Every module, one entry each.

Containers, images, volumes, networks and Compose projects, in a browser. The same tool the media server introduces, which is why it is here: if you followed that site, this is already familiar.

ENCRYPTION_KEY protects the credentials it stores and must be at least 32 characters; the generator writes 64 hex characters for both keys. Change the default login before anything else.

Arcane gets its own install-arcane.sh because it is the one thing here you would sensibly install before the rest of the stack exists. It runs the same platform checks as the main script.

The only PDF tool here with a proper API, so it is the one that fits into scripts and automation. Merge, split, OCR, convert, sign, redact, compress.

Contested: one software directory lists the licence as Apache-2.0. The repository's own LICENSE file says MIT with carve-out directories. Trust the repository.

Every operation runs in the browser. Files never reach the server, which is the whole point. That also means it can be served as plain static files from any web server, and the container is only a convenience.

Use the simple build. Upstream describes it as the full toolset with the marketing page removed, intended for internal deployments, and explicitly not a feature-reduced version.

Tags, collections, annotations, share links, and it remembers where you stopped reading on each device. OIDC single sign-on is included rather than paid for. There is a consume directory for adding files without the UI.

Drop a file in the consume directory and it is OCR'd, classified and indexed. It learns tags and correspondents from your corrections. Everything the UI does is available over the API.

Four volumes, and they are not interchangeable. media holds the documents themselves, data holds the search index and classifier. Back up both. export is where a proper document export lands, which is the migration path off Paperless if you ever want one.

Stronger than Paperless on structured metadata: document types, folders, permissions, and a rule-driven workflow layer with a documented API.

Release cadence is slow but the project is not abandoned. The last tagged release was v0.43.0 in March 2025, while pull requests were still being merged in August 2026 and nightly builds continue. Judge it as slow rather than dead.

The recommendation for most people who want a team wiki. The fixed hierarchy is the feature: non-technical writers put things in the right place without being told to. Ships on a calendar release schedule with regular security releases.

The default login is admin@admin.com with the password password. Change it before anything else. If you are running behind a reverse proxy, APP_URL must be the external URL or links and redirects break.

More flexible than BookStack: several editor types over one page tree, optional Git synchronisation of content, and richer search backends.

Version 2.5.314 shipped in May 2026 and security fixes continue, but new feature work is going into version 3. If a predictable release schedule matters to you, that is the argument for BookStack.

This is not a web application. It is the real Obsidian desktop app running in a container and streamed to your browser through Selkies, which replaced KasmVNC in these images. Plugins work because it is the actual app.

HTTPS is required for the video and audio features to work at all, because the browser APIs involved only run in a secure context. That is why port 3001 serves its own certificate. A reverse proxy that validates upstream certificates will reject it, which is what port 3000 exists for.

Serves ZIM archives with full-text search. A full English Wikipedia with images is tens of gigabytes; the no-pictures build is far smaller. Stack Exchange sites, Project Gutenberg and WikiHow are also available.

The command argument is not optional if you are serving local files. Without it the container has nothing to serve. Quote the glob in compose, or YAML will not pass it through as you expect.

The recommendation of the two forges here. Forgejo Actions gives you CI compatible with GitHub Actions workflows, there is a package registry, and it can act as an OAuth2 provider for other services in your stack, which is worth knowing if you want single sign-on without running a separate identity server.

Governance is community-led under Codeberg e.V. Federation over ActivityPub exists but is experimental and off by default.

Map SSH to a spare host port such as 222 rather than 22, unless you have moved your host's own SSH daemon. Both cannot have port 22.

Repositories, issues, pull requests, a wiki, webhooks, SSH and HTTP. That is the whole scope, and it has stayed that way deliberately. It will run on hardware where Forgejo would be uncomfortable.

What it does not have: built-in CI, a package registry, project boards, or an OAuth2 provider. If you want any of those, you want Forgejo.

Open the page on two devices on the same network and they find each other. Files go directly between browsers over WebRTC; the server only introduces them. Nothing is stored, so there is nothing to clean up.

Leave DEBUG_MODE off. Upstream says not to use it in production, because it logs client IP addresses to standard output.

One naming trap. A site at pairdrop.org advertises a self-contained PHP script with no database. That is different software with the same name. The project this image wraps is the Node and WebRTC one, forked from Snapdrop.

The closest thing here to WeTransfer. Upload a bucket of files, set an expiry, get a link. Resumable uploads and downloads, one-time downloads, password-protected download lists, and everything can be pulled as a zip.

Two different passwords, easy to confuse. PSITRANSFER_ADMIN_PASS enables the /admin page, which is disabled entirely until you set it. PSITRANSFER_UPLOAD_PASS is what stops strangers uploading if the instance is reachable from outside.

Built for ShareX, Flameshot and similar tools. Dashboard, API, URL shortener, paste bin, and embed metadata for links pasted into chat apps.

Version 4 was a complete rewrite and there is no in-place upgrade from version 3. Data moves across using a built-in importer. Several variables were renamed at the same time: CORE_DATABASE_URL became DATABASE_URL, and CORE_HOST became CORE_HOSTNAME. Old compose files fail in confusing ways because of this.

More file hosting than file transfer. Albums, tagging, thumbnails, shareable galleries, multi-user with permissions, and ShareX support.

Some third-party comparisons state that Chibisafe requires PostgreSQL. Upstream's own compose files use a local database directory instead. Where a guide and the project disagree, the project wins.

Create the database, uploads and logs directories before first start. Letting Docker create them produces permission errors.

Documents, spreadsheets, kanban and more, encrypted in the browser so the server cannot read them. That property is also its main constraint: the server cannot help you if you lose a key.

The optional OnlyOffice integration is enabled by an environment variable that the shipped compose file leaves commented out, with a note telling you to read and accept its licence first. That comment is there deliberately.

The same Selkies base image as Obsidian, running KDE's office suite. Words, Sheets, Stage and the rest, in a browser tab. Useful when you need to open a document format nothing else handles and you do not want to install anything locally.

HTTPS is required for full functionality, because the browser features it depends on do not work over plain HTTP.

Documents, databases, kanban boards and calendars, with polished desktop and mobile clients that you point at your own server. AppFlowy Cloud is the server component; the apps are where you actually work.

A domain name is required rather than recommended, because the clients connect to a base URL and a websocket URL that have to resolve.

The largest thing on this site by some distance. Project management, issue tracking, documents, HR, and optional video calls through LiveKit.

Upgrades need attention. Moving from any 0.6.x version to 0.7.x requires the dedicated migration steps in the project's migration guide rather than a direct in-place upgrade. The quick-start compose is described by upstream as intended for local testing only.

Boards, swimlanes, checklists, due dates and attachments, close enough to Trello that the import works. Boards export as JSON with attachments included, which is a real exit route rather than a claimed one. WITH_API turns on the REST API, off by default.

Contested: the required MongoDB version. Community guides variously insist on 4.4.x, while others run MongoDB 6 or 7 without trouble, and upstream examples span everything from 3.2 to 4.4 depending on their age. Check the project wiki for the version matching the Wekan release you are pulling rather than copying a version number out of a blog post.

Four services: the web UI, an XMPP server, a conference focus component, and the videobridge that actually moves the media. Optional add-ons for SIP and recording are separate compose files layered on top.

You also have to create the config directories before the first start, or the containers have nowhere to write. Upstream gives the exact mkdir line, covering web, transcripts, prosody config and plugins, jicofo, jvb, jigasi and jibri.

The firewall rules differ from everything else on this site. Media needs 10000/udp open, and 4443/tcp for the case where UDP is blocked at the client's end. A reverse proxy alone does not carry that traffic.

Send a document, place fields, collect signatures, keep an audit trail. Deployed from upstream's own compose file and Caddyfile rather than a service you write yourself, with configuration in a .env.prod file.

MASTER_KEY is described by upstream as the key that allows access to all the data. Treat it as the most sensitive value in your whole stack, keep it out of version control, and do not reuse it anywhere. PARSE_MOUNT should be left at /app; upstream says not to change it.

PFX_BASE64 holds the signing certificate. Upstream's example file ships a sample certificate, which is fine for trying it out and wrong for anything you would actually rely on.

You build the board in the browser rather than in a file. Tiles pull live data from services you point them at, and it ships its own user accounts and login, so it does not need an auth layer bolted on.

The Docker socket mount is what gives you container status, and it is optional. Mount it read only if you mount it at all, and understand that read only limits the damage rather than removing it. The socket is root on the host in practical terms.

The version 1 rewrite changed the architecture and required manual reconfiguration for people upgrading from earlier versions.

Your whole dashboard is one YAML file, which means it lives in Git next to your compose file and is restored by copying a file. There is a UI editor too, so you are not forced into a text editor. Status checks per tile, and a large theme collection.

Actively released through 2026, on the 4.5.x line as of August.