cobalt

Save videos, audio and pictures from the web. No ads, no trackers.

  • ghcr.io/hsinghhira/cobalt:latest
  • port 6144
  • Media
cobalt screenshot 1: Paste a link and save

Web App

/
http://localhost:6144/

cobalt saves what you love from the web. Paste a link from YouTube, TikTok, Instagram, Reddit, SoundCloud, Bluesky and many more sites, and get the file. No ads, no trackers, no paywalls. This is the official cobalt API and the official cobalt web app in a single container, with one port and one data folder.

Features

  • Saves video, audio and pictures from dozens of sites
  • Pick video, audio only or muted video, plus quality and format in the settings
  • Nothing is stored: files stream straight from the site to you
  • Remux and convert files on your own device in the browser
  • The web app always matches the API version; both come from the same upstream release
  • Optional cookies for content that needs a sign-in, API keys and Cloudflare Turnstile bot protection for public instances

How to use

  1. Open cobalt from your dashboard.
  2. Paste a link into the box.
  3. Pick auto, audio or mute, then save the file.

Before you install

Change localhost in PUBLIC_URL to your server's IP address (keep port 6144), because download links are made from it. Every other setting is optional and listed in the Variables tab. To use one, add it in the app settings with your value; a setting you leave out keeps its default. For sites that need a sign-in, put a cookies.json file (see cobalt's cookie format) in the config folder inside the app's data folder and restart the app; a keys.json there turns on API keys. The first start takes about a minute.

The settings in the first table are already in the app settings. To use any other one, open the app settings, add the variable with your value, save, and the app restarts with it. A setting you leave out uses its default.

In the app settings

VariableDefault valueDescription
TZ$TZYour time zone. It is filled in from your ZimaOS time zone. Leave it unless you need another.
PUBLIC_URLhttp://localhost:6144The address you type in your browser. Download links are made from it, so it must be right. It starts as localhost, which only works on this device. For other devices, change localhost to your ZimaOS IP. Keep the port at 6144.

Server

VariableDefault valueDescription
DISABLED_SERVICES—Sites to turn off, separated by commas, like bilibili,youtube. Leave it out to allow every site cobalt supports.
FORCE_LOCAL_PROCESSINGneverSet to always so merging and converting happen in the browser instead of on your server, or session for session clients only.
DURATION_LIMIT10800The longest video or audio people can save, in seconds. 10800 is three hours.
TUNNEL_LIFESPAN90How many seconds a download link keeps working.
PROCESSING_PRIORITY—A nice value for ffmpeg, like 10. Higher numbers give it less of your CPU. Leave it out to run at normal priority.

Proxy

VariableDefault valueDescription
HTTP_PROXY—A proxy for all outgoing requests, like http://user:[email protected]:1337/.
HTTPS_PROXY—A proxy for https requests only. Leave it out to use HTTP_PROXY for both.
NO_PROXY—Host names that skip the proxy, separated by commas.

Rate limits

VariableDefault valueDescription
RATELIMIT_WINDOW60The time window, in seconds, for counting save requests.
RATELIMIT_MAX20How many save requests one person can make in that window.
SESSION_RATELIMIT_WINDOW60The time window, in seconds, for counting new sessions.
SESSION_RATELIMIT_MAX10How many sessions one person can start in that window.
TUNNEL_RATELIMIT_WINDOW60The time window, in seconds, for counting downloads.
TUNNEL_RATELIMIT_MAX40How many downloads one person can start in that window.

Protect a public instance

VariableDefault valueDescription
TURNSTILE_SITEKEY—The site key from Cloudflare Turnstile. Set it together with TURNSTILE_SECRET to make visitors pass a bot check. The JWT secret it needs is already made for you.
TURNSTILE_SECRET—The secret key from Cloudflare Turnstile.
JWT_EXPIRY120How many seconds a passed bot check stays valid.
API_AUTH_REQUIRED0Set to 1 so every request needs an API key or a passed bot check.
API_KEY_URL—Where your API keys file is. Leave it out and a keys.json in the config folder of the data folder is used when it exists.
CORS_WILDCARD1Set to 0 so other websites can't use your API, only CORS_URL.
CORS_URL—The one website allowed to use your API when CORS_WILDCARD is 0.

YouTube

VariableDefault valueDescription
YOUTUBE_SESSION_SERVER—The address of a yt-session-generator you run, like http://192.168.1.20:8080/. Helps when YouTube blocks downloads.
YOUTUBE_SESSION_INNERTUBE_CLIENT—The YouTube client to use with that session, like WEB_EMBEDDED.
CUSTOM_INNERTUBE_CLIENT—Use another YouTube client instead of the default one, like IOS.
YOUTUBE_PLAYER_ID—YouTube player IDs to use, separated by commas. Leave it out to use the newest one.
YOUTUBE_ALLOW_BETTER_AUDIO0Set to 1 to allow the better audio option. It uses up the rate limit faster.
ENABLE_DEPRECATED_YOUTUBE_HLSneverSet to always or key to let requests ask for YouTube HLS streams.
docker-compose.yml
name: cobalt

services:
  cobalt:
    image: ghcr.io/hsinghhira/cobalt:latest
    container_name: cobalt
    restart: unless-stopped
    stop_grace_period: 40s
    privileged: true
    environment:
      - TZ=$TZ
      - PUBLIC_URL=http://localhost:6144
    ports:
      - target: 8080
        published: "6144"
        protocol: tcp
    volumes:
      - type: bind
        source: /DATA/AppData/$AppID/data
        target: /data
        bind:
          create_host_path: true
    healthcheck:
      test: ["CMD", "curl", "-fsS", "-o", "/dev/null", "http://127.0.0.1:8080/api/"]
      interval: 30s
      timeout: 10s
      retries: 5
      start_period: 60s
    deploy:
      resources:
        limits:
          cpus: "2.00"
          memory: 1024M
        reservations:
          cpus: "0.00"
          memory: 128M
    labels:
      icon: https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/cobalt/icon.png
    x-casaos:
      id: com.icestore.cobalt
      envs:
        - container: TZ
          description:
            en_US: >-
              Your time zone. It is filled in from your ZimaOS time zone.
              Leave it unless you need another.
        - container: PUBLIC_URL
          description:
            en_US: >-
              The address you type in your browser. Download links are made
              from it, so it must be right. It starts as localhost, which only
              works on this device. For other devices, change `localhost` to
              your ZimaOS IP. Keep the port at 6144.
      ports:
        - container: "8080"
          description:
            en_US: cobalt web app and API, published on host as 6144
      volumes:
        - container: /data
          description:
            en_US: >-
              Settings and keys. Put cookies.json or keys.json in the config
              folder inside it.

x-casaos:
  id: com.icestore.cobalt
  architectures:
    - amd64
    - arm64
  main: cobalt
  author: HSinghHira
  category: Media
  developer: imputnet
  icon: https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/cobalt/icon.png
  screenshot_link:
    - https://cdn.jsdelivr.net/gh/HSinghHira/IceStore@main/Apps/cobalt/screenshot-1.png
  title:
    en_US: cobalt
  tagline:
    en_US: Save videos, audio and pictures from the web. No ads, no trackers.
  description:
    en_US: >-
      cobalt saves what you love from the web. Paste a link from YouTube,
      TikTok, Instagram, Reddit, SoundCloud, Bluesky and many more sites, and
      get the file. No ads, no trackers, no paywalls. This is the official
      cobalt API and the official cobalt web app in a single container, with
      one port and one data folder.


      **Features**


      - Saves video, audio and pictures from dozens of sites


      - Pick video, audio only or muted video, plus quality and format in
        the settings


      - Nothing is stored: files stream straight from the site to you


      - Remux and convert files on your own device in the browser


      - The web app always matches the API version; both come from the same
        upstream release


      - Optional cookies for content that needs a sign-in, API keys and
        Cloudflare Turnstile bot protection for public instances


      **How to use?**


      1. Open cobalt from the Zima OS dashboard.


      2. Paste a link into the box.


      3. Pick auto, audio or mute, then save the file.
  tips:
    before_install:
      en_US: >-
        1. Open the app configuration before you install.


        2. Find PUBLIC_URL. It starts as http://localhost:6144.


        3. To use cobalt on other devices, change localhost to your ZimaOS
           IP address, like http://192.168.1.20:6144. Downloads only work
           from the address you put here.


        4. More settings, like turning sites off or bot protection, are
           listed on the cobalt page at https://icestore.hsinghhira.me/app/cobalt/
           (Variables tab). You can add them now or later in the app settings.


        5. Start the installation.


        6. Wait about a minute.


        7. Open cobalt from the Zima OS dashboard and paste a link.


        8. Some sites need you to be signed in. For those, put a cookies.json
           file in the config folder inside the app's data folder, then
           restart the app.
  index: /
  port_map: "6144"
  scheme: http
  is_uncontrolled: false
  version: "11.7.1"
  update_at: "2026-10-25"
  release_notes:
    en_US: |-
      - Single-container cobalt with one port (6144) and one data folder
      - The web app is the official one, built from the same commit as the API
      - Web app on /, API on /api, one address and port; the web app finds the API by itself
      - Drop cookies.json or keys.json in /data/config to use them
      - ghcr.io/imputnet/cobalt 11.7.1
  repo: "https://github.com/imputnet/cobalt"
  support: "https://github.com/imputnet/cobalt/issues"
  docs: "https://github.com/imputnet/cobalt/blob/main/docs/run-an-instance.md"