Identity and access, checked 2026-10-17
authentik: Docker configuration reference
Self-hosted identity provider with SSO, SAML, OAuth2/OIDC, LDAP and proxy-based forward auth.
At a glance
- Image:
ghcr.io/goauthentik/server - Tags:
2026.8.4,2026.8.3,2026.8.2,2026.5.7,2026.2.7 - Licence: NOASSERTION
- Source: https://github.com/goauthentik/authentik
- Docs: https://docs.goauthentik.io/
Ports
| Port | What listens | Source |
|---|---|---|
9000 | HTTP listener for the web UI, API and outpost communication. Default when COMPOSE_PORT_HTTP is unset. | source for port 9000 |
9443 | HTTPS listener, self-signed by default. Point a reverse proxy here if it expects TLS from authentik. | source for port 9443 |
Environment variables
| Variable | Required | What it does | Example | Source |
|---|---|---|---|---|
AUTHENTIK_SECRET_KEY | Yes | Signing key for sessions and tokens. Losing it invalidates every session. | openssl rand -base64 60 | source for AUTHENTIK_SECRET_KEY |
PG_PASS | Yes | Password for the bundled PostgreSQL user, shared with the server and worker containers. | openssl rand -base64 36 | source for PG_PASS |
AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS | No | Replaces the default trusted proxy CIDR list. Set this if the reverse proxy connects from outside 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12 or 192.168.0.0/16. | 10.0.0.0/8 | source for AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS |
COMPOSE_PORT_HTTP | No | Host port mapped to the internal HTTP listener. Requires a container recreate to take effect. | 80 | source for COMPOSE_PORT_HTTP |
AUTHENTIK_ERROR_REPORTING__ENABLED | No | Sends anonymised error reports upstream. Off by default. | true | source for AUTHENTIK_ERROR_REPORTING__ENABLED |
Volumes that must persist
| Path | What is in it | Source |
|---|---|---|
/var/lib/postgresql/data (postgresql) | The whole dataset: users, flows, applications, outpost configuration. | source for /var/lib/postgresql/data |
/data (server) | Media, blueprints and other server-side state shared with the worker. | source for /data |
/certs (worker) | Certificates the worker manages, including outpost TLS material. | source for /certs |
Behind a reverse proxy
- authentik uses WebSockets for outpost communication. The reverse proxy must support HTTP/1.1 or newer and forward Connection: Upgrade and Upgrade: WebSocket. source for this reverse-proxy note
- Set X-Forwarded-Host (or Host), X-Forwarded-Proto and X-Forwarded-For and have the proxy overwrite any client-supplied copies of these headers. source for this reverse-proxy note
- Forwarded headers are trusted only from a trusted proxy network. A proxy outside the default CIDR list needs AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS set, or headers are ignored. source for this reverse-proxy note
- Outpost containers (used for Proxy, LDAP, RADIUS and RAC providers) are separate deployments that talk to the authentik API over websockets; they are not covered by proxying the main server alone. source for this reverse-proxy note
What it needs alongside it
| Dependency | Why | Source |
|---|---|---|
| PostgreSQL 14 to 18 | Required for application data, configuration, sessions and background task coordination. | source for PostgreSQL 14 to 18 |
Release timeline
| Version | Date | Breaking | What changed | Source |
|---|---|---|---|---|
2026.8.4 | 2026-10-14 | No | Maintenance release: fixes SAML metadata serving the full PEM chain, proxy outpost JWKS fetching over the unix socket and HTTP/2 upstream negotiation. | source for release 2026.8.4 |
2026.8.3 | 2026-09-17 | No | Maintenance release: fixes a policy binding cache invalidation bug, a login_hint redirect loop and X-Forwarded-For values that include ports. | source for release 2026.8.3 |
2026.8.2 | 2026-09-09 | No | Maintenance release with backported security patches, plus fixes for bulk session revocation and an is_active check in auth backends. | source for release 2026.8.2 |
2026.5.7 | 2026-09-09 | No | Maintenance release in the 2026.5 line with backported security patches and Django 5.2.17. | source for release 2026.5.7 |
2026.2.7 | 2026-09-09 | No | Maintenance release in the 2026.2 line with backported security patches and Django 5.2.17. | source for release 2026.2.7 |
2026.8.1 | 2026-09-01 | No | Patch release. See the linked release notes for the fixed issues in the 2026.8 line. | source for release 2026.8.1 |
2026.8.0 | 2026-08-18 | Yes | Forwarded headers are now trusted only from trusted proxy networks. Adds object attributes, agent accounts, user switching and OAuth2 token exchange. | source for release 2026.8.0 |
2026.5.6 | 2026-08-03 | No | Maintenance release in the 2026.5 line. | source for release 2026.5.6 |
2026.5.5 | 2026-07-20 | No | Maintenance release in the 2026.5 line. | source for release 2026.5.5 |
2026.2.6 | 2026-07-13 | No | Maintenance release in the 2026.2 line. | source for release 2026.2.6 |
If it is not coming up
- WebSocket connection to 'wss://<your-domain>:6001/app/...' failed (UI shows "WARNING: Cannot connect to real-time service")
- ECONNREFUSED / ENOTFOUND / connection to server at "postgres" port 5432 failed
- Gate a self-hosted app with Cloudflare Access
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-10-17. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.