Sonarr and Radarr login: there is no default

Why there is no Sonarr or Radarr default login

There is no Sonarr default login and no Radarr default login. Neither app ships with a built-in username or password. On first start the web UI opens a dialog titled "Authentication Required", and you type a username and password of your own choosing. If you are looking at a login form instead, credentials already exist in that install, and the fix is a one-line edit to config.xml that brings the first-run dialog back.

This is how the current stable releases behave. As of September 2026 the linuxserver image lscr.io/linuxserver/sonarr:4.0.20 carries Sonarr 4.0.20.3014, and lscr.io/linuxserver/radarr:6.4.4 carries Radarr 6.4.4.10685. Both were released on 2026-09-16. Authentication became mandatory in Sonarr v4 and Radarr v5, so any image you can pull today asks you to create credentials. The hotio images behave the same way, because the behaviour lives in the app and the image only wraps it.

What the first-run dialog asks for

The dialog opens with a banner: "To prevent remote access without authentication, Sonarr now requires authentication to be enabled. You can optionally disable authentication from local addresses." Under it are the fields that decide how the app is protected.

• Authentication Method: "Forms (Login Page)" or "Basic (Browser Popup)". The Save button stays disabled while the method is None, so you cannot skip this step.
• Authentication Required: "Enabled" or "Disabled for Local Addresses". Pick Enabled on a VPS. The section on Docker below explains why.
• Username.
• Password, typed twice.

Forms gives you a normal login page. Basic makes the browser pop up its own credential box instead. Either way, the username and password are stored as a salted hash in the app database (sonarr.db or radarr.db), not in config.xml. You cannot read a forgotten password back out of any file. You can only replace it.

Where the setting lives in Docker

When you save the dialog, the app writes two elements to config.xml. In Docker that file sits in the host folder you mapped to /config in your compose file. If your service maps ./sonarr/config:/config, as a Docker Compose arr stack typically does, the path is ./sonarr/config/config.xml. It is a separate mount from your media, so nothing in the folder layout that keeps hardlinks working changes here.

grep Authentication ./sonarr/config/config.xml

  <AuthenticationMethod>Forms</AuthenticationMethod>
  <AuthenticationRequired>Enabled</AuthenticationRequired>

AuthenticationMethod holds Forms or Basic. AuthenticationRequired holds Enabled or DisabledForLocalAddresses. The web UI shows the login form when the method is anything other than None, and the first-run dialog when it is None. A missing element also reads as None, because the config loader falls back to that default when the key is absent. That one fact is the whole reset procedure.

How to reset a Sonarr or Radarr password in Docker

Stop the container first. The app rewrites config.xml whenever it saves settings, so an edit made while it runs can be overwritten a moment later. Use stop, not down: stop keeps the container and its settings in place, and start brings the same container back.

docker compose stop sonarr
sudo sed -i '/<AuthenticationMethod>/d' ./sonarr/config/config.xml
grep Authentication ./sonarr/config/config.xml
docker compose start sonarr

The second grep should print only the AuthenticationRequired line. Delete the whole AuthenticationMethod line rather than changing its value. The Servarr wiki warns against ending up with two AuthenticationMethod entries, and a deleted line cannot be duplicated. Leave AuthenticationRequired and every other line alone.

Open http://your-server:8989 for Sonarr or port 7878 for Radarr. The "Authentication Required" dialog is back. Enter a new username and password, save, and the login form returns with credentials you know. The new user replaces the old one in the database. For Radarr the procedure is the same with radarr in place of sonarr in each command.

One detail about ownership. sed -i writes a new file and, when run as root, keeps the owner and mode of the old one, so config.xml stays owned by the PUID and PGID the container runs as. If you use an editor instead, check with ls -l afterwards. A file that ends up owned by root with mode 644 is one the container user can no longer write, and PUID and PGID decide which host user that is.

What "Disabled for Local Addresses" means inside Docker

The app decides whether a request is local by looking at its source address. Loopback, 169.254.0.0/16, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 all count as local, and so do IPv6 link-local and unique-local addresses. Docker's bridge networks are carved out of 172.16.0.0/12: the default bridge is 172.17.0.0/16, and each compose project network takes the next free /16. So every container on the same network, and the bridge gateway itself, are local as far as Sonarr can tell.

On a VPS that has consequences. A reverse proxy container in front of Sonarr connects from its own container address, something like 172.18.0.3, so without further checks everyone the proxy serves would be local. Connections relayed by Docker's userland proxy arrive from the bridge gateway, 172.17.0.1 or 172.18.0.1. That covers requests from the host itself, and it covers IPv6 clients whenever the Docker network is IPv4 only, which is the default. The Docker documentation states it plainly: "Ports on the host's IPv6 addresses will map to the container's IPv4 address if no host IP is given in a port mapping, the bridge network is IPv4-only, and --userland-proxy=true (default)." A stranger connecting over IPv6 looks like the gateway, and the login is skipped. Only a direct IPv4 connection to the published port keeps its real source address, because Docker's DNAT rule rewrites the destination and leaves the source alone.

Current versions of both apps (Sonarr since 4.0.16, which closed a 2026 advisory where a spoofed header made any request look local) never treat a request that carries an X-Forwarded-For header as local unless it came through a proxy listed under Settings > General > Trusted Networks. That fixes the spoofing hole. It does not change the bridge-gateway case, because those requests carry no header at all. Set Authentication Required to Enabled. A published port on a VPS is reachable from the whole internet, and Docker's published ports bypass ufw, so the login form is often the only thing between the internet and your library. Which port belongs to which app tells you what else is listening.

Updating Sonarr or Radarr in Docker

In Docker the app cannot update itself. System > Updates lists newer releases with the note "Update the docker container to receive the update" instead of an install button. Pull a new image and recreate the container:

docker compose pull sonarr
docker compose up -d sonarr

If you pinned a tag such as 4.0.20, change it in the compose file before pulling, or pull fetches the image you already have. up -d recreates the container from the new image, while restart only restarts the old one, which is the difference between restarting a container and recreating it. The /config mount survives, so the database and config.xml carry over, and your login does too. Copy the config folder somewhere safe before a major version jump, because database migrations run one way only.

FAQ

What is the default username and password for Sonarr and Radarr?

There is none. Sonarr v4 and Radarr v5 and later refuse to run without authentication, and the first time you open the web UI a dialog titled "Authentication Required" makes you choose a username and password. If you see a login form on a fresh install, someone saved that dialog already, or the config volume came from an earlier install.

How do I reset a Sonarr password in Docker if I am locked out?

Stop the container with docker compose stop sonarr, delete the <AuthenticationMethod> line from config.xml in the folder mapped to /config, and start the container again. The app treats a missing method as None, so the first-run dialog appears and you set a new username and password. Do not add a second AuthenticationMethod line, and leave AuthenticationRequired as it is.

Is "Disabled for Local Addresses" safe when Sonarr runs in Docker on a VPS?

No. Sonarr counts the whole 172.16.0.0/12 range as local, and that is where Docker puts every container and every bridge gateway. Requests that reach Sonarr through a proxy container or through Docker's userland proxy, including IPv6 clients on an IPv4-only Docker network, arrive from a private address and skip the login. Set Authentication Required to Enabled.

How do I update Sonarr or Radarr when they run in Docker?

Not from the web UI. System > Updates shows "Update the docker container to receive the update" next to each release. Run docker compose pull sonarr and then docker compose up -d sonarr. If your compose file pins a version tag, change the tag first. The database and your login live in the /config mount and survive the new container.