Skip to content

ONLYOFFICE Workspace ONLYOFFICE Workspace

Description / nameInput element
Container Registry
Container Configuration Root Path
Timezone
User ID
Group ID
ONLYOFFICE Workspace /config Path

Build Status Last Commit OCI Pulls mlock Required

Self-hosted collaborative office workspace combining Documents, Projects, CRM, Mail, Calendar, People, Control Panel, and real-time ONLYOFFICE Document Server editors.

This is the full ONLYOFFICE Workspace portal (users, Documents, Projects, CRM, Calendar, People, and Control Panel), with Document Server included by default. If you already run Nextcloud, Seafile, or OwnCloud and only want the standalone document editors to connect to it, see ONLYOFFICE Document Server (daemonless/onlyoffice) instead.
Registry ghcr.io/daemonless/onlyoffice-workspace
Daemonless daemonless/onlyoffice-workspace
Source ONLYOFFICE/CommunityServer
Website www.onlyoffice.com/workspace.aspx

Version Tags

Tag Description Best For
latest Built from the official upstream ONLYOFFICE Community Server and Control Panel releases with FreeBSD-native HyperFastCGI. Most users — recommended.

Parts

Service Image Role
onlyoffice-workspace ghcr.io/daemonless/onlyoffice-workspace:${ONLYOFFICE_WORKSPACE_TAG:-latest} Portal web UI, API, Control Panel, and internal Redis cache docs
onlyoffice-documentserver ghcr.io/daemonless/onlyoffice:pkg Online collaborative editors for documents, spreadsheets, and presentations docs
mariadb ghcr.io/daemonless/mariadb:latest Portal database (users, projects, CRM, calendar, and metadata) docs
postgres ghcr.io/daemonless/postgres:16 Document Server database for real-time collaborative editing state docs

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

Database Where ONLYOFFICE Workspace keeps its portal data. The default runs its own MariaDB. The document editors keep their editing state in a PostgreSQL of their own, which is always built in.

Document editors Online collaborative editors for Word, Excel and PowerPoint files inside Documents.

onlyoffice-workspace:latest · onlyoffice:pkg · mariadb:latest · postgres:16 — data in /containers/onlyoffice-workspace/data, /containers/onlyoffice-workspace/docserver, /containers/onlyoffice-workspace/mariadb, /containers/onlyoffice-workspace/postgres

A MariaDB of its own, on the stack's private network. Runs ONLYOFFICE Document Server and its PostgreSQL alongside the portal.

1. Save as .env and fill in what is empty:

1
2
3
4
5
6
7
8
9
WORKSPACE_DATA_LOCATION=/containers/onlyoffice-workspace/data
DOCSERVER_DATA_LOCATION=/containers/onlyoffice-workspace/docserver
MARIADB_DATA_LOCATION=/containers/onlyoffice-workspace/mariadb
POSTGRES_DATA_LOCATION=/containers/onlyoffice-workspace/postgres
DB_PASSWORD=
DB_ROOT_PASSWORD=
JWT_SECRET=
CORE_MACHINEKEY=
TZ=UTC

2. Save as compose.yaml:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
name: onlyoffice-workspace

services:
  onlyoffice-workspace:
    image: ghcr.io/daemonless/onlyoffice-workspace:${ONLYOFFICE_WORKSPACE_TAG:-latest}
    container_name: onlyoffice-workspace
    network_mode: host
    restart: unless-stopped
    annotations:
      org.freebsd.jail.allow.mlock: "true"
    depends_on:
      - mariadb
      - onlyoffice-documentserver
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ:-UTC}
      - HTTP_PORT=8080
      - MYSQL_SERVER_HOST=${MARIADB_HOSTNAME:-127.0.0.1}
      - MYSQL_SERVER_PORT=${MARIADB_PORT:-3306}
      - MYSQL_SERVER_DB_NAME=${MARIADB_DATABASE:-onlyoffice}
      - MYSQL_SERVER_USER=${MARIADB_USER:-onlyoffice}
      - MYSQL_SERVER_PASS=${DB_PASSWORD}
      - MYSQL_SERVER_ROOT_PASS=${DB_ROOT_PASSWORD:-}
      - DOCUMENT_SERVER_HOST=${DOCUMENT_SERVER_HOSTNAME-127.0.0.1}
      - DOCUMENT_SERVER_PORT=8083
      - JWT_ENABLED=true
      - JWT_SECRET=${JWT_SECRET}
      - JWT_HEADER=AuthorizationJwt
      - CORE_MACHINEKEY=${CORE_MACHINEKEY:-}
    volumes:
      - ${WORKSPACE_DATA_LOCATION}:/config

  onlyoffice-documentserver:
    image: ghcr.io/daemonless/onlyoffice:pkg
    container_name: onlyoffice-documentserver
    network_mode: host
    restart: unless-stopped
    depends_on:
      - postgres
    environment:
      - DB_HOST=${POSTGRES_HOSTNAME:-127.0.0.1}
      - DB_PORT=5432
      - DB_NAME=onlyoffice
      - DB_USER=onlyoffice
      - DB_PWD=${DB_PASSWORD}
      - HTTP_PORT=8083
      - JWT_ENABLED=true
      - JWT_SECRET=${JWT_SECRET}
      - JWT_HEADER=AuthorizationJwt
      - TZ=${TZ:-UTC}
    volumes:
      - ${DOCSERVER_DATA_LOCATION}:/config

  mariadb:
    image: ghcr.io/daemonless/mariadb:latest
    container_name: onlyoffice-mariadb
    network_mode: host
    restart: unless-stopped
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=${TZ:-UTC}
      - MYSQL_ROOT_PASSWORD=${DB_ROOT_PASSWORD}
      - MYSQL_DATABASE=onlyoffice
      - MYSQL_USER=onlyoffice
      - MYSQL_PASSWORD=${DB_PASSWORD}
    volumes:
      - ${MARIADB_DATA_LOCATION}:/config

  postgres:
    image: ghcr.io/daemonless/postgres:16
    container_name: onlyoffice-postgres
    network_mode: host
    restart: unless-stopped
    annotations:
      org.freebsd.jail.allow.sysvipc: "true"
    environment:
      - POSTGRES_DB=onlyoffice
      - POSTGRES_USER=onlyoffice
      - POSTGRES_PASSWORD=${DB_PASSWORD}
      - POSTGRES_HOST_AUTH_METHOD=trust
    volumes:
      - ${POSTGRES_DATA_LOCATION}:/var/lib/postgresql/data

Then run podman-compose up -d.

Database Where ONLYOFFICE Workspace keeps its portal data. The default runs its own MariaDB. The document editors keep their editing state in a PostgreSQL of their own, which is always built in.

Document editors Online collaborative editors for Word, Excel and PowerPoint files inside Documents.

onlyoffice-workspace:latest · onlyoffice:pkg · mariadb:latest · postgres:16 — data in /containers/onlyoffice-workspace/data, /containers/onlyoffice-workspace/docserver, /containers/onlyoffice-workspace/mariadb, /containers/onlyoffice-workspace/postgres

A MariaDB of its own, on the stack's private network. Runs ONLYOFFICE Document Server and its PostgreSQL alongside the portal.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
# .env

DIRECTOR_PROJECT=onlyoffice-workspace
PUID=1000
PGID=1000
TZ=UTC
HTTP_PORT=8080
MYSQL_SERVER_HOST=127.0.0.1
MYSQL_SERVER_PORT=3306
MYSQL_SERVER_DB_NAME=onlyoffice
MYSQL_SERVER_USER=onlyoffice
MYSQL_SERVER_PASS=<MYSQL_SERVER_PASS>
MYSQL_SERVER_ROOT_PASS=<MYSQL_SERVER_ROOT_PASS>
DOCUMENT_SERVER_HOST=${DOCUMENT_SERVER_HOSTNAME-127.0.0.1}
DOCUMENT_SERVER_PORT=8083
JWT_ENABLED=true
JWT_SECRET=<JWT_SECRET>
JWT_HEADER=AuthorizationJwt
CORE_MACHINEKEY=<CORE_MACHINEKEY>
WORKSPACE_DATA_LOCATION=/containers/onlyoffice-workspace/data
DOCSERVER_DATA_LOCATION=/containers/onlyoffice-workspace/docserver
MARIADB_DATA_LOCATION=/containers/onlyoffice-workspace/mariadb
POSTGRES_DATA_LOCATION=/containers/onlyoffice-workspace/postgres

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
# appjail-director.yml

options:
  - alias:
  - ip4_inherit:
services:
  onlyoffice-workspace:
    name: onlyoffice_workspace
    options:
      - container: 'args:--pull'
      - template: !ENV '${PWD}/template.conf'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
        - HTTP_PORT: !ENV '${HTTP_PORT}'
        - MYSQL_SERVER_HOST: !ENV '${MYSQL_SERVER_HOST}'
        - MYSQL_SERVER_PORT: !ENV '${MYSQL_SERVER_PORT}'
        - MYSQL_SERVER_DB_NAME: !ENV '${MYSQL_SERVER_DB_NAME}'
        - MYSQL_SERVER_USER: !ENV '${MYSQL_SERVER_USER}'
        - MYSQL_SERVER_PASS: !ENV '${MYSQL_SERVER_PASS}'
        - MYSQL_SERVER_ROOT_PASS: !ENV '${MYSQL_SERVER_ROOT_PASS}'
        - DOCUMENT_SERVER_HOST: !ENV '${DOCUMENT_SERVER_HOST}'
        - DOCUMENT_SERVER_PORT: !ENV '${DOCUMENT_SERVER_PORT}'
        - JWT_ENABLED: !ENV '${JWT_ENABLED}'
        - JWT_SECRET: !ENV '${JWT_SECRET}'
        - JWT_HEADER: !ENV '${JWT_HEADER}'
        - CORE_MACHINEKEY: !ENV '${CORE_MACHINEKEY}'
        - WORKSPACE_DATA_LOCATION: !ENV '${WORKSPACE_DATA_LOCATION}'
        - DOCSERVER_DATA_LOCATION: !ENV '${DOCSERVER_DATA_LOCATION}'
        - MARIADB_DATA_LOCATION: !ENV '${MARIADB_DATA_LOCATION}'
        - POSTGRES_DATA_LOCATION: !ENV '${POSTGRES_DATA_LOCATION}'
    volumes:
      - ONLYOFFICE_WORKSPACE_CONFIG_PATH: /config
  mariadb:
    name: mariadb
    options:
      - from: ghcr.io/daemonless/mariadb:latest
      - template: !ENV '${PWD}/template.conf'
    oci:
      environment:
        - PUID: "1000"
        - PGID: "1000"
        - TZ: !ENV '${TZ}'
        - MYSQL_ROOT_PASSWORD: !ENV '${DB_ROOT_PASSWORD}'
        - MYSQL_DATABASE: "onlyoffice"
        - MYSQL_USER: "onlyoffice"
        - MYSQL_PASSWORD: !ENV '${DB_PASSWORD}'
    volumes:
      - mariadb_data: /config
  postgres:
    name: postgres
    options:
      - from: ghcr.io/daemonless/postgres:16
      - template: !ENV '${PWD}/postgres-template.conf'
    oci:
      environment:
        - POSTGRES_DB: "onlyoffice"
        - POSTGRES_USER: "onlyoffice"
        - POSTGRES_PASSWORD: !ENV '${DB_PASSWORD}'
        - POSTGRES_HOST_AUTH_METHOD: "trust"
    volumes:
      - postgres_data: /var/lib/postgresql/data
  onlyoffice-documentserver:
    name: onlyoffice_documentserver
    options:
      - from: ghcr.io/daemonless/onlyoffice:pkg
      - template: !ENV '${PWD}/template.conf'
    oci:
      environment:
        - DB_HOST: !ENV '${POSTGRES_HOSTNAME:-127.0.0.1}'
        - DB_PORT: "5432"
        - DB_NAME: "onlyoffice"
        - DB_USER: "onlyoffice"
        - DB_PWD: !ENV '${DB_PASSWORD}'
        - HTTP_PORT: "8083"
        - JWT_ENABLED: "true"
        - JWT_SECRET: !ENV '${JWT_SECRET}'
        - JWT_HEADER: "AuthorizationJwt"
        - TZ: !ENV '${TZ}'
    volumes:
      - docserver_data: /config
volumes:
  ONLYOFFICE_WORKSPACE_CONFIG_PATH:
    device: '/containers/onlyoffice-workspace'
  mariadb_data:
    device: !ENV '${MARIADB_DATA_LOCATION}'
  postgres_data:
    device: !ENV '${POSTGRES_DATA_LOCATION}'
  docserver_data:
    device: !ENV '${DOCSERVER_DATA_LOCATION}'

1
2
3
4
5
6
7
# Makejail

ARG tag=latest

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/onlyoffice-workspace:${tag}

1
2
3
4
5
6
7
# template.conf

exec.start: "/bin/sh /etc/rc"
exec.stop: "/bin/sh /etc/rc.shutdown jail"
mount.devfs
persist
allow.mlock

Save the files above, then run appjail-director up.

Setup Instructions

Modules not included. External CalDAV/CardDAV sync (Radicale) is not included; the built-in Calendar and People modules work without it. The Mail module (external IMAP/SMTP aggregation) is not included yet.

Interactive Configuration

Parameters

Environment Variables

Variable Default Description
PUID 1000 User ID for the application process
PGID 1000 Group ID for the application process
TZ UTC Timezone for the containers
HTTP_PORT 8080 HTTP listen port for the Workspace portal (default: 8080)
MYSQL_SERVER_HOST 127.0.0.1 MariaDB server hostname
MYSQL_SERVER_PORT 3306 MariaDB server port (default: 3306)
MYSQL_SERVER_DB_NAME onlyoffice MariaDB database name (default: onlyoffice)
MYSQL_SERVER_USER onlyoffice MariaDB username (default: onlyoffice)
MYSQL_SERVER_PASS <MYSQL_SERVER_PASS> MariaDB password
MYSQL_SERVER_ROOT_PASS <MYSQL_SERVER_ROOT_PASS> MariaDB root password for applying global sql_mode and max_allowed_packet settings at startup
DOCUMENT_SERVER_HOST ${DOCUMENT_SERVER_HOSTNAME-127.0.0.1} Document Server hostname
DOCUMENT_SERVER_PORT 8083 Document Server HTTP port (default: 8083)
JWT_ENABLED true Enable JWT validation with Document Server (default: true)
JWT_SECRET <JWT_SECRET> Shared JWT secret between Workspace and Document Server
JWT_HEADER AuthorizationJwt JWT HTTP header name (default: AuthorizationJwt)
CORE_MACHINEKEY <CORE_MACHINEKEY> Portal encryption and token signing key (generated and persisted on first start if unset)
WORKSPACE_DATA_LOCATION /containers/onlyoffice-workspace/data Path to store ONLYOFFICE Workspace portal data, uploads, and logs
DOCSERVER_DATA_LOCATION /containers/onlyoffice-workspace/docserver Path to store Document Server cache and data
MARIADB_DATA_LOCATION /containers/onlyoffice-workspace/mariadb Path to store MariaDB database files
POSTGRES_DATA_LOCATION /containers/onlyoffice-workspace/postgres Path to store PostgreSQL database files
DB_PASSWORD <DB_PASSWORD> Database password for MariaDB and PostgreSQL
DB_ROOT_PASSWORD <DB_ROOT_PASSWORD> MariaDB root password (built-in MariaDB only)
MARIADB_HOSTNAME `` Where the portal finds MariaDB (fjord sets this for the built-in one; 127.0.0.1 on host networking)
MARIADB_PORT `` MariaDB port (your own MariaDB)
MARIADB_DATABASE `` Database name (your own MariaDB)
MARIADB_USER `` Database user (your own MariaDB)
POSTGRES_HOSTNAME `` Where Document Server finds PostgreSQL (fjord sets this; 127.0.0.1 on host networking)
DOCUMENT_SERVER_HOSTNAME `` Where the portal finds Document Server (127.0.0.1 on host networking; empty disables online editors)

Volumes

Path Description
/config Persistent portal data, uploads, certificates, and logs

Implementation Details

  • Architectures: amd64
  • User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
  • Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).
  • mlock: Requires --annotation 'org.freebsd.jail.allow.mlock=true' (ocijail 0.5.0+)

Need help? Join our Discord community.