Skip to main content

Docker

Image​

ghcr.io/eugenioenko/autentico:latest

The image is a minimal Linux container with just the autentico binary. The entrypoint is ./autentico and the default command is start.

Quick start​

docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest \
  start --auto-setup

On first run, --auto-setup generates a .env with fresh secrets and persists it on the volume. On subsequent restarts, the existing configuration is reused.

Open http://localhost:9999/onboard to create your admin account.

Custom URL​

docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  -e AUTENTICO_APP_URL=https://auth.example.com \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest \
  start --auto-setup

Using a pre-generated .env​

If you prefer to manage secrets explicitly:

# Generate .env locally (requires the binary)
autentico init --url https://auth.example.com
docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  --env-file .env \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest

Environment variables​

All configuration is via Bootstrap Settings. Key variables:

VariableRequiredNotes
AUTENTICO_APP_URLNoPublic URL. Defaults to http://localhost:9999. Used in OIDC discovery and redirects.
AUTENTICO_DB_FILE_PATHNoSQLite database path. Defaults to ./autentico.db.
AUTENTICO_LISTEN_PORTNoPort the server binds to. Defaults to the port in AUTENTICO_APP_URL.

When using --auto-setup, secrets (AUTENTICO_PRIVATE_KEY, AUTENTICO_CSRF_SECRET_KEY, AUTENTICO_ACCESS_TOKEN_SECRET, AUTENTICO_REFRESH_TOKEN_SECRET) are generated automatically. When using a pre-generated .env or inline environment variables, all four are required.

Health check​

HEALTHCHECK --interval=30s --timeout=5s \
  CMD wget -qO- http://localhost:9999/healthz || exit 1

Logs​

Autentico logs structured HTTP access logs to stdout. Collect them with your Docker logging driver.

tip

For production setups with a reverse proxy, see Docker Compose.

Changing AUTENTICO_APP_URL after first run leaves the admin client registered with the old callback URL. Delete the volume and start fresh: docker stop autentico && docker rm autentico && docker volume rm autentico-data.