Skip to main content

Docker Compose installation

This installation method is for test setups and small-scale production setups.

Requirements​

Video​

View our video about installing authentik on Docker.

Download the Compose file​

To download the latest compose.yml open your terminal, navigate to the directory of your choice, and then run the following command:

wget https://docs.goauthentik.io/compose.yml

Generate PostgreSQL password and secret key​

If this is a fresh authentik installation, you need to generate a PostgreSQL password and a secret key. Use a secure password generator of your choice such as pwgen, or you can use openssl as below.

Run the following commands to generate a PostgreSQL password and secret key and write them to your .env file:

echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env
echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env
info

Because of a PostgreSQL limitation, only passwords up to 99 chars are supported. See: https://www.postgresql.org/message-id/09512C4F-8CB9-4021-B455-EF4C4F0D55A0@amazon.com

To enable error reporting, run the following command:

echo "AUTHENTIK_ERROR_REPORTING__ENABLED=true" >> .env

For an explanation about what each service in the Docker Compose file does, see Architecture.

Configure custom ports​

By default, authentik listens internally on port 9000 for HTTP and 9443 for HTTPS. To use different exposed ports such as 80 and 443, you can set the following variables in .env:

COMPOSE_PORT_HTTP=80
COMPOSE_PORT_HTTPS=443

See Configuration to change the internal ports. Be sure to run docker compose up -d to rebuild with the new port numbers.

Docker socket​

By default, the authentik Docker Compose file mounts the Docker socket to the authentik worker container:

- /var/run/docker.sock:/var/run/docker.sock

This is used for automatic deployment and management of authentik Outposts.

Mounting the Docker socket to a container comes with some inherent security risks. To reduce these risks, you can utilize a Docker Socket Proxy as an additional layer of protection.

Alternatively, you can remove this mount and instead manually deploy and manage outposts.

It is also recommended to configure global email settings. These are used by authentik to notify administrators about alerts, configuration issues and new releases. They can also be used by Email stages to send verification/recovery emails.

For more information, refer to our Email configuration documentation.

Install and start authentik​

warning

All internal operations use UTC. Times displayed in the UI are automatically localized for the user. Do not update or mount /etc/timezone or /etc/localtime in the authentik containers; it will cause problems with OAuth and SAML authentication, as seen this GitHub issue.

After you have downloaded the docker-compose.yml file, generated a password and a secret key, and optionally configured your global email, run these commands to retrieve and install the current version of authentik:

docker compose pull
docker compose up -d

The compose.yml file statically references the latest version available at the time of downloading the compose file. Each time you upgrade to a newer version of authentik, you download a new compose.yml file, which points to the latest available version. For more information, refer to the Upgrading section in the Release Notes.

Access authentik​

To start the initial setup, navigate to http://<your server's IP or hostname>:9000/if/flow/initial-setup/.

Initial setup in browser

You will get a Not Found error if initial setup URL doesn't include the trailing forward slash /. Also verify that the authentik server, worker, and PostgreSQL database are running and healthy. Review additional tips in our troubleshooting docs.

There you are prompted to set a password for the akadmin user (the default user).

First steps in authentik​

You are now ready to add your first application and its provider. Then you'll want to add users and define groups, roles, and RBAC guidelines.

To view a typical workflow for adding applications and users, with helpful context and explanations for each step, refer to the First Steps tutorial.

📄️ Potatoes

They're great!