Self-host Authentik with Docker Compose

Flexible identity provider with SSO, MFA, LDAP and OAuth2 support.

authentik

postgres

postgres:18.3-alpine3.23

worker

ghcr.io/goauthentik/server:2026.5.5

This is still a work in progress.

The generated compose file and instructions may not be complete or correct for every app yet. Please report any issues you encounter to contact@bitflake.com.

The steps below take a few minutes end to end.

Docker compose setup and file
save the generated compose and env files.
Secret generation
create the random passwords Authentik needs.
Start Authentik with Docker Compose
bring the stack up and check it's healthy.

Requirements

You'll need these installed on the machine you're deploying to:

Docker

Packages Authentik and everything it depends on into an isolated container, so it runs the same way on your machine as it does everywhere else.

Install guide

Docker Compose

Reads docker-compose.ymland starts everything in it together. Ships with Docker Desktop. On Linux servers it's usually a separate install.

Install guide

1. Docker compose setup and file

Create a folder for Authentik and save the file below into it as docker-compose.yml. It describes every container the stack needs — Authentikitself and any supporting services, such as its database — along with the ports, volumes and environment variables each one uses. You'll also need an empty .env file in the same folder; Docker Compose reads it automatically and uses it to fill in the ${VARIABLE}references you'll see in the file below.

docker-compose.yml

version: "3.9"
services:
  authentik:
    image: ghcr.io/goauthentik/server:2026.5.5
    restart: unless-stopped
    ports:
      - 9000:9000
    environment:
      AUTHENTIK_POSTGRESQL__HOST: localhost
      AUTHENTIK_POSTGRESQL__NAME: app
      AUTHENTIK_POSTGRESQL__PASSWORD: ${RANDOM_PG_PASSWORD}
      AUTHENTIK_POSTGRESQL__USER: app
      AUTHENTIK_SECRET_KEY: ${RANDOM_AUTHENTIK_SECRET_KEY}
    volumes:
      - data:/data
    command:
      - server
    healthcheck:
      test:
        - CMD
        - curl
        - -f
        - http://localhost:9000/-/health/live/
      interval: 10s
      timeout: 5s
      retries: 5
  postgres:
    image: postgres:18.3-alpine3.23
    restart: unless-stopped
    network_mode: service:authentik
    environment:
      POSTGRES_PASSWORD: ${RANDOM_PG_PASSWORD}
      POSTGRES_USER: app
  worker:
    image: ghcr.io/goauthentik/server:2026.5.5
    restart: unless-stopped
    network_mode: service:authentik
    environment:
      AUTHENTIK_LISTEN__HTTP: 127.0.0.1:9001
      AUTHENTIK_LISTEN__METRICS: 127.0.0.1:9301
      AUTHENTIK_POSTGRESQL__HOST: localhost
      AUTHENTIK_POSTGRESQL__NAME: app
      AUTHENTIK_POSTGRESQL__PASSWORD: ${RANDOM_PG_PASSWORD}
      AUTHENTIK_POSTGRESQL__USER: app
      AUTHENTIK_SECRET_KEY: ${RANDOM_AUTHENTIK_SECRET_KEY}
    volumes:
      - worker-data:/data
      - worker-certs:/certs
    command:
      - worker
volumes:
  data: null
  worker-certs: null
  worker-data: null

Volumes

Authentik stores its data in named Docker volumes, so it survives container restarts and updates:

data mounted at /data: Authentik's application data directory, including uploaded media such as custom branding icons and flow backgrounds served to users.

2. Secret generation

Authentik needs a few randomly generated secrets — for example, database passwords or an internal session key — before it can start. These are referenced from docker-compose.ymlabove but don't live in it, so they need to end up in your .env file. Pick one of the two options below.

Generating secrets…

3. Start Authentik with Docker Compose

From the folder with docker-compose.yml and .env, run:

Terminal

Start Authentik and all its supporting services in the background.

docker compose up -d

The -d flag runs the stack in the background so it keeps running after you close the terminal. Docker will pull the images the first time, which can take a minute or two.

To check on it afterwards: docker compose ps shows whether containers are healthy, and docker compose logs -f follows their logs if something looks wrong. Once it's running, open http://localhost:9000 in your browser.