Published

authentik

Identity provider for single sign-on: OAuth2/OpenID Connect, SAML, LDAP, RADIUS and SCIM, with configurable login, enrollment and MFA flows, and a proxy that puts a login in front of apps that have none. The self-hosted stack is the server (web UI, API and embedded proxy outpost), a background worker and PostgreSQL.

Resources by load level

What the app itself needs at each level, next to what we recommend for a server that runs only this app.

Level	What it means	App requirements	Recommended
LightEstimate	Up to 50 users and 5 connected apps, ~200 logins a day (~600 events a day), no directory sync; default event retention of 365 days.	2.5 vCPU · 2.5 GiB RAM · 8 GiB disk	3.12 vCPU · 4.5 GiB RAM · 18.745 GiB disk
MediumEstimate	Up to 500 users and 20 connected apps, ~1,000 logins a day (~3,000 events a day), an LDAP or SCIM sync of all users every few hours.	3.5 vCPU · 2.75 GiB RAM · 8 GiB disk	4.32 vCPU · 4.8 GiB RAM · 18.745 GiB disk
HeavyEstimate	Up to 2,000 users and 50 connected apps, ~5,000 logins a day (~15,000 events a day), hourly directory syncs and proxy-protected apps through the embedded outpost.	5 vCPU · 6.5 GiB RAM · 53 GiB disk	6.12 vCPU · 9.3 GiB RAM · 70.495 GiB disk

Recommended = app requirements + system baseline + safety headroom, under sizing policy 2026.10.0. Options stay at their defaults. “Estimate” means the sources give no number for that case, so it is worked out from them by the method stated under Components. How the numbers are built

Size it in the Stack Sizer

Ready-to-run files

Support level Supported

Compose template from the official sources; not yet verified by a run.

Create docker-compose

Components

What each component needs at each load level, before baseline and headroom.

vCPU / GiB RAM / GiB disk
Component	Light	Medium	Heavy	Sources
authentik server (web UI, API, flows, embedded outpost) (app)	1 / 1 / 1.5	1.5 / 1 / 1.5	2 / 1.5 / 1.5	[6][7][28][30]
authentik worker (background tasks) (worker)	0.5 / 0.5 / 0	1 / 0.75 / 0	1 / 1 / 0	[7][15][28]
PostgreSQL (database)	1 / 1 / 6.5	1 / 1 / 6.5	2 / 4 / 51.5	[7][16][27][34][35][36][37][38][39][40]

How the estimates are worked out

authentik server (web UI, API, flows, embedded outpost) · Light: The docs ask for at least 2 cores and 2 GB for the whole stack; the Helm chart's example gives the server 512 MiB. 1 GiB covers 2 gunicorn workers × 4 threads (defaults) and the embedded outpost; 1 vCPU covers PBKDF2 password checks. Disk: 382,343,402 B compressed × 3 (1.07 GiB, shared with the worker) rounded up to 1.25 GiB + 0.25 GiB for uploaded icons.
authentik server (web UI, API, flows, embedded outpost) · Medium: Morning peaks bring dozens of logins a minute, each with a PBKDF2 hash (1,000,000 iterations in the docs' example), so 1.5 vCPU; RAM stays at 1 GiB with the default 2 gunicorn workers. Disk: 1.25 GiB image + 0.25 GiB for uploaded icons.
authentik server (web UI, API, flows, embedded outpost) · Heavy: Login peaks and every request to a proxy-protected app pass through the server: 2 vCPU, and 1.5 GiB so AUTHENTIK_WEB__WORKERS can go from 2 to 3 (the docs' way to scale a single server), about 0.5 GiB per worker. Disk: 1.25 GiB image + 0.25 GiB for uploaded icons.
authentik worker (background tasks) · Light: One process with 2 threads (defaults) running emails, notifications, cleanups and scheduled tasks; 0.5 GiB matches the Helm chart's 512 MiB example. Disk: same image as the server (counted there), no volume.
authentik worker (background tasks) · Medium: A sync of 500 users is split into pages of 50, about 10 tasks plus a coordinating one, which keep both default threads busy: 1 vCPU and 0.75 GiB, above the Helm chart's 512 MiB example. Disk: same image as the server, no volume.
authentik worker (background tasks) · Heavy: An hourly sync of 2,000 users is about 40 pages of 50 plus a coordinating task, alongside notifications for ~15,000 events a day: 1 vCPU and 1 GiB, room for AUTHENTIK_WORKER__THREADS above 2. Disk: same image as the server, no volume.
PostgreSQL · Light: ~600 events a day × 365 days of retention × an assumed 2 KB per event row = 0.44 GB, inside the sidecar's 5 GB. Server (2 × 4 threads) and worker (1 × 2) plus their listeners stay under 20 connections. Light preset method: shared_buffers 25% of RAM, 0.5 GiB image + 5 GiB data + 1 GiB WAL.
PostgreSQL · Medium: ~3,000 events a day × 365 days × an assumed 2 KB per event = 2.2 GB, plus 30 days of task rows, inside the sidecar's 5 GB. Connections stay under 20 with the default server and worker settings. Light preset method: shared_buffers 25% of RAM, 0.5 GiB image + 5 GiB data + 1 GiB WAL.
PostgreSQL · Heavy: ~15,000 events a day × 365 days × an assumed 2 KB per event = 11 GB, more than the sidecar's 5 GB, so the PostgreSQL profile's medium preset (≤ 50 GB, ≤ 100 connections), which also covers more web workers and threads. Medium preset method: shared_buffers 25% of 4 GiB, 0.5 GiB image + 50 GiB data + 1 GiB WAL.

Ports

Public ports are meant to be reached from outside the stack, usually through a reverse proxy; internal ones stay on the stack's own network.

Component	Port	Exposure	Purpose	Sources
authentik server (web UI, API, flows, embedded outpost)	9000/tcp	Public, through a proxy	Web UI, API, SSO endpoints and embedded proxy outpost (HTTP; put behind TLS)	[2][7]
authentik server (web UI, API, flows, embedded outpost)	9443/tcp	Internal only	HTTPS listener with a self-signed certificate; unused when TLS ends at the proxy	[2][7]
authentik server (web UI, API, flows, embedded outpost)	9300/tcp	Internal only	Prometheus metrics of the server, without authentication	[7][10]
authentik worker (background tasks)	9000/tcp	Internal only	Worker health endpoint (/-/health/ready/)	[7][10]
authentik worker (background tasks)	9300/tcp	Internal only	Prometheus metrics of the worker (task counts and durations)	[7][10]
PostgreSQL	5432/tcp	Internal only	PostgreSQL connections, task queue and LISTEN/NOTIFY of server and worker	[2][39]

Every port in the catalog, with conflicts between apps

User and permissions (UID/GID)

The user each container's process runs as, and the paths it writes to. A bind mount for one of these paths must be writable by that UID:GID.

Component	UID:GID	User	Starts as root	Writes to	Sources
authentik server (web UI, API, flows, embedded outpost)Derived	1000:1000	`authentik`	No	`/data/media/dev/shm`	[3][4]
authentik worker (background tasks)Derived	1000:1000	`authentik`	No	`/dev/shm`	[2][3][4]
PostgreSQL	999:999	`postgres`	Yes, prepares its directories, then drops to this user	`/var/lib/postgresql/var/run/postgresql`	[32][33][39]

authentik server (web UI, API, flows, embedded outpost): The Dockerfile ends with USER 1000 (authentik) and pre-creates /data and /media owned by it, with /data/media linking to /media. Started as 1000, the ak entrypoint skips its root-only chown. Temporary files and metrics go to TMPDIR=/dev/shm.
authentik worker (background tasks): Upstream starts the worker as root so ak can join the Docker socket's group and chown /data and /certs before dropping to authentik with setpriv. Without the socket and those mounts, it runs as the image's user 1000 from the start; it writes only to TMPDIR=/dev/shm.

Storage growth

How much each component's data grows per month at each load level, on top of the disk in the profile. A value marked Assumption is ANAROQ's stated assumption, not a figure from the sources; the notes say what it rests on.

GiB per month
Component	Light	Medium	Heavy	Sources
authentik server (web UI, API, flows, embedded outpost)Assumption	0	0	0	[8][17]
PostgreSQLAssumption	0.034	0.168	0.838	[7][15][16]

What the growth figures rest on

authentik server (web UI, API, flows, embedded outpost): The data and media volumes only change when an administrator uploads an icon or a flow background; logins and syncs write nothing there.
PostgreSQL: Events a day (600, 3,000, 15,000) × 30 days × an assumed 2 KB per event. Events expire after 365 days by default, so growth stops after a year; finished tasks are purged after 30 days.

Upgrade and rollback

How to move to a new version safely, and how to go back if it fails.

Back up first

Take a pg_dump of the authentik database first (it holds every user, flow, provider and certificate), plus archives of the data and media volumes and the .env with AUTHENTIK_SECRET_KEY. [17][18]

Upgrade steps

Read the release notes of every version up to the new one. Do not skip versions: move to the latest .x of each release in order (for example 2026.5.x, then 2026.8.x). Downgrades are not supported. [18]
Change the pinned tag of both the server and the worker (the same image), then run docker compose pull and docker compose up -d. Migrations run at startup; the image's healthcheck allows 120 s before it counts failures. [3][18]
Upgrade any outposts you deployed by hand (LDAP, RADIUS, RAC, proxy) to the same version at the same time: server and outposts must match. [12][18]

Roll back

authentik cannot downgrade in place: stop the stack, restore the pre-upgrade dump into an empty database and pin the previous tag on server and worker. [17][18]

Known breaking changes

In 2026.8: X-Forwarded-Proto, -Host and -For are used only from networks in AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS; a proxy outside them makes HTTPS look like HTTP (mixed content, endless loading). hash_password no longer takes the password as an argument. [9][23]
In 2026.5: Listeners default to [::] instead of 0.0.0.0, so IPv4-only environments may need AUTHENTIK_LISTEN__* set. AUTHENTIK_POSTGRESQL__CONN_OPTIONS is deprecated and goes away in the next release. [24]
In 2026.2: SCIM providers now sync only users allowed by the application's policies, and a provider with a group filter is turned off with a configuration warning until reviewed. User.ak_groups in custom code is deprecated in favour of User.groups. [25]
In 2025.12: Local file storage moved to a mount at /data (the old /media mount becomes /data/media) and files are served from /files instead of /media. Group names must be unique: the migration fails until duplicates are renamed. [26]
In 2025.10: Redis is gone: cache, embedded outpost sessions and WebSockets moved to PostgreSQL, which now gets roughly 50% more connections. Default scope mappings send email_verified as false. [27]

Limits

Without the Docker socket authentik cannot deploy outposts by itself. The embedded outpost handles Proxy providers; LDAP, RADIUS and RAC need an outpost container you add by hand from the docs' snippets, on the server's version. [6][8][12]
/dev/shm, where the image keeps temporary files, is Docker's default 64 MiB instead of upstream's 512 MB. If workers fail with errors about temporary space, add shm_size: 512mb to both services. [2][3][14]
No SMTP server is configured, so recovery emails, email verification and admin alerts are not sent until you add the AUTHENTIK_EMAIL__* settings to server and worker. [6][7]
Only the server has the /data volume. Enterprise CSV data exports, which the worker generates, need shared storage: configure S3 storage for reports before using them. [7][8][22]

Security

The first visitor sets the akadmin password in the initial-setup flow (/if/flow/initial-setup/, trailing slash included). Complete it right after the first start, before the domain is reachable from the internet. [6][20][24]
Forwarded headers are trusted from all private ranges by default (10/8, 172.16/12, 192.168/16, loopback). The proxy must send X-Forwarded-Proto: https; if untrusted clients reach authentik directly from a private network, narrow AUTHENTIK_LISTEN__TRUSTED_PROXY_CIDRS to the proxy. [7][9]
The template leaves out the Docker socket that upstream mounts into a root worker: access to it equals root on the host. If you want automatic outposts, the docs suggest a Docker socket proxy instead of the raw socket. [6][11]
Metrics on port 9300 need no authentication; the template does not publish the port, and it should stay off the internet. [10]

Backup

The PostgreSQL database is the backup that matters: users, flows, providers, policies and imported certificates all live there. Take regular pg_dump copies off the server, together with the .env (AUTHENTIK_SECRET_KEY and the database password). [7][17]
Also archive the data and media volumes (uploaded icons, flow backgrounds, reports); without them the configuration restores but uploaded images are missing. [3][17]