Passbolt

Open source password manager for teams

Alternative to: 1password, lastpass, keeper

Passbolt is an open-source, self-hosted password manager built for teams, letting members securely store, share, and manage credentials using OpenPGP-based encryption. It provides granular permissions, groups, browser extensions, and mobile apps, serving as a self-hosted alternative to team password managers like 1Password and LastPass.

Passbolt Docker Compose example

Self-host Passbolt on your own server, homelab, or VPS starting from this Docker Compose example. It runs Passbolt in Docker containers using the official mariadb:10.11, passbolt/passbolt:latest-ce images, with persistent volumes and automatic restarts preconfigured. Review the environment variables and adjust them to your setup, save the file as compose.yml (or docker-compose.yml), and start the stack with docker compose up -d.

services:
  db:
    image: mariadb:10.11
    restart: unless-stopped
    environment:
      # Generate a random MariaDB root password on first initialization.
      MYSQL_RANDOM_ROOT_PASSWORD: "true"
      # Name of the database Passbolt uses.
      MYSQL_DATABASE: "passbolt"
      # Database user Passbolt connects as.
      MYSQL_USER: "passbolt"
      # Password for the Passbolt database user (internal to the compose network).
      MYSQL_PASSWORD: "P4ssb0lt"
    volumes:
      - database_volume:/var/lib/mysql

  passbolt:
    image: passbolt/passbolt:latest-ce
    restart: unless-stopped
    depends_on:
      - db
    environment:
      # Public base URL where Passbolt is reached, including scheme (e.g. https://passbolt.example.com).
      APP_FULL_BASE_URL: "changeme"
      # Database host — the db service on the compose network.
      DATASOURCES_DEFAULT_HOST: "db"
      # Database user (must match the db service).
      DATASOURCES_DEFAULT_USERNAME: "passbolt"
      # Database password (must match the db service).
      DATASOURCES_DEFAULT_PASSWORD: "P4ssb0lt"
      # Database name (must match the db service).
      DATASOURCES_DEFAULT_DATABASE: "passbolt"
      # Sender address shown on Passbolt emails.
      EMAIL_DEFAULT_FROM: ""
      # SMTP server hostname used to send invitation / notification emails. Leave empty to disable email.
      EMAIL_TRANSPORT_DEFAULT_HOST: ""
      # SMTP server port.
      EMAIL_TRANSPORT_DEFAULT_PORT: "587"
      # SMTP username.
      EMAIL_TRANSPORT_DEFAULT_USERNAME: ""
      # SMTP password.
      EMAIL_TRANSPORT_DEFAULT_PASSWORD: ""
      # Whether to use TLS for SMTP (true/false).
      EMAIL_TRANSPORT_DEFAULT_TLS: "true"
    volumes:
      - gpg_volume:/etc/passbolt/gpg
      - jwt_volume:/etc/passbolt/jwt
    command:
      [
        "/usr/bin/wait-for.sh",
        "-t",
        "0",
        "db:3306",
        "--",
        "/docker-entrypoint.sh",
      ]

volumes:
  database_volume:
  gpg_volume:
  jwt_volume:

Values set to changeme are required — replace them with your own values before starting Passbolt.

Prefer a managed setup? WinterFlow installs, configures, and updates Passbolt for you using this same Docker Compose configuration.