Nextcloud All-in-One
[!NOTE]
Nextcloud AIO is actively looking for contributors. See the forum post.
The official Nextcloud installation method. Nextcloud AIO provides easy deployment and maintenance with most features included in this one Nextcloud instance.
Included are:
- Nextcloud
- High performance backend for Nextcloud Files (Client Push)
- Redis & APCU for performant caching
- PostgreSQL as database
- Nextcloud Office (optional)
- EuroOffice (optional)
- High performance backend for Nextcloud Talk and TURN-server (optional)
- Nextcloud Talk Recording-server (optional)
- Backup solution (optional, based on BorgBackup)
- Imaginary (optional, for previews of heic, heif, illustrator, pdf, svg, tiff and webp)
- ClamAV (optional, Antivirus backend for Nextcloud)
- Fulltextsearch (optional)
- Whiteboard (optional)
- Docker Socket Proxy (optional, needed for Nextcloud App API)
- Community containers
And much more:
- Simple web interface included that enables easy installation and maintenance
- Easy updates included
- Update and backup notifications included
- Daily backups can be enabled from the AIO interface which also allows updating all containers, Nextcloud and its apps afterwards automatically
- Instance restore from backup archive via the AIO interface included (you only need the archive and the password in order to restore the whole instance on a new AIO instance)
- APCu as local cache
- Redis as distributed cache and for file locking
- Postgresql as database
- PHP-FPM with performance-optimized config (e.g. Opcache and JIT enabled by default)
- A+ security in Nextcloud security scan
- Ready to be used behind existing Reverse proxies
- Can be used behind Cloudflare Tunnel
- Can be used via Tailscale
- Ready for big file uploads up to 10 GB on public links, adjustable (logged in users can upload much bigger files using the webinterface or the mobile/desktop clients since chunking is used in that case)
- PHP and web server timeouts set to 3600s, adjustable (important for big file uploads)
- Defaults to a max of 512 MB RAM per PHP process, adjustable
- Automatic TLS included (by using Let's Encrypt)
- zstd/gzip compression enabled by default inside caddy inside the apache container
- HTTP/2 and HTTP/3 enabled
- "Pretty URLs" for Nextcloud are enabled by default (removes the index.php from all links)
- Video previews work out of the box and when Imaginary is enabled, many recent image formats as well!
- Only one domain and not multiple domains are required for everything to work (usually you would need to have one domain for each service which is much more complex)
- Adjustable location of Nextcloud's datadir (e.g. good for easy file-sharing with host system on Windows and MacOS)
- By default confined (good for security) but can allow access to additional storages in order to enable the usage of the local external storage feature
- Possibility included to adjust default installed Nextcloud apps
- Nextcloud installation is not read only - that means you can apply patches if you should need them (instead of having to wait for the next release for them getting applied)
ffmpeg, smbclient and nodejs are included by default- Possibility included to permanently add additional OS packages into the Nextcloud container without having to build your own Docker image
- Possibility included to permanently add additional PHP extensions into the Nextcloud container without having to build your own Docker image
- Possibility included to pass the needed device for hardware transcoding to the Nextcloud container
- Possibility included to store all docker related files on a separate drive
- LDAP can be used as user backend for Nextcloud
- Migration from any former Nextcloud installation to AIO is possible. See this documentation.
- Migration in the other direction (e.g. from AIO to a VM-based installation) is also possible.
- Fail2Ban can be added
- phpMyAdmin, Adminer or pgAdmin can be added
- Mail server can be added
- Nextcloud can be accessed locally via the domain
- Can be installed locally (if you don't want or cannot make the instance publicly reachable)
- Free deSEC dynamic-DNS domain (
*.dedyn.io) can be registered directly from the AIO interface — no external domain needed
- IPv6-ready
- Can be used with Docker rootless (good for additional security)
- Runs on all platforms Docker supports (e.g. also on Windows and Macos)
- Included containers easy to debug by having the possibility to check their logs directly from the AIO interface
- Docker-compose ready
- Can be installed without a container having access to the docker socket
- Can be installed with Docker Swarm
- Can be installed with Kubernetes
- Almost all included containers Alpine Linux based (good for security and size)
- Many of the included containers run as non-root user (good for security)
- Many of the included containers have a read-only root-FS (good for security)
- Included containers run in its own docker network (good for security) and only really necessary ports are exposed on the host
- Multiple instances on one server are doable without having to deal with VMs
- Adjustable backup path or remote borg repository from the AIO interface (good to put the backups e.g. on a different drive if using a local backup path)
- Possibility included to also back up external Docker Volumes or Host paths (can be used for host backups)
- Borg backup can be completely managed from the AIO interface, including backup creation, backup restore, backup integrity check and integrity-repair
- Other forms of remote backup are indirectly possible
- Updates and backups can be run from an external script. See this documentation for a complete example.
Screenshots
| First setup |
After installation |
 |
 |
Architecture overview
flowchart TB
%% ── Styles ───────────────────────────────────────────────────────────────────
classDef user fill:#FFF3CD,stroke:#F0AD4E,color:#333
classDef master fill:#E8D5F5,stroke:#9B59B6,color:#222
classDef core fill:#D6EAF8,stroke:#2E86C1,color:#222
classDef opt fill:#D5F5E3,stroke:#27AE60,color:#222
classDef community fill:#FDEBD0,stroke:#E67E22,color:#222
classDef access fill:#EAFAF1,stroke:#1E8449,color:#222
%% ── Top row: people ─────────────────────────────────────────────────────────
YOU(["🧑💻 Admin\n(You)"]):::user
ENDUSER(["🧑🤝🧑 Users\n(family / team)"]):::user
%% ── Everything that runs inside AIO ─────────────────────────────────────────
subgraph AIO[" 🐳 Nextcloud AIO "]
MC(["🧠 Mastercontainer\n─────────────────────────\n▸ AIO interface :8080 / :8443\n▸ Manages & updates containers\n▸ Handles backups"]):::master
subgraph CORE[" 📦 Core Stack (auto-started) "]
PROXY(["🔀 Apache\nProxy & HTTPS"]):::core
NC(["☁️ Nextcloud\nApp Server"]):::core
DB(["🗄️ PostgreSQL\nDatabase"]):::core
CACHE(["⚡ Redis\nCache"]):::core
PUSH(["🔔 Notify Push\nReal-time sync"]):::core
end
subgraph OPT[" 🧩 Optional Built-in Containers (enable in AIO interface) "]
COLLA(["📄 Nextcloud Office"]):::opt
EO(["📄 EuroOffice\nDocument Server"]):::opt
TALK(["🎙️ Talk\nVideo & Voice calls"]):::opt
TALKREC(["🎬 Talk Recording"]):::opt
FTS(["🔎 Full-text Search\n(Elasticsearch)"]):::opt
IMAG(["🖼️ Imaginary\nImage previews"]):::opt
CLAM(["🦠 ClamAV\nAntivirus"]):::opt
WB(["🖊️ Whiteboard"]):::opt
end
COMM(["🌍 Community Containers\n──────────────────────\n30+ optional add-ons\nSee community-containers/"]):::community
click COMM "https://github.com/nextcloud/all-in-one/tree/main/community-containers#community-containers" "Browse community containers"
end
%% ── Result node (outside AIO) ────────────────────────────────────────────────
NC_URL(["🌐 https://your-domain.com\n✅ Nextcloud — ready to use!"]):::access
%% ── Flows ────────────────────────────────────────────────────────────────────
YOU -->|"① open :8080 or :8443 in browser"| MC
MC -->|"② auto-starts & wires up"| CORE
MC -. "③ enable in AIO interface" .-> OPT
MC -. "④ add via AIO interface" .-> COMM
PROXY --> NC
NC --- DB
NC --- CACHE
NC --- PUSH
OPT -->|"integrate with"| NC
COMM -.->|"integrate with"| NC
CORE -->|"⑤ stack is ready!"| NC_URL
ENDUSER -->|"⑥ browser / app"| NC_URL
YOU -->|"⑥ use normally"| NC_URL
How to use this?
The steps below are written for Linux. For platform-specific guidance see:
[!IMPORTANT]
These instructions assume there is no existing web server or reverse proxy (for example Apache, Nginx, Caddy, or Cloudflare Tunnel) that you intend to place in front of AIO. If you plan to run AIO behind an existing web server or reverse proxy, follow the AIO reverse proxy documentation: Reverse proxy docs
You're encouraged to skim the attached FAQ. While we've tried to make things straightforward, Nextcloud is a large and flexible platform. Reading the FAQ will save you time, particularly if edge cases come up.
[!TIP]
Don't worry about getting everything perfect on the first try — test deployments are cheap and disposable.
- Install Docker on your Linux host by following the official documentation: Docker install — supported platforms
[!WARNING]
Snap-based Docker installations are not supported. Make sure you are not using a snap-based Docker installation (generally only applicable to Ubuntu). To check, run:
sudo docker info | grep "Docker Root Dir" | grep "/var/snap/docker/"
If you see the following output:
/var/snap/docker/
you should migrate to a standard Docker installation and remove the snap-based package before proceeding: Install Docker on Ubuntu.
⚠️ To avoid losing data or interrupting services, only remove the Docker snap after you are certain you're not running any existing containers in it.
Consult the official Docker documentation or other guides for instructions on migrating existing containers. Once you are certain it's safe, remove the snap-based Docker installation with:
sudo snap remove docker
If you need IPv6 support, enable it by following: Docker IPv6 support for AIO
AIO uses a special mastercontainer to orchestrate the various pieces of the Nextcloud stack. To start AIO, launch the mastercontainer with the command below:
# For Linux and without a web server or reverse proxy already in place:
sudo docker run \
--init \
--sig-proxy=false \
--name nextcloud-aio-mastercontainer \
--restart always \
--publish 80:80 \
--publish 8080:8080 \
--publish 8443:8443 \
--volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
--volume /var/run/docker.sock:/var/run/docker.sock:ro \
ghcr.io/nextcloud-releases/all-in-one:latest
Explanation of the command
sudo docker run — starts a new Docker container. Omit sudo if your user is in the docker group. --init — runs an init process inside the container to handle zombie processes. --sig-proxy=false — prevents Ctrl+C in the attached terminal from stopping the container. --name nextcloud-aio-mastercontainer — the container name. Do not change this name; mastercontainer updates rely on it. --restart always — ensures the container restarts automatically with the Docker daemon. --publish 80:80 — publishes container port 80 on host port 80 (used for ACME http-challenge when obtaining certificates, used for for the AIO-interface running inside the mastercontainer). Not required if you run AIO behind a reverse proxy.--publish 8080:8080 — publishes the AIO interface (self-signed certificate) on host port 8080. You may map a different host port if 8080 is in use (e.g. --publish 8081:8080). --publish 8443:8443 — publishes the AIO interface with a valid certificate on host port 8443 (requires ports 80 and 8443 to be reachable and a domain pointing to your server). Not required if you run AIO behind a reverse proxy. --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config — stores mastercontainer configuration in the named Docker volume. Do not change this volume name; built-in backups depend on it. --volume /var/run/docker.sock:/var/run/docker.sock:ro — mounts the Docker socket (read-only) so the mastercontainer can manage other containers. On Windows/macOS or when using rootless Docker, this path may need adjustment; see the platform-specific docs. If you change the socket path, also set WATCHTOWER_DOCKER_SOCKET_PATH accordingly. If you prefer not to expose the socket, see the manual-install documentation: Manual install without docker socket access ghcr.io/nextcloud-releases/all-in-one:latest — the mastercontainer image.
Additional options can be set with environment variables (for example --env NEXTCLOUD_DATADIR="/mnt/ncdata" to change Nextcloud's datadir on first startup). See the Customization section and example compose file: compose.yaml for more options.
[!TIP]
If you want Nextcloud’s data directory in a different location than the default Docker volume, see "How to change the default location of Nextcloud's Datadir" in this README: How to change the default location of Nextcloud's Datadir
[!NOTE]
For production usage (and ease of upgrades and changes), we suggest using the example Compose file rather than docker run.
- After the initial startup, open the Nextcloud AIO interface on port 8080 of this server by IP address, for example:
https://192.168.5.5:8080
[!CAUTION]
Use an IP address (not a domain) when accessing the AIO interface on port 8080. Accessing via a domain may work temporarily but is likely to break later due to HSTS.
Port 8080 uses a self-signed certificate that you must accept in your browser.
It is also possible to obtain a valid certificate automatically if your firewall/router forwards ports 80 and 8443 and you point a domain to your server. In that case, access the AIO interface using the dedicated port for this purpose (8443), for example:
https://your-domain-that-points-to-this-server.tld:8443
- If you enable Nextcloud Talk, open port
3478/TCP and 3478/UDP in your firewall/router for the Talk (TURN) container.
[!TIP]
Don't have a domain yet? AIO can register a free dynamic-DNS subdomain under dedyn.io for you via deSEC — no external setup needed. Look for the "Don't have a domain? Get a free one from deSEC" section on the AIO interface when you are asked to enter your domain. AIO will automatically register the domain, keep the DNS record up to date, and enable the Caddy community container as a reverse proxy as well as the dnsmasq container for local DNS resolution.
FAQ
The official Nextcloud installation method: one Docker-managed package that deploys and maintains a full self-hosted Nextcloud instance with most features included, controlled from a single web interface.