The first step isn't installing anything — it's deciding which path to take. SnowLuma's core injects a hook into a real QQ process, so you need an environment that can run QQ, inject into it, and let you scan a login QR. The table below maps your situation straight to a recommended path — pick the row that matches and follow the link.
| Your situation | Recommended path | Link |
|---|---|---|
| A Linux server | Docker (easiest, recommended) | Docker deployment |
| Windows machine | Windows manual / Docker Desktop | Windows deployment |
| Want to use WSL2 | Run containers inside WSL2 | WSL2 deployment |
| Only an Android phone | Termux + proot (advanced/experimental) | Mobile deployment |
| Hook up an AI client | MCP server | MCP integration |
| Write client code | TypeScript SDK | SDK |
When in doubt, choose Docker on Linux — it's the official, easiest path to a working setup. Full comparison at Choose a deployment.
The most common path is the official image on Linux. Three steps:
1. Start the container
--cap-add=SYS_PTRACE and --security-opt seccomp=unconfined are not optional: the hook injects into QQ via ptrace, and the default seccomp profile blocks it. --shm-size=1g is also required by QQ (Chromium-based).
2. Scan the login QR
Open http://<server-ip>:6081/ (noVNC) in a browser and enter the VNC_PASSWD you set. QQ is already running on the remote desktop — scan the QR with your QQ mobile app. After login, the hook auto-switches from passive observation to working mode.
3. Open the WebUI
Open http://<server-ip>:5099/ to reach the SnowLuma WebUI.
For the full Compose template, multi-account, and ops commands, see Docker deployment.
Whichever path you take, first-time setup always involves these:
QR login: SnowLuma is QR-scan login only — there's no CLI login. On headless setups you must see the QQ window via VNC / noVNC to scan.
Find the WebUI temp password: on the first start with a fresh data dir, a one-time admin password is printed to the logs. Docker:
The temp password is printed only on the first start with a fresh data dir. Restarting or reusing an existing data dir will not regenerate it.
Open ports: to reach it from outside, allow the WebUI (5099) and whichever OneBot ports you use (3000 / 3001).
Change the default VNC password, and do not expose VNC / noVNC / WebUI / OneBot ports raw on the public internet.