Shinobi

Last reviewed Sep 13, 2026 · 834 words

Ranked honestly, for someone setting up cameras from scratch in 2026: Frigate first, because object detection is what makes camera alerts worth receiving; ZoneMinder second if you want a two-decade-old codebase that is boring in the good way; Shinobi third, and only for a specific kind of user. That user has 8 to 30 cameras of mixed brands, wants a browser NVR with a proper multi-view wall and per-monitor recording rules, does not have or want an AI accelerator, and is comfortable with software whose documentation is spread across a wiki, a forum, a Discord and the source. Shinobi serves that person well. Everyone else should read the last section and leave.

Two logins, and the first one is a trap

Shinobi runs as a Node.js app on port 8080 with a MariaDB or MySQL database. There are two separate interfaces: the superuser panel at /super, which manages user accounts and system settings, and the normal dashboard at /, where cameras live. The superuser panel ships with default credentials ([email protected] and admin) stored in super.json, and a startling number of installs leave them in place. Change them first, then create a regular user through the superuser panel, then log out and log in at the root as that user. New arrivals routinely spend an hour trying to add cameras as the superuser, which cannot be done.

Docker is the sane deployment; the official images are on GitLab's registry alongside the source. Mount /config, /customAutoLoad and a large volume for /home/Shinobi/videos, and pass /dev/dri if you want Intel Quick Sync for decoding. Give it the 2 GB the catalogue lists as a floor; stream buffers and the Node process eat it.

Monitor settings decide your CPU bill

Each camera is a "monitor" with a mode, Watch-Only for live view or Record for continuous capture, and a separate Detector section for motion-triggered recording. The mode matters less than the input and stream settings under it. The mistake that eats CPUs is letting Shinobi re-encode. Set the input to the camera's RTSP main stream, set the recording codec to copy, and the video is written straight to disk with no transcoding. Then add a second input, the camera's low-resolution substream, and point motion detection at that. Shinobi's built-in detector compares JPEG frames, so feeding it a 640x360 stream at 2 fps instead of 4K at 20 fps is the difference between 5% and 80% of a core per camera. Twenty cameras done right fit on a modest quad-core; twenty cameras done wrong will not fit on anything.

Retention is per monitor: a maximum number of days or a maximum size, with the oldest recordings deleted first. Set both. Shinobi does not stop you filling the disk on a monitor with no limit.

Motion detection is pixel-based, and that is the ceiling

The stock detector is pixel-difference with regions and a threshold, the same technique Motion has used since 2000. It is fine indoors and fine for "did anything happen in the garage". Outdoors it triggers on rain, headlights and shadows, and the tuning never fully fixes it. Shinobi can hand frames to external object-detection plugins (there are community ones for TensorFlow and YOLO) but wiring them up is where the scattered documentation bites hardest, and once you are doing that work you are rebuilding a worse Frigate by hand. If person and vehicle detection is a requirement, that is the moment to stop and switch.

What Shinobi does better than the alternatives

Three things kept me on it longer than I expected. The camera compatibility is broad: RTSP, MJPEG, HLS, ONVIF discovery, raw h264 over HTTP, local USB devices, and the kind of odd vendor stream that Frigate's stricter input path rejects. The multi-monitor live wall with drag-to-arrange layouts is the best in the open-source category for a security desk. And the API is complete: every dashboard action has an endpoint with an API key, which makes Home Assistant and custom integrations straightforward. For a small business replacing Blue Iris on a Windows box with something Linux-based, this list is closer to what they need than Frigate's focus on detection.

What I'd do

If you fit the profile in the first paragraph, run the Docker image, change the superuser password before anything else, create your monitors with copy recording from the main stream and detection from the substream, set retention on every monitor, and keep the whole thing off the internet behind a VPN. If you have fewer than 8 cameras or you want to be told a person is at the door, skip Shinobi and set up Frigate; it is the larger project, better documented, and its results are the ones people actually want from a camera system. The full category is under video surveillance.