Reading and bookmarks, checked 2026-09-07
Linkwarden: Docker configuration reference
Self-hosted bookmark manager that keeps permanent snapshots, screenshots and PDFs of saved pages.
At a glance
Ports
Ports| Port | What listens | Source |
|---|
3000 (linkwarden) | HTTP listener for the web app and API. Route the reverse proxy here. | source for port 3000 |
Environment variables
Environment variables| Variable | Required | What it does | Example | Source |
|---|
NEXTAUTH_URL | Yes | Full NextAuth base URL. Must include the /api/v1/auth suffix or authentication and OAuth callbacks fail to resolve. | https://app.example.com/api/v1/auth | source for NEXTAUTH_URL |
NEXTAUTH_SECRET | Yes | Secret used to sign sessions, JWTs and preserved-content tokens. Must be a long random value outside development. | openssl rand -base64 32 | source for NEXTAUTH_SECRET |
POSTGRES_PASSWORD | Yes | Password for the bundled Postgres container in the default compose setup; used to build the internal DATABASE_URL. | | source for POSTGRES_PASSWORD |
BASE_URL | No | Public URL used to build links in outgoing emails such as password reset and verification. | https://app.example.com | source for BASE_URL |
NEXT_PUBLIC_USER_CONTENT_DOMAIN | No | Serves preserved HTML archives from a separate hostname so untrusted archived pages are isolated from the main app origin. | https://usercontent.example.com | source for NEXT_PUBLIC_USER_CONTENT_DOMAIN |
Volumes that must persist
Volumes| Path | What is in it | Source |
|---|
/data/data (linkwarden) | Archives, previews and uploaded files when S3-compatible storage is not configured, plus the app's local STORAGE_FOLDER. | source for /data/data |
/var/lib/postgresql/data (postgres) | Postgres data directory holding links, collections and users. The core data to back up. | source for /var/lib/postgresql/data |
Behind a reverse proxy
- Forward the Upgrade and Connection headers; the official nginx config sets them for the main app location block. source for this reverse-proxy note
- After adding a proxy, update NEXTAUTH_URL to the public https URL and set BASE_URL to the same origin, or auth callbacks and emailed links stay pointed at localhost. source for this reverse-proxy note
- For stronger isolation, serve preserved HTML archives from a separate hostname via NEXT_PUBLIC_USER_CONTENT_DOMAIN, proxied to the same app on a dedicated site block. source for this reverse-proxy note
What it needs alongside it
Dependencies| Dependency | Why | Source |
|---|
| PostgreSQL 16 | Primary database for links, collections and users, addressed through DATABASE_URL. | source for PostgreSQL 16 |
| Meilisearch | Search index for links, run as a separate container and configured through MEILI_HOST and MEILI_MASTER_KEY. | source for Meilisearch |
Release timeline
Releases| Version | Date | Breaking | What changed | Source |
|---|
v2.16.2 | 2026-08-31 | No | Fixes case-insensitive sorting in Docker and other minor bugs. | source for release v2.16.2 |
v2.16.1 | 2026-08-17 | No | Adds support for running the Docker container as a non-root user and fixes Azure AD B2C sign-in issues. | source for release v2.16.1 |
v2.16.0 | 2026-07-28 | No | Release across web and mobile with a round of feature and stability improvements. | source for release v2.16.0 |
v2.15.0 | 2026-07-10 | No | Large mobile update alongside a web app that is much lighter to run. | source for release v2.15.0 |
v2.14.1 | 2026-04-22 | No | Adds support for serving preserved HTML archives from a separate public hostname to isolate untrusted archived pages. | source for release v2.14.1 |
If it is not coming up
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.
Other app references
All app references