Identity and access, checked 2026-10-17
Vaultwarden: Docker configuration reference
Unofficial Bitwarden-compatible password server written in Rust, for use with official Bitwarden clients.
At a glance
- Image:
docker.io/vaultwarden/server - Tags:
1.37.4,1.37.3,1.37.2,1.37.1,1.37.0 - Licence: AGPL-3.0
- Source: https://github.com/dani-garcia/vaultwarden
- Docs: https://github.com/dani-garcia/vaultwarden/wiki
Ports
| Port | What listens | Source |
|---|---|---|
80 | HTTP listener for the web vault and API. Since v1.31.0 WebSocket traffic runs on this port too. | source for port 80 |
Environment variables
| Variable | Required | What it does | Example | Source |
|---|---|---|---|---|
DOMAIN | Yes | Public URL Vaultwarden is served at. Required behind a reverse proxy so it knows it is HTTPS, which attachments and U2F/WebAuthn depend on. | https://vw.example.com | source for DOMAIN |
ADMIN_TOKEN | No | Enables the /admin diagnostics and user-management panel. As an Argon2 PHC string it is hashed rather than compared in plaintext. | openssl rand -base64 48 | source for ADMIN_TOKEN |
SIGNUPS_ALLOWED | No | Allows new account signups. The wiki compose example says to set it to false after you have created your account. | false | source for SIGNUPS_ALLOWED |
ENABLE_WEBSOCKET | No | Turns the notification hub on or off. On by default since v1.29.0; the old WEBSOCKET_ENABLED and WEBSOCKET_PORT variables are ignored on that and later versions. | true | source for ENABLE_WEBSOCKET |
DATABASE_URL | No | Connection string. Defaults to a local SQLite file at DATA_FOLDER/db.sqlite3 if unset; MySQL and PostgreSQL are both supported. | postgresql://user:password@host/database_name | source for DATABASE_URL |
Volumes that must persist
| Path | What is in it | Source |
|---|---|---|
/data | SQLite database, attachments, sends, icon cache, RSA keys and config.json from the admin panel. Defaults per .env.template. | source for /data |
Behind a reverse proxy
- Enabled by default since v1.29.0. Since v1.31.0 port 3012 is no longer supported and WebSockets use the main HTTP port. Proxies must pass the Upgrade and Connection headers. source for this reverse-proxy note
- Some proxies such as Traefik pass WebSocket headers by default; nginx and Apache HTTPd must be configured to pass Upgrade and Connection. source for this reverse-proxy note
- Set DOMAIN to the externally visible https:// URL. An unset or http DOMAIN behind a TLS-terminating proxy breaks attachment downloads and WebAuthn registration. source for this reverse-proxy note
- Test in the browser network tab (WS filter): after login a 101 response on /notifications/hub means it works; any other status means a misconfiguration. source for this reverse-proxy note
What it needs alongside it
| Dependency | Why | Source |
|---|---|---|
| None required; SQLite, MySQL or PostgreSQL | SQLite is the default and needs no separate container. MySQL and PostgreSQL are opt-in via DATABASE_URL. | source for None required; SQLite, MySQL or PostgreSQL |
Release timeline
| Version | Date | Breaking | What changed | Source |
|---|---|---|---|---|
1.37.4 | 2026-10-05 | Yes | Security fixes for seven advisories including organization member revocation (High). With IP_HEADER=X-Forwarded-For the client IP is now the rightmost untrusted address. | source for release 1.37.4 |
1.37.3 | 2026-09-13 | No | Fixes password change with newer web vault, adds SSO_SIGNUPS_ALLOWED and admin 2FA reset, and rate limits prelogin and auth request endpoints. | source for release 1.37.3 |
1.37.2 | 2026-08-22 | Yes | Required for compatibility with Bitwarden clients v2026.8.0 and newer; older Vaultwarden versions will have issues with those clients. | source for release 1.37.2 |
1.37.1 | 2026-07-29 | No | Patch resolving an invites regression; reverts any local workarounds applied for it. | source for release 1.37.1 |
1.37.0 | 2026-07-24 | Yes | Security fixes including an SSRF via the icon endpoint; also required for newer client compatibility. | source for release 1.37.0 |
1.36.0 | 2026-05-03 | Yes | Security fixes for SSO login CSRF, GHSA-pfp2-jhgq-6hg5 and GHSA-w6h6-8r66-hcv7. Update as soon as practical. | source for release 1.36.0 |
1.35.8 | 2026-04-25 | No | Fixes a dummy-organisation master password policy bug and an invalid refresh token response. | source for release 1.35.8 |
If it is not coming up
- WebSocket connection to 'wss://<your-domain>:6001/app/...' failed (UI shows "WARNING: Cannot connect to real-time service")
- Coolify volume data lost after redeploy / a new empty volume is created every deploy
- Gate a self-hosted app with Cloudflare Access
Read from the upstream documentation, repository and container registry by Keita Emsden on 2026-10-17. Every row links the page it came from. Upstream changes without telling anyone, so check the source link before you rely on a value.