Portainer Templates logo

Portainer Templates

CryptPad CryptPad

Stack

ProductivityCloud

Collaboration suite, encrypted and open-source. Source: https://github.com/cryptpad/cryptpad

Image details

Pulls: 647k
Architecture: amd64, arm64
Image size: 217 MB
User: cryptpad
Created: Feb 13, 2019
Updated: 9 days ago
Status: active

Source details

Repo: cryptpad/cryptpad
Stars: 8k
Forks: 838
Language: JavaScript
License: AGPL-3.0
Latest: 2026.5.1 · 2 months ago
Updated: 1 day ago
Website: cryptpad.org/

Configuration

Type
Compose
Platform
linux
Image
cryptpad/cryptpad:version-2026.5.1
Ports
3000:30003003:3003
Volumes
/cryptpad/blob : cryptpad-blob/cryptpad/block : cryptpad-block/cryptpad/customize : cryptpad-customize/cryptpad/data : cryptpad-data/cryptpad/datastore : cryptpad-datastore
Env vars
CPAD_MAIN_DOMAIN=${CPAD_MAIN_DOMAIN}CPAD_SANDBOX_DOMAIN=${CPAD_SANDBOX_DOMAIN}CPAD_CONF=/cryptpad/config/config.js
Restart
unless-stopped
Source
Repo

Source

Notes

CryptPad requires two DIFFERENT domains/origins (main + sandbox) fronted by a reverse proxy that forwards to port 3000 — mandatory for its XSS sandboxing. Set both to real, distinct domains before deploying.

Standalone Install

Select an install method, to see config/commands for deploying CryptPad

Installation method

Install on Portainer

Import all app templates into your Portainer instance, for easy 1-click deploys

  1. Ensure both Docker and Portainer are installed, and up-to-date
  2. Log into your Portainer web UI
  3. Under Settings → App Templates, paste the below URL
  4. Head to Home → App Templates, and the list of apps will show up
  5. Select CryptPad, fill in any config options, and hit Deploy

Template Import URL

https://raw.githubusercontent.com/Lissy93/portainer-templates/main/templates.json
Show Me demo
Original stackfile

The compose file this template deploys, straight from its repo:

# SPDX-FileCopyrightText: 2023 XWiki CryptPad Team <[email protected]> and contributors
#
# SPDX-License-Identifier: AGPL-3.0-or-later

---
services:
  cryptpad:
    image: "cryptpad/cryptpad:version-2026.5.1"
    hostname: cryptpad
    restart: unless-stopped

    environment:
      # MAIN and SANDBOX must be two DIFFERENT origins (required for XSS sandboxing)
      - CPAD_MAIN_DOMAIN=${CPAD_MAIN_DOMAIN}
      - CPAD_SANDBOX_DOMAIN=${CPAD_SANDBOX_DOMAIN}
      - CPAD_CONF=/cryptpad/config/config.js

    volumes:
      - cryptpad-blob:/cryptpad/blob
      - cryptpad-block:/cryptpad/block
      - cryptpad-customize:/cryptpad/customize
      - cryptpad-data:/cryptpad/data
      - cryptpad-datastore:/cryptpad/datastore

    ports:
      - "3000:3000"
      - "3003:3003"

    ulimits:
      nofile:
        soft: 1000000
        hard: 1000000

volumes:
  cryptpad-blob:
  cryptpad-block:
  cryptpad-customize:
  cryptpad-data:
  cryptpad-datastore:

Or deploy it directly from the source:

git clone https://github.com/lissy93/portainer-templates
cd portainer-templates
docker compose -f sources/stacks/cryptpad.yml up -d

More install options in our documentation, or see cryptpad/cryptpad for app-specific guidance.

CryptPad

CryptPad is a collaboration suite that is end-to-end-encrypted and open-source. It is built to enable collaboration, synchronizing changes to documents in real time. Because all data is encrypted, the service and its administrators have no way of seeing the content being edited and stored.
Drive screenshot
Suite screenshots

Installation

For development

Our developer guide provides instructions for setting up a local instance without HTTPS or our more advanced security features.

For production

Configuring CryptPad for production requires a little more work, but the process is described in our admin installation guide. From there you can find more information about customization and maintenance.

Current version

The most recent version and all past release notes can be found here.

Setup using Docker

You can find Dockerfile, docker-compose.yml and docker-entrypoint.sh files at the root of this repository. We also publish every release on Docker Hub as AMD64 & ARM64 official images.
Previously, Docker images were community maintained, had their own repository and weren't official supported. We changed that with v5.4.0 during July 2023. Thanks to @promasu for all the work on the community images.

Security

CryptPad offers a variety of collaborative tools that encrypt your data in your browser before it is sent to the server and your collaborators. In the event that the server is compromized the database holds encrypted data that is not of much value to attackers.
The code which performs the encryption is still loaded from the host server like any other web page, so you still need to trust the administrator to keep their server secure and to send you the right code. An expert can download code from the server and check that it isn't doing anything malicious like leaking your encryption keys, which is why this is considered an active attack.
The platform is designed to minimize what data is exposed to its operators. User registration and account access is based on a cryptographic key that is derived from your username and password so the server never needs to see either and you don't need to worry about whether they are being stored securely. It is impossible to verify whether a server's operators are logging your IP or other activity, so if you consider this information sensitive it is safest to assume it is being recorded and access your preferred instance via Tor browser.
A correctly configured instance has safeguards to prevent collaborators from doing some nasty things like injecting scripts into collaborative documents or uploads. The project is actively maintained and bugs that our safeguards don't catch tend to get fixed quickly. For this reason it is best to only use instances that are running the most recent version, which is currently on a three-week release cycle. It is difficult for a non-expert to determine whether an instance is otherwise configured correctly, so we are actively working on allowing administrators to opt in to a public directory of servers that meet our strict criteria for safety.

Translations

CryptPad can be translated with nothing more than a web browser via our Weblate instance. See the state of the translated languages:

More information about this can be found in our translation guide.

Contacting Us

The best places to reach the development team and the community are the CryptPad Forum and the Matrix chat
The team is also on the fediverse: @[email protected]

Team

CryptPad is actively developed by a team at XWiki SAS, a company that has been building Open-Source software since 2004 with contributors from around the world. Between 2015 and 2019 it was funded by a research grant from the French state through BPI France. In the years since we have been funded by NLnet PET, NGI TRUST, NGI DAPSI, subscribers of CryptPad.fr, and donations to our Open-Collective campaign.

Contributing

We love Open Source and we love contribution. Learn more about contributing.
If you have any questions or comments, or if you're interested in contributing to CryptPad, come say hi in our Matrix channel.
This project is tested with BrowserStack.

License

AGPL logo
This software is and will always be available under the GNU Affero General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. If you wish to use this technology in a proprietary product, please contact [email protected].

Serve CryptPad on your own domain behind Caddy, Nginx or Traefik. Fill in your domain and copy the result. It's a starting point, some apps need their own base URL or extra headers set too.

Proxying cryptpad.example.com to http://cryptpad:3000

Add this to your Caddyfile

cryptpad.example.com {
	reverse_proxy http://cryptpad:3000
}

Check the logs first

Nine times out of ten the logs tell you exactly what went wrong.

  • In Portainer, go to Containers, click the container, then Logs. Or run docker logs <container>
  • Exit codes help too: 137 means killed, usually out of memory. 126 or 127 means the command inside the image is broken.

Port already in use

If deployment fails with "Bind for 0.0.0.0:3000 failed: port is already allocated", something else on your server is using that port.

  • Find what's using it: sudo ss -tlnp | grep :3000
  • Stop the other service, or pick a different host port. In 3000:3000 only the left number is yours to change, the right one belongs to the app.

Running but the page won't load

The container is up but nothing appears in your browser.

  • Use your server's real IP: http://your-server-ip:3000. The 0.0.0.0 link Portainer shows isn't a real address.
  • Give it a minute after first deploy, cryptpad can take a while to initialise.
  • Make sure your firewall allows the port, e.g. sudo ufw allow 3000

Image won't pull

Test the pull directly on the host: docker pull cryptpad/cryptpad:version-2026.5.1

  • "manifest unknown" means the tag no longer exists.
  • "toomanyrequests" is the Docker Hub rate limit. Log in with docker login to raise it.
  • "no space left on device" means a full disk. Reclaim space with docker system prune

"exec format error"

This means the image was built for a different CPU architecture than your server.

  • This image supports: amd64, arm64
  • Check yours with uname -m: x86_64 is amd64, aarch64 is arm64. Raspberry Pi and other ARM boards are the usual culprits.

Container keeps restarting

The unless-stopped restart policy relaunches the app after every crash, so the real error can scroll past.

  • Check the logs right after a restart, the last few lines before it died are the useful ones.
  • Get the exit code with docker inspect <container> --format '{{.State.ExitCode}}'
  • Still stuck? Redeploy once with the restart policy set to no so the failure stays visible.

Stack won't deploy

Compose stacks fail fast on small mistakes, and Portainer shows the reason just above the editor.

  • YAML only accepts spaces for indentation, a single tab breaks the whole file.

Raise an issue

Found something which isn't working as it should? Here's how to report it.

A Compose stack

CryptPad is a Compose stack, a set of containers defined in one file and brought up together by Portainer, then started and stopped as a single app.

The app image

An image is the app packed up ready to go, everything CryptPad needs bundled into one download. This template pulls cryptpad/cryptpad:version-2026.5.1, which Docker fetches once (about 217 MB) and then starts your own copy from.

Where the image comes from

Docker pulls its images from registries, public libraries of ready-built apps. CryptPad's comes from Docker Hub, published by cryptpad.

Version tags

The bit after the colon in the image name is the version tag. This one pins version-2026.5.1, so every redeploy gives you that exact build until you bump it yourself.

Which machines it runs on

Every image is built for particular CPU types. This one ships for amd64, arm64, so it runs on both regular x86 servers and ARM boards like a Raspberry Pi.

Ports

A port is the door the app answers on. A mapping like 3000:3000 means it's reachable on port 3000 of your server, where the left number is yours to change and the right one belongs to the app. Once it's running, open http://your-server-ip:3000 in a browser. It opens:

  • 3000:3000, likely the web interface
  • 3003:3003

Volumes

A volume is where CryptPad keeps its files so they survive an update or a restart. Without one, anything it saves would sit inside the container and vanish the moment it's recreated. This template mounts:

  • /cryptpad/blob kept in the cryptpad-blob volume Docker manages
  • /cryptpad/block kept in the cryptpad-block volume Docker manages
  • /cryptpad/customize kept in the cryptpad-customize volume Docker manages
  • /cryptpad/data kept in the cryptpad-data volume Docker manages
  • /cryptpad/datastore kept in the cryptpad-datastore volume Docker manages

Environment variables

Environment variables are the settings you hand over when you deploy, things like a password or a timezone. CryptPad takes 3 of them, all with defaults you can leave alone or tweak:

  • CPAD_MAIN_DOMAIN, pulled from your own environment. Main domain (full URL) — your public CryptPad address
  • CPAD_SANDBOX_DOMAIN, pulled from your own environment. Sandbox domain (full URL) — MUST be a DIFFERENT origin from the main domain
  • CPAD_CONF, defaults to /cryptpad/config/config.js

Restart policy

The restart policy here is unless-stopped, so Docker restarts CryptPad after a crash or reboot, but leaves it off when you stop it on purpose. You can change this on the deploy screen. The choices are no (never restart), on-failure (only after a crash), unless-stopped (restart unless you stop it), and always (bring it back no matter what).

Networking

Nothing custom is set, so CryptPad sits on Docker's default bridge network: its own private space that reaches the outside world only through the ports it publishes.

Container name

Once it's deployed, Portainer names the container cryptpad. That's what you'll spot in the containers list and use in commands like docker logs cryptpad.

Platform

The platform is linux, the kind of system the container is built to run on. Docker and Portainer handle this on a normal Linux server.

Open source license

CryptPad is open source, released under the AGPL-3.0 license. In plain terms the code is out in the open, so you're free to run it and change it to fit what you need.

Portainer app templates

Zooming out, this whole page comes from a Portainer app template: a short recipe telling Portainer how to set CryptPad up. Add the template list to Portainer once, then deploying CryptPad is a click rather than a wall of config.