Skip to content
Autentico

Docker

Image

Section titled “Image”
ghcr.io/eugenioenko/autentico:latest

The image is a minimal Linux container with just the autentico binary. The entrypoint is ./autentico and the default command is start.

The listener uses the same HTTP timeouts as binary deployments.

Release tags

Section titled “Release tags”

Stable releases update latest and the matching major/minor tag. Prereleases use numbered SemVer suffixes such as v3.0.0-beta.1, v3.0.0-beta.2 or v3.0.0-rc.1. They are marked as prereleases on GitHub and publish only their full Docker version tag, leaving latest and stable major/minor tags unchanged.

For example:

Git tag GitHub release Docker tags
v3.0.0 Latest stable release 3.0.0, 3.0, latest
v3.0.0-beta.1 Prerelease 3.0.0-beta.1
v3.0.0-rc.1 Prerelease 3.0.0-rc.1

Docker version tags omit the leading v. To try a published beta, select its exact image tag, for example ghcr.io/eugenioenko/autentico:3.0.0-beta.1. Before upgrading an existing database to v3, follow the migration guide.

Quick start

Section titled “Quick start”
Terminal window
docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest \
  start --auto-setup

On first run, --auto-setup generates a .env with fresh secrets and persists it on the volume. On subsequent restarts, the existing configuration is reused.

Open http://localhost:9999/onboard to create your admin account.

Custom URL

Section titled “Custom URL”
Terminal window
docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  -e AUTENTICO_APP_URL=https://auth.example.com \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest \
  start --auto-setup

Using a pre-generated .env

Section titled “Using a pre-generated .env”

If you prefer to manage secrets explicitly:

Terminal window
# Generate .env locally (requires the binary)
autentico init --url https://auth.example.com
Terminal window
docker run -d \
  --name autentico \
  -p 9999:9999 \
  -v autentico-data:/app/data \
  --env-file .env \
  --restart unless-stopped \
  ghcr.io/eugenioenko/autentico:latest

Environment variables

Section titled “Environment variables”

All configuration is via Bootstrap Settings. Key variables:

Variable Required Notes
AUTENTICO_APP_URL No Public URL. Defaults to http://localhost:9999. Used in OIDC discovery and redirects.
AUTENTICO_DB_FILE_PATH No SQLite database path. Defaults to ./autentico.db.
AUTENTICO_LISTEN_PORT No Port the server binds to. Defaults to the port in AUTENTICO_APP_URL.
AUTENTICO_TOTP_ENCRYPTION_KEY Yes Persistent base64-encoded 32-byte TOTP encryption key. Keep the same key for migration, restarts and database restores.

Fresh init and fresh --auto-setup generate AUTENTICO_PRIVATE_KEY, AUTENTICO_CSRF_SECRET_KEY, AUTENTICO_ACCESS_TOKEN_SECRET, AUTENTICO_REFRESH_TOKEN_SECRET, and AUTENTICO_TOTP_ENCRYPTION_KEY. Environment-managed production deployments must supply all five and retain them across restarts.

For an existing .env, the updated init command adds only a missing TOTP encryption key, preserving other settings and signing secrets. Startup does not silently add a key to an existing configuration. Before upgrading to v3, follow the migration guide to prepare the persistent key, stop the old service and approve the migration. Existing authenticator enrollments are encrypted in place and preserved.

Health check

Section titled “Health check”
HEALTHCHECK --interval=30s --timeout=5s \
  CMD wget -qO- http://localhost:9999/healthz || exit 1

Logs

Section titled “Logs”

Autentico logs structured HTTP access logs to stdout. Collect them with your Docker logging driver.