Configurations

RF Swift Configuration

RF Swift reads a small INI file for persistent preferences, YAML profiles for container presets, environment variables for one-off overrides, and command-line flags that win over everything.

The configuration file

Location

~/.config/rfswift/config.ini

C:\Users\username\AppData\Roaming\rfswift\config.ini

~/.config/rfswift/config.ini

On first run RF Swift asks whether to create the file with the shipped defaults; when there is no terminal to answer (the Workbench, a script) it is created silently.

Structure

[general]
imagename = myrfswift:latest
repotag = penthertz/rfswift_resolute
engine = auto

[container]
shell = /bin/zsh
bindings =
network = host
exposedports =
portbindings =
x11forward = /tmp/.X11-unix:/tmp/.X11-unix
xdisplay = "DISPLAY=:0"
extrahost = pluto.local:192.168.2.1
extraenv =
devices = /dev/bus/usb:/dev/bus/usb,/dev/snd:/dev/snd,/dev/dri:/dev/dri,/dev/input:/dev/input,/dev/vhci:/dev/vhci,/dev/console:/dev/console,/dev/vcsa:/dev/vcsa,/dev/tty:/dev/tty,/dev/tty0:/dev/tty0,/dev/tty1:/dev/tty1,/dev/tty2:/dev/tty2,/dev/uinput:/dev/uinput
privileged = false
caps =
seccomp =
cgroups = c 189:* rwm,c 166:* rwm,c 188:* rwm

[audio]
pulse_server = tcp:localhost:34567

[desktop]
proto = vnc
host = 127.0.0.1
port = 6080
password =
ssl = false

[nix]
wsl_distro =

The device defaults depend on the operating system the file was created on.

Sections

[general]

[container]

[audio]: pulse_server is the host audio server address containers get in PULSE_SERVER and the port rfswift host audio enable opens (tcp:localhost:PORT yields a local-only ACL). Windows ignores it and uses WSLg.

[desktop]: proto (vnc or http for noVNC), host, port, password, ssl are the defaults of --desktop.

[nix]: wsl_distro names the WSL 2 distribution that hosts the Nix engine on Windows (rfswift env wsl use writes it).

Changing the repository

repotag is what RF Swift prepends to short tags, so rfswift container create -i sdr_full resolves to penthertz/rfswift_resolute:sdr_full by default. Edit the [general] section to use another repository.

Container profiles

Profiles are YAML presets bundling image, network mode, features, devices, mounts, ports, capabilities, cgroup rules, GPU and VPN into one name. They live in:

~/.config/rfswift/profiles/

~/Library/Application Support/rfswift/profiles/

%APPDATA%\rfswift\profiles\

rfswift profile init                                   # write the built-in presets
rfswift profile list
rfswift container create --profile sdr-full -n my_sdr
rfswift container create --profile wifi -n my_wifi -i penthertz/rfswift_resolute:sdr_full   # flags override the profile

Built-in profiles: yolo, network-host, network-nat, sdr-full, sdr-light, wifi, bluetooth, telecom, telecom-5g, rfid, automotive, hardware, reversing, headless. A built-in profile you never edited is refreshed automatically when RF Swift improves it (a fingerprint records what RF Swift wrote); an edited copy is kept. The Workbench create dialog offers the same presets. See profile.

Environment variables

Installer variables (get_rfswift.sh) are listed in Getting Started.

Command-line overrides

Every setting can be overridden per container on rfswift container create (-b, -s, -a, -g, -t, -u, -e, -d, -p, -w, -z, -x, -m, --workspace, --realtime, --desktop*, --vpn, …). The full list with examples is on the container create page; the security-related flags are summarised in Running RF Swift.

rfswift container create -i penthertz/rfswift_resolute:sdr_full -n my_sdr_container
rfswift container create -i penthertz/rfswift_resolute:sdr_full -n captures -b /home/user/captures:/data/captures
rfswift container create -i penthertz/rfswift_resolute:wifi -n wifi -a NET_ADMIN
rfswift container create -i penthertz/rfswift_resolute:sdr_full -n web -t bridge -w 8080:80/tcp
rfswift container create -i penthertz/rfswift_resolute:sdr_full -n bash_only -e /bin/bash

Changing a container afterwards

Bind mounts, devices, capabilities, cgroup rules, GPUs, ports and ulimits of an existing container are managed with rfswift config ... (Dynamic container management):

rfswift config bindings add -c my_sdr_container -s /home/user/data -t /data
rfswift config bindings add -c my_container -d -t /dev/ttyUSB0
rfswift config bindings rm  -c my_container -t /data

Docker API version

If the daemon is older than the client library you may see client version 1.47 is too new. Maximum supported API version is 1.45. Pin the version:

DOCKER_API_VERSION=1.45 rfswift config bindings add -c my_container -s /tmp -t /root/myshare
export DOCKER_API_VERSION=1.45     # in ~/.bashrc or ~/.zshrc for good

Disconnected mode

rfswift -q container create -i sdr_full -n quick_analysis
rfswift --disconnect image local
rfswift -q container shell -c my_container

-q / --disconnect skips the release check and every network query. Use it in air-gapped labs, in scripts, and on slow links; everything else works the same. rfswift --version never touches the network either.

Best practices

1. Put your common preferences in config.ini and the default engine in [general] engine.
2. Use profiles for recurring setups and flags for one-off changes.
3. Keep privileged = false; add capabilities per container and remove them afterwards.
4. Be selective with devices: the USB tree plus the serial hot-plug covers most hardware.
5. Use rfswift config ... for changes instead of re-creating containers.

Common scenarios

# SDR development environment
rfswift container create -i penthertz/rfswift_resolute:sdr_full -n sdr_dev -b ~/sdr_projects:/projects -s /dev/ttyUSB0:/dev/ttyUSB0

# Wi-Fi security testing
rfswift container create -i penthertz/rfswift_resolute:wifi -n wifi_testing -a NET_ADMIN,NET_RAW -b ~/wifi_captures:/captures

# Offline firmware analysis
rfswift container create -i penthertz/rfswift_resolute:reversing -n firmware_analysis -t none -b ~/firmware:/firmware

# Native, no container engine
rfswift container create --engine nix -i sdr_light -n radio