Docs and wikis, checked 2026-09-07
BookStack: Docker configuration reference
Self-hosted wiki platform organising content into books, chapters and pages with a WYSIWYG editor.
At a glance
Ports
Ports| Port | What listens | Source |
|---|
80 | HTTP web interface inside the container. The LinuxServer.io compose example maps host port 6875 to it. | source for port 80 |
Environment variables
Environment variables| Variable | Required | What it does | Example | Source |
|---|
APP_URL | Yes | The protocol, host and port BookStack is accessed on. Wrong values break generated links and static asset URLs. | https://bookstack.example.com | source for APP_URL |
APP_KEY | Yes | Session and cookie encryption key, generated once with the image's own artisan command and then kept stable. | base64:generated_value | source for APP_KEY |
DB_HOST | Yes | Hostname of the MySQL or MariaDB server BookStack connects to. | bookstack_db | source for DB_HOST |
DB_DATABASE | Yes | Name of the database BookStack uses; the application manages its own schema inside it. | bookstackapp | source for DB_DATABASE |
QUEUE_CONNECTION | No | Optional queue driver override for background jobs such as exports and notifications. | | source for QUEUE_CONNECTION |
Volumes that must persist
Volumes| Path | What is in it | Source |
|---|
/config | Application config, uploaded images and attachments, and the copied .env file. Loses the whole install if not persisted. | source for /config |
Behind a reverse proxy
- APP_URL must match the externally visible address exactly; changing it later requires running the bookstack:update-url artisan command to fix stored links. source for this reverse-proxy note
- Docker installs needing a subdirectory path should configure it at the reverse proxy rather than following the plain webserver subdirectory guide. source for this reverse-proxy note
What it needs alongside it
Dependencies| Dependency | Why | Source |
|---|
| MySQL 8.0 or MariaDB 10.6 or newer | Required relational database for all BookStack content and settings; a single database with full permissions is advised. | source for MySQL 8.0 or MariaDB 10.6 or newer |
Release timeline
Releases| Version | Date | Breaking | What changed | Source |
|---|
v26.05.4 | 2026-08-24 | No | Security release fixing attachment permission checks and misuse of drawing request endpoints. | source for release v26.05.4 |
v26.05.3 | 2026-07-29 | No | Security release for external authentication user matching across OIDC, SAML2 and LDAP. | source for release v26.05.3 |
v26.05.2 | 2026-07-02 | No | Security release addressing URL filtering, redirect handling and permission checking edge cases. | source for release v26.05.2 |
v26.05.1 | 2026-06-09 | No | Security release fixing attachment requests that could leak metadata the user did not have permission to see. | source for release v26.05.1 |
v26.05 | 2026-05-28 | Yes | Revision access is now controlled separately from page access, which can remove revision visibility some users had before. Font changes may need a storage/fonts permission fix for PDF export. | source for release v26.05 |
If it is not coming up
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.
Other app references
All app references