In a nutshell, (I don't use the docker version, because I like to compile things and adapt to my system, but I might actually go for it on my little Android to see how it works with a specific old system):

Hive witness node (block production only) Docker deployment guide

This is for a minimal consensus / witness node whose only job is to stay in sync and produce blocks when scheduled. It does not run account history, exchange tracking, or unnecessary APIs.

Prerequisites (modified from what AI provided)

• Docker Engine installed
• ~16 GB RAM (shared-file ~7–8 GB) - you can get along with 7GB by separating the comments-rocksdb-path into a separate non /dev/shm path different from shared-file-dir. Below shows how to run everything from local disk, which will be slow... so the docker paths need to point into the /dev/shm for hosting the shared-file-dir file.
• Fast storage (NVMe preferred), but realistically even a very old 2TB SATA disk works fine. Full block log is ~550 GB+; I think you can now keep just a partial amount of block log... but I haven't tested it myself yet.
• A Hive account that will be the witness
• Outbound internet (P2P)
• Bother me anywhere, and I can help fine-tune this... if you don't figure out how to put the shared file on /dev/shm (and how to work with backups of the file if you are not using snapshots to restart the node).

Install Docker if needed:

curl -fsSL get.docker.com -o get-docker.sh
sh get-docker.sh

1. Prepare directories and clone (optional, for scripts)

mkdir -p ~/hived-datadir/blockchain ~/hived-shm
# Optional: clone if you want the helper scripts
git clone --depth=1 https://gitlab.syncad.com/hive/hive.git

2. Create a minimal config.ini for witnessing only

cat > ~/hived-datadir/config.ini << 'EOF'
log-appender = {"appender":"stderr","stream":"std_error","time_format":"iso_8601_milliseconds"}
log-logger = {"name":"default","level":"info","appender":"stderr"}

backtrace = yes

# Minimal plugins for witnessing
plugin = p2p
plugin = witness
plugin = state_snapshot

# Witness settings (EDIT THESE)
witness = "yourwitnessname"
private-key = 5XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

enable-stale-production = false
required-participation = 33

shared-file-size = 12G
shared-file-full-threshold = 9500
shared-file-scale-rate = 1000

p2p-endpoint = 0.0.0.0:2001
p2p-max-connections = 200

# Optional seed nodes (add more from the official list if desired)
p2p-seed-node = seed.openhive.network:2001
p2p-seed-node = anyx.io:2001
p2p-seed-node = hive-seed.arcange.eu:2001
p2p-seed-node = api.hive.blog:2001

# Keep block log as single file if you download one
block-log-split = -1
EOF

Important:

• Replace yourwitnessname and the private-key (WIF).
• The private key is the signing key, not your owner/active key.
• Do not expose the private key.

3. Generate a signing key pair (recommended method)

Use a temporary container or cli_wallet:

# Pull a recent image (always pin the version)
docker pull hiveio/hive:1.28.8   # check Docker Hub / releases for current version

# Run cli_wallet temporarily to generate keys
docker run --rm -it hiveio/hive:1.28.8 /home/hived/bin/cli_wallet

Inside the wallet:

set_password yourstrongpassword
unlock yourstrongpassword
suggest_brain_key

Note the private (WIF) and public keys, then exit.

Put the private WIF into config.ini as shown above.

4. Start the witness node (pre-built image)

Using the recommended helper script (if you cloned the repo):

cd hive
./scripts/run_hived_img.sh hiveio/hive:1.28.8 \
  --name=hived-witness \
  --data-dir=$HOME/hived-datadir \
  --shared-file-dir=$HOME/hived-shm \
  --p2p-endpoint=0.0.0.0:2001 \
  --detach \
  --preserve-container

Or with plain docker run (equivalent):

docker run -d \
  --name hived-witness \
  --restart unless-stopped \
  -e HIVED_UID=$(id -u) \
  -p 2001:2001 \
  -v $HOME/hived-datadir:/home/hived/datadir \
  -v $HOME/hived-shm:/home/hived/shm_dir \
  hiveio/hive:1.28.8 \
  --config=/home/hived/datadir/config.ini

For first start with a published snapshot (much faster than full sync):

docker run -d \
  --name hived-witness \
  --restart unless-stopped \
  -e HIVED_UID=$(id -u) \
  -e SNAPSHOT_URL=https://gtg.openhive.network/get/snapshot/exchange/latest.tgz \
  -p 2001:2001 \
  -v $HOME/hived-datadir:/home/hived/datadir \
  -v $HOME/hived-shm:/home/hived/shm_dir \
  hiveio/hive:1.28.8 \
  --config=/home/hived/datadir/config.ini

(Use a snapshot built with compatible plugins; pure witness + state_snapshot is usually fine.)

5. Monitor

docker logs -f hived-witness
# or
docker exec -it hived-witness tail -f /home/hived/datadir/hived.log

Look for head block advancing and eventually “producing block” when you are scheduled.

6. Register / update the witness on-chain

You must set the public signing key on your account (once the node is running and in sync).

Use a wallet or cli_wallet connected to any public API node:

docker run --rm -it hiveio/hive:1.28.8 /home/hived/bin/cli_wallet -s ws://api.openhive.network:8090

Then (after setting password and importing your active key):

update_witness "yourwitnessname" "https://your-witness-url.com" "STMYourPublicSigningKeyHere" {"account_creation_fee":"3.000 HIVE","maximum_block_size":65536,"hbd_interest_rate":0} true

7. Useful commands

docker stop hived-witness
docker start hived-witness
docker logs --tail 100 -f hived-witness
docker exec -it hived-witness /bin/bash          # inspect inside

Notes for a pure witness node

• Keep plugins minimal (p2p + witness + optionally state_snapshot). Adding account history or many APIs increases resource use and may require a replay.
• The private signing key lives in config.ini — protect the host and the file.
• After major version upgrades that change state, you may need --replay or a fresh snapshot.
• Always pin the image tag (hiveio/hive:1.28.x). Do not use a floating latest tag.
• Open TCP 2001 if you want to contribute to the P2P network (optional but recommended).

This gives you a lightweight node whose sole purpose is witnessing blocks.