Identity and access, checked 2026-09-07
Vaultwarden: Docker configuration reference
Unofficial Bitwarden-compatible password server written in Rust, for use with official Bitwarden clients.
At a glance
Ports
Ports| Port | What listens | Source |
|---|
80 | HTTP listener for the web vault, API and, since v1.29.0, the WebSocket notifications hub on the same port. | source for port 80 |
Environment variables
Environment variables| Variable | Required | What it does | Example | Source |
|---|
DOMAIN | Yes | Public URL Vaultwarden is served at. Required behind a reverse proxy so it knows it is HTTPS, which attachments and U2F/WebAuthn depend on. | https://vw.example.com | source for DOMAIN |
ADMIN_TOKEN | No | Enables the /admin diagnostics and user-management panel. As an Argon2 PHC string it is hashed rather than compared in plaintext. | openssl rand -base64 48 | source for ADMIN_TOKEN |
SIGNUPS_ALLOWED | No | Allows new account signups. The wiki setup example recommends turning this off immediately after creating the first account. | false | source for SIGNUPS_ALLOWED |
ENABLE_WEBSOCKET | No | Turns the notification hub on or off. On by default since v1.29.0; the old WEBSOCKET_ENABLED and WEBSOCKET_PORT variables are ignored on that and later versions. | true | source for ENABLE_WEBSOCKET |
DATABASE_URL | No | Connection string. Defaults to a local SQLite file at DATA_FOLDER/db.sqlite3 if unset; MySQL and PostgreSQL are both supported. | postgresql://user:password@host/database_name | source for DATABASE_URL |
Volumes that must persist
Volumes| Path | What is in it | Source |
|---|
/data | SQLite database (or config for an external database), attachments, sends, icon cache and the RSA keypair. Every vault item lives here. | source for /data |
Behind a reverse proxy
- Enabled by default since v1.29.0, and since v1.31.0 support for the separate port 3012 is removed and WebSocket traffic runs on the main HTTP port. The proxy must still forward Upgrade and Connection. source for this reverse-proxy note
- Traefik forwards WebSocket upgrades by default; nginx and Apache HTTPd need the Upgrade/Connection headers configured explicitly or clients silently fall back to polling. source for this reverse-proxy note
- Set DOMAIN to the externally visible https:// URL. An unset or http DOMAIN behind a TLS-terminating proxy breaks attachment downloads and WebAuthn registration. source for this reverse-proxy note
- Test the upgrade by watching the browser network tab for a 101 response on /notifications/hub after login; anything else means the proxy is not passing the upgrade through. source for this reverse-proxy note
What it needs alongside it
Release timeline
Releases| Version | Date | Breaking | What changed | Source |
|---|
1.37.2 | 2026-08-22 | Yes | Required for compatibility with Bitwarden clients v2026.8.0 and newer; older Vaultwarden versions will have issues with those clients. | source for release 1.37.2 |
1.37.1 | 2026-07-29 | No | Patch resolving an invites regression; reverts any local workarounds applied for it. | source for release 1.37.1 |
1.37.0 | 2026-07-24 | Yes | Security fixes including an SSRF via the icon endpoint; also required for newer client compatibility. | source for release 1.37.0 |
1.36.0 | 2026-05-03 | Yes | Security fixes for SSO login CSRF, GHSA-pfp2-jhgq-6hg5 and GHSA-w6h6-8r66-hcv7. Update as soon as practical. | source for release 1.36.0 |
1.35.8 | 2026-04-25 | No | Fixes a dummy-organisation master password policy bug and an invalid refresh token response. | source for release 1.35.8 |
If it is not coming up
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-09-07. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.
Other app references
All app references