Wagtail

Description / name	Input element
Container Registry
Container Configuration Root Path
Timezone
User ID
Group ID
Wagtail Host Port
Wagtail /config Path

Wagtail is an open source content management system built on Django, with a strong community and commercial support. It's focused on user experience, and offers precise control for designers and developers.


Port	`8080`
Registry	`ghcr.io/daemonless/wagtail`
Daemonless	daemonless/wagtail
Source	wagtail/wagtail
Website	wagtail.org

Version Tags

Tag	Description	Best For
`pkg`	FreeBSD Quarterly. Uses stable, tested packages.	Production stability.
`pkg-latest`	FreeBSD Latest. Rolling package updates.	Staying current.

Before deploying, ensure your host environment is ready. See the Quick Start Guide for host setup instructions, including the security model for host vs. container privileges.

Deployment

Podman AppJail Bastille

Compose CLI Ansible

services:
  wagtail:
    image: "ghcr.io/daemonless/wagtail:latest"
    container_name: wagtail
    environment:
      - PUID=1000  # User ID for the application process
      - PGID=1000  # Group ID for the application process
      - TZ=UTC  # Timezone for the container
      - WAGTAIL_SUPERUSER_NAME=admin  # If set with WAGTAIL_SUPERUSER_PASSWORD, creates an admin superuser on start.
      - WAGTAIL_SUPERUSER_PASSWORD=changeme  # Password for the admin superuser (with WAGTAIL_SUPERUSER_NAME).
      - DATABASE_URL=  # Use Postgres instead of the default SQLite, e.g. postgres://user:pass@host:5432/db. Unset = SQLite in /config.
      - SECRET_KEY=<SECRET_KEY>  # Django SECRET_KEY. Auto-generated and persisted to /config/.secret_key if unset.
      - WAGTAIL_ALLOWED_HOSTS=*  # Comma-separated Django ALLOWED_HOSTS.
      - WAGTAIL_WORKERS=3  # Number of gunicorn workers.
    volumes:
      - "/path/to/containers/wagtail:/config"
    ports:
      - "8080:8080"
    # always (not unless-stopped) so FreeBSD's podman rc.d auto-starts it at boot
    restart: always

Save as compose.yaml, then run podman-compose up -d.

podman run -d --name wagtail \
  -p 8080:8080 \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -e WAGTAIL_SUPERUSER_NAME=admin \
  -e WAGTAIL_SUPERUSER_PASSWORD=changeme \
  -e DATABASE_URL= \
  -e SECRET_KEY=<SECRET_KEY> \
  -e WAGTAIL_ALLOWED_HOSTS=* \
  -e WAGTAIL_WORKERS=3 \
  -v /path/to/containers/wagtail:/config \
  ghcr.io/daemonless/wagtail:latest

Save as run.sh, then run sh run.sh.

- name: Deploy wagtail
  containers.podman.podman_container:
    name: wagtail
    image: "ghcr.io/daemonless/wagtail:latest"
    state: started
    restart_policy: always
    env:
      PUID: "1000"
      PGID: "1000"
      TZ: "UTC"
      WAGTAIL_SUPERUSER_NAME: "admin"
      WAGTAIL_SUPERUSER_PASSWORD: "changeme"
      DATABASE_URL: ""
      SECRET_KEY: "<SECRET_KEY>"
      WAGTAIL_ALLOWED_HOSTS: "*"
      WAGTAIL_WORKERS: "3"
    ports:
      - "8080:8080"
    volumes:
      - "/path/to/containers/wagtail:/config"

Save as wagtail-deploy.yaml, then run ansible-playbook wagtail-deploy.yaml.

Warning

Exposing ports in AppJail means that your service can be reached from remote hosts. If that is not your intention, do not expose the ports and communicate with the service using the jail's IPv4 address or hostname assigned by the virtual network.

Director CLI

# .env

DIRECTOR_PROJECT=wagtail
PUID=1000
PGID=1000
TZ=UTC
WAGTAIL_SUPERUSER_NAME=admin
WAGTAIL_SUPERUSER_PASSWORD=changeme
DATABASE_URL=
SECRET_KEY=<SECRET_KEY>
WAGTAIL_ALLOWED_HOSTS=*
WAGTAIL_WORKERS=3

# appjail-director.yml

options:
  - virtualnet: ':<random> default'
  - nat:
services:
  wagtail:
    name: wagtail
    options:
      - container: 'args:--pull'
      - expose: '8080:8080 proto:tcp'
    oci:
      user: root
      environment:
        - PUID: !ENV '${PUID}'
        - PGID: !ENV '${PGID}'
        - TZ: !ENV '${TZ}'
        - WAGTAIL_SUPERUSER_NAME: !ENV '${WAGTAIL_SUPERUSER_NAME}'
        - WAGTAIL_SUPERUSER_PASSWORD: !ENV '${WAGTAIL_SUPERUSER_PASSWORD}'
        - DATABASE_URL: !ENV '${DATABASE_URL}'
        - SECRET_KEY: !ENV '${SECRET_KEY}'
        - WAGTAIL_ALLOWED_HOSTS: !ENV '${WAGTAIL_ALLOWED_HOSTS}'
        - WAGTAIL_WORKERS: !ENV '${WAGTAIL_WORKERS}'
    volumes:
      - WAGTAIL_CONFIG_PATH: /config
volumes:
  WAGTAIL_CONFIG_PATH:
    device: '/path/to/containers/wagtail'

# Makejail

ARG tag=pkg

OPTION container=boot
OPTION overwrite=force
OPTION from=ghcr.io/daemonless/wagtail:${tag}

Save the files above, then run appjail-director up.

appjail oci run -Pd \
  -o overwrite=force \
  -o container="args:--pull" \
  -o virtualnet=":<random> default" \
  -o nat \
  -o expose="8080:8080 proto:tcp" \
  -e PUID=1000 \
  -e PGID=1000 \
  -e TZ=UTC \
  -e WAGTAIL_SUPERUSER_NAME=admin \
  -e WAGTAIL_SUPERUSER_PASSWORD=changeme \
  -e DATABASE_URL= \
  -e SECRET_KEY=<SECRET_KEY> \
  -e WAGTAIL_ALLOWED_HOSTS=* \
  -e WAGTAIL_WORKERS=3 \
  -o fstab="/path/to/containers/wagtail /config <pseudofs>" \
  ghcr.io/daemonless/wagtail:latest wagtail

Save the files above, then run sh run.sh.

Experimental

Bastille's OCI support is experimental. It requires buildah and shares the host network stack (inherit). Mount volumes with --volume HOST JAIL; without it, image-declared volumes are stored under ${bastille_volumesdir}/${jail}.

Compose CLI

services:
  wagtail:
    name: wagtail
    image: "ghcr.io/daemonless/wagtail:latest"
    network:
      - mode: host
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=UTC
      - WAGTAIL_SUPERUSER_NAME=admin
      - WAGTAIL_SUPERUSER_PASSWORD=changeme
      - DATABASE_URL=
      - SECRET_KEY=<SECRET_KEY>
      - WAGTAIL_ALLOWED_HOSTS=*
      - WAGTAIL_WORKERS=3
    volumes:
      - "/path/to/containers/wagtail:/config"

Save as bastille-compose.yml, then run bastille up.

bastille create -O \
  --env PUID=1000 \
  --env PGID=1000 \
  --env TZ=UTC \
  --env WAGTAIL_SUPERUSER_NAME=admin \
  --env WAGTAIL_SUPERUSER_PASSWORD=changeme \
  --env DATABASE_URL= \
  --env SECRET_KEY=<SECRET_KEY> \
  --env WAGTAIL_ALLOWED_HOSTS=* \
  --env WAGTAIL_WORKERS=3 \
  --volume /path/to/containers/wagtail /config \
  wagtail ghcr.io/daemonless/wagtail:latest inherit

Access at: http://localhost:8080

Interactive Configuration

Parameters

Environment Variables

Variable	Default	Description
`PUID`	`1000`	User ID for the application process
`PGID`	`1000`	Group ID for the application process
`TZ`	`UTC`	Timezone for the container
`WAGTAIL_SUPERUSER_NAME`	`admin`	If set with WAGTAIL_SUPERUSER_PASSWORD, creates an admin superuser on start.
`WAGTAIL_SUPERUSER_PASSWORD`	`changeme`	Password for the admin superuser (with WAGTAIL_SUPERUSER_NAME).
`DATABASE_URL`	``	Use Postgres instead of the default SQLite, e.g. postgres://user:pass@host:5432/db. Unset = SQLite in /config.
`SECRET_KEY`	`<SECRET_KEY>`	Django SECRET_KEY. Auto-generated and persisted to /config/.secret_key if unset.
`WAGTAIL_ALLOWED_HOSTS`	`*`	Comma-separated Django ALLOWED_HOSTS.
`WAGTAIL_WORKERS`	`3`	Number of gunicorn workers.

Volumes

Path	Description
`/config`	Holds the generated Wagtail project (/config/app), SQLite DB, media, and the secret key. Must be persistent.

Ports

Port	Protocol	Description
`8080`	TCP	Web UI / admin (/admin)

Implementation Details

Architectures: amd64
User: bsd (UID/GID set via PUID/PGID). Defaults to 1000:1000.
Base: Built on ghcr.io/daemonless/base (FreeBSD 15.1).

Need help? Join our Discord community.