TeamPass

Collaborative, on-premise password manager for teams

Alternative to: 1password, lastpass, keeper

TeamPass is a collaborative password manager designed to be installed on-premise, letting teams securely store and share credentials with fine-grained, per-item access control. It supports LDAP/Active Directory authentication, OAuth2 and MFA, real-time synchronization via WebSockets, and detailed audit logging of who accessed or changed what. First released in 2009, it is actively maintained with a Docker-based deployment path.

TeamPass Docker Compose example

Self-host TeamPass on your own server, homelab, or VPS starting from this Docker Compose example. It runs TeamPass in Docker containers using the official teampass/teampass:latest, mariadb:lts images, with persistent volumes and automatic restarts preconfigured. Review the environment variables and adjust them to your setup, save the file as compose.yml (or docker-compose.yml), and start the stack with docker compose up -d.

services:
  teampass:
    image: teampass/teampass:latest
    depends_on:
      db:
        condition: service_healthy
    volumes:
      - sk:/var/www/html/storage/sk
      - files:/var/www/html/storage/files
      - upload:/var/www/html/storage/upload
      # Install state (settings.php, csrfp.config.php) and master key — must
      # persist or TeamPass reinstalls itself on every restart.
      - config:/var/www/html/storage/config
      - secrets:/var/www/html/secrets
    environment:
      # Hostname of the MariaDB service (matches the db service name).
      DB_HOST: "db"
      # MariaDB port.
      DB_PORT: "3306"
      # Name of the TeamPass database.
      DB_NAME: "teampass"
      # MariaDB user TeamPass connects as.
      DB_USER: "teampass"
      # Password for the TeamPass database user (must match the db service).
      DB_PASSWORD: "changeme"
      # Prefix applied to all TeamPass database tables.
      DB_PREFIX: "teampass_"
      # Installation mode: "auto" installs unattended from ADMIN_PWD/DB_PASSWORD;
      # "manual" leaves first-run setup to the web installer.
      INSTALL_MODE: "auto"
      # Email of the initial administrator account.
      ADMIN_EMAIL: "admin@teampass.local"
      # Password of the initial administrator account (used when INSTALL_MODE=auto).
      ADMIN_PWD: "changeme"
      # Public URL where users reach TeamPass (used for links and CSRF checks).
      TEAMPASS_URL: "http://localhost:8080"
      # PHP memory limit.
      PHP_MEMORY_LIMIT: "512M"
      # Maximum upload file size.
      PHP_UPLOAD_MAX_FILESIZE: "100M"
      # Maximum POST body size.
      PHP_POST_MAX_SIZE: "100M"
      # Maximum PHP script execution time, in seconds.
      PHP_MAX_EXECUTION_TIME: "120"
    healthcheck:
      test: ["CMD", "wget", "--no-verbose", "--tries=1", "--spider", "http://localhost/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 60s
    restart: unless-stopped

  db:
    image: mariadb:lts
    volumes:
      - db:/var/lib/mysql
    environment:
      # Root password for MariaDB.
      MARIADB_ROOT_PASSWORD: "changeme"
      # Database created on first boot.
      MARIADB_DATABASE: "teampass"
      # Application database user created on first boot.
      MARIADB_USER: "teampass"
      # Password for the application database user (must match teampass DB_PASSWORD).
      MARIADB_PASSWORD: "changeme"
      # Automatically run mariadb-upgrade when the image version changes.
      MARIADB_AUTO_UPGRADE: "1"
      # Skip loading timezone tables at init for a faster first boot.
      MARIADB_INITDB_SKIP_TZINFO: "1"
    command:
      - --character-set-server=utf8mb4
      - --collation-server=utf8mb4_unicode_ci
      - --max_allowed_packet=64M
      - --innodb_buffer_pool_size=256M
      # Relax strict mode — TeamPass install/upgrade needs NO_ENGINE_SUBSTITUTION.
      - --sql-mode=NO_ENGINE_SUBSTITUTION
    healthcheck:
      test: ["CMD", "healthcheck.sh", "--connect", "--innodb_initialized"]
      interval: 10s
      timeout: 5s
      retries: 5
      start_period: 30s
    restart: unless-stopped

volumes:
  sk:
  files:
  upload:
  config:
  secrets:
  db:

Values set to changeme are required — replace them with your own values before starting TeamPass.

Prefer a managed setup? WinterFlow installs, configures, and updates TeamPass for you using this same Docker Compose configuration.