htpdate-server

A lightweight Docker container that serves real NTP on your LAN while syncing time over HTTPS — bypassing ISPs that block UDP/123.

Internet (TCP/443 — not blocked)               LAN (UDP/123)
────────────────────────────────               ──────────────────
  https://www.google.com ─────┐                        ┌─ desktop
  https://www.apple.com ──────┤  ┌──────────────────┐  ├─ laptop
  https://www.fastly.com ─────┤──│ htpdate │ chrony │──┤  server
  https://www.amazon.com ─────┘  └──────────────────┘  └─ raspberry pi
                       HTTPS Date headers            NTP responses

docker run -d \
  --name htpdate-server \
  --restart unless-stopped \
  --cap-add SYS_TIME \
  -p 123:123/udp \
  tabilzad/htpdate-server:latest

Or with Docker Compose:

docker compose up -d

Then point your LAN clients at the Docker host:

# /etc/chrony/chrony.conf (on each client)
server <docker-host-ip> iburst

The container requires the SYS_TIME capability so it can adjust the system clock.

The entrypoint supervises both daemons: if either process dies, or htpdate stops syncing for WATCHDOG_STALE seconds, the container exits non-zero so Docker's restart policy (restart: unless-stopped) brings the pair back up together.

All settings are passed as environment variables:

Example with custom servers and faster polling:

docker run -d \
  --name htpdate-server \
  --cap-add SYS_TIME \
  -p 123:123/udp \
  -e "HTTPS_SERVERS=https://www.cloudflare.com https://www.google.com" \
  -e MIN_POLL=300 \
  tabilzad/htpdate-server:latest

From the Docker host:

# Check htpdate + chrony status inside the container
docker exec htpdate-server chronyc tracking

# Query NTP from a LAN machine
chronyc sources          # if pointed at this server
ntpdate -q <docker-host-ip>

docker compose build
docker compose up -d

MIT