- /var/run/docker.sock:/var/run/docker.sock
command: --cleanup --schedule "0 0 4 * * *" nzbfast # daily 04:00, nzbfast only
The ./config, ./downloads and ./watch folders are
created for you inside the project folder.
Container Manager pulls the images and starts them. Then jump to First run below.
/var/run/docker.sock gives that
container root-equivalent control of your NAS, so it is a real trade: convenience against handing one
container broad power. If you would rather not make it, delete the watchtower block and take
the scheduled-task route below instead. It is scoped to the nzbfast container by the name at
the end of the command line, so it will never touch your other containers.DSM can do the same job on a schedule, and nothing needs the socket mounted. Delete
the watchtower service from the compose file, then:
Control Panel → Task Scheduler → Create → Scheduled Task →
User-defined script. Name it something like nzbfast update and set
User to root, which Docker commands need. Schedule it daily, at a quiet hour.
cd /volume1/docker/nzbfast && docker compose pull && docker compose up -d
Adjust the path to your project folder. On DSM 7.1 and older the command is
docker-compose (with the hyphen) rather than docker compose.
The trade here runs the other way: the task itself runs as root, but nothing gains standing access to the Docker socket, and you can read exactly what it does.
No text files at all. The trade-off: a container built this way cannot auto-update, because Container Manager's volume picker only browses shared folders and so cannot mount the Docker socket that Watchtower needs. You update it by hand, a few clicks each release.
File Station → create a shared folder or sub-tree for the container's data, e.g.:
/docker/nzbfast/config | settings + index database |
/docker/nzbfast/downloads | finished files land here (but see Sonarr and Radarr if you run them) |
/docker/nzbfast/watch | drop an .nzb here to auto-download it |
Container Manager → Registry → search nzbfast → select
nzbfast/nzbfast → Download → tag latest.
Container Manager → Image → select nzbfast/nzbfast:latest → Run. In the wizard:
| Folder (on your NAS) | Mount path |
|---|---|
/docker/nzbfast/config | /config |
/docker/nzbfast/downloads | /downloads |
/docker/nzbfast/watch | /watch |
| Variable | Value |
|---|---|
PUID | your uid (e.g. 1026) |
PGID | your gid (e.g. 100) |
TZ | your timezone, e.g. Europe/London |
Then jump to First run below.
There is no config file to edit. Open http://YOUR_NAS_IP:6789.
A Welcome panel asks for your Usenet server. Enter the host, username, password and connection
count from your provider's welcome email and save. It applies immediately, no restart. Drop an
.nzb on the dashboard (or into the watch folder) and it downloads.
Skip this if you do not run them. If you do, it decides whether every import is instant or is a full copy of a 5-50 GB release, and on NAS hardware a copy is the slowest thing in the chain.
An arr imports by renaming the files into your library when downloads and library
share a filesystem, and by copying then deleting when they do not. Docker decides that more
bluntly than the disk does: two separate mounts look like two filesystems to a container even when
one volume sits underneath. On a DiskStation /docker and your media share are
different shared folders by construction, so the folders above produce the copy case by default.
Put both under one shared folder instead. If your library lives in a shared folder called
data:
/volume1/data/usenet | nzbfast downloads here |
/volume1/data/media | your Sonarr/Radarr library |
Mount it into nzbfast at the same path on both sides - in the compose file,
- /volume1/data/usenet:/volume1/data/usenet in place of the downloads line, plus
- NZBFAST_OUT=/volume1/data/usenet under environment:.
Give nzbfast usenet only, not the whole data folder - it has no
business in your library, and the rename still works because it is your *arr that moves the files
and it sees both sides. There is no incomplete folder to make: SABnzbd needs one
because it writes there and moves everything when a job finishes, while nzbfast writes at the final
path from the first article on. A SAB migrant has two filesystem boundaries to get right here and
you have exactly one. TRaSH keep a DSM-specific guide too:
trash-guides.info.
nzbfast speaks the SABnzbd API. In your *arr app, add a SABnzbd download client:
Host = your NAS IP, Port = 6789, API Key = the value you set in
NZBFAST_APIKEY. It also exposes the NZBGet JSON-RPC API for NZBGet remotes such as
LunaSea; nzb360 connects with the same SABnzbd settings as the *arrs.
The image is the update channel: nzbfast in a container never swaps its own binary,
you move it forward by pulling a newer image. Your config and downloads survive,
because they live in your NAS folders and not inside the container.
watchtower service: nothing to do.
It checks nightly at 04:00 and recreates the container when a new version ships.nzbfast → Stop,
then Build (this re-pulls latest), then Start.latest tag,
then Container → stop nzbfast → Action → Reset to recreate it on the new image.nzbfast/nzbfast:latest. If it is pinned to a version, say :1.0.3, then neither
Watchtower nor a re-pull will ever move it: both fetch the tag the container was created with. Container
Manager → Container → Details shows which one you have.nzbfast → Details → the Log tab. The Log page in DSM's
left-hand menu is a different thing, recording who pressed start and stop, and will never show why a
container died. Over SSH: sudo docker logs --tail 50 nzbfast. A container that quits a
second or two after starting, repeatedly, is usually refusing on purpose rather than crashing, and the
log says which case it is.PUID/PGID don't match
the folder owner. Re-check with id your_dsm_username. This is the most common issue.6889:6789) and browse to :6889.nzbfast/nzbfast.latest tag rather than a pinned
version, and that the schedule ran in your timezone (set TZ on the watchtower service, or
0 0 4 * * * means 04:00 UTC). sudo docker logs nzbfast-watchtower shows its next run.