A self-hosted documentation platform built on Laravel and MySQL, with a fixed shelf/book/chapter/page hierarchy instead of free-form linking. It replaces Confluence for teams that want structure and want to stop paying per seat.
Our verdict on BookStack#
BookStack is the boring one, and boring is the point. It is a Laravel app on MySQL with a MIT licence, one maintainer working on it full time since 2015, and a version-specific upgrade notes page you can read end to end in five minutes. Between v24.05.1 and v26.05 the only documented manual upgrade steps were a folder permission change for export fonts and a revision visibility change. Everything else was git pull origin release, composer install --no-dev, php artisan migrate. That predictability is what you are buying: documentation you write today will still open in five years because the storage format is rows in MySQL and the app has no plugin ecosystem to rot. The costs are real. There is no official Docker image (LinuxServer.io and solidnerd carry the community ones), MySQL or MariaDB only, and the rigid shelf/book/chapter/page tree frustrates people who think in backlinks.
Who BookStack is for#
Choose it if
- A team that needs internal documentation to still be readable and editable in five years without a migration project
- Anyone leaving Confluence who wants the same shelf and space mental model rather than a graph of notes
- Admins who already run a LAMP stack and would rather not add Redis, Postgres and an object store
- Organizations that need OIDC or SAML plus per-role page permissions without paying for an enterprise tier
Look elsewhere if
- You want bidirectional links, transclusion or a graph view; BookStack's hierarchy is deliberately rigid
- You need real-time multi-user editing on the same page, which BookStack does not do
- You are set on PostgreSQL, which is not supported and has been declined repeatedly
What running it actually looks like#
The supported install is a git checkout of the release branch with composer install --no-dev, a .env file, a MySQL or MariaDB database, and nginx or Apache pointed at public/. PHP 8.2 or newer with curl, dom, gd, iconv, mbstring, mysqlnd, openssl, pdo_mysql, tokenizer, xml and zip. Shared hosting is explicitly unsupported. The distro install scripts for Ubuntu 22.04, 24.04 and 26.04 do the whole thing in one pass. Docker works but the images are community maintained, not official, so pick one and understand its permission model. First run gives you admin@admin.com with password password, which you must change immediately. Upgrades are pull, composer, migrate, then clear the three caches; v25.02.1 and later can swap composer for ./bookstack-system-cli download-vendor.
Resource profile#
- Memory
- 260 MB idle, around 500 MB in ordinary use. Estimate for PHP-FPM plus a web server plus MariaDB on one host; MariaDB is usually the largest single consumer and PHP-FPM scales with the number of workers you configure.
- CPU and acceleration
- Idle at zero because PHP only runs during a request. The two spikes worth knowing about are PDF export, which shells out to a headless renderer, and `php artisan migrate` on an instance with a lot of content and roles.
- Storage growth
- Page text lives in the database and stays small. Growth comes from `public/uploads` (images) and `storage/uploads` (attachments), plus page revisions, which are kept indefinitely by default.
- Operational load
- 2 of 5, Light. Two moving parts, a documented three command upgrade, and a backup that is a mysqldump plus a tar of four paths. The only ongoing attention it demands is applying security patch releases, which arrive roughly monthly.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
A mysqldump plus four paths and you are done: tar -czvf files.tar.gz .env public/uploads storage/uploads themes. Images live in public/uploads, page attachments in storage/uploads, and everything else in that directory tree is code you can re-clone. A live file copy is safe because the files are immutable uploads; only the database needs a consistent dump. The one thing that will ruin a restore is losing APP_KEY from .env, since it encrypts multi-factor secrets and other stored values, so keep .env in the backup and not just the uploads.
Derived backup shape
MySQL dump. mariadb-dump / mysqldump with --single-transaction, then snapshot the dump plus the app's data volume.
Traps and surprises#
The canonical repo moved to Codeberg in April 2026
BookStack migrated development to codeberg.org/bookstack/bookstack on 28 April 2026 over GitHub's AI tooling direction and Git-LFS limits. The GitHub repo remains a code mirror so existing git pull setups keep working, but issues, pull requests and some sibling repos (including the website and docs source) are no longer updated there. For production the project now recommends pulling from https://source.bookstackapp.com/bookstack.git.
APP_KEY loss is unrecoverable
The APP_KEY value in .env encrypts stored secrets, notably multi-factor authentication seeds. Restore the uploads and the database with a freshly generated key and MFA-enabled users are locked out with no self-service recovery. Back up .env itself, and if you rotate the key, disable MFA for everyone first.
Security patches arrive monthly and you have to take them
Feature releases land every couple of months, but patch releases in between are almost all security fixes: v26.05.1 through v26.05.4 alone covered attachment permission leaks, a ZIP import remote-code-execution path, draft page permission bypasses and OIDC/SAML identity mismatching on case-differing IDs. An instance pinned to a version from last year is not stable, it is unpatched.
MySQL or MariaDB only, and no official container
PostgreSQL and SQLite are not supported and are not on the roadmap. Docker images come from LinuxServer.io or solidnerd rather than the project, which means upgrade timing, file ownership and the PHP version inside the image are the image maintainer's decisions, not BookStack's. Read that image's release notes as well as BookStack's.
PDF export breaks on the v26.05 font permission change
v26.05 changed how fonts are used for exports and requires the storage/fonts directory and everything inside it to be readable and writable by the web server user. The symptom after upgrading is that the app works fine and only PDF export throws an error, which is easy to misdiagnose as a renderer problem.
Specifications#
- Category
- Documents, notes and knowledge
- Licence
- MIT (Permissive)
- Written in
- PHP (Laravel)
- First release
- 2015
- Maturity
- Mature
- Datastore
- MySQL 8.0+ or MariaDB 10.6+
- Default ports
80- Ships as
- git checkout with composer, docker (community images), distro install script, PikaPods/Cloudron/YunoHost
- arm64 builds
- Yes
- Identity
- Native OIDC. OIDC, SAML2 and LDAP are all first-party and configured with environment variables, including group to role sync; no plugin and no reverse proxy trickery required.
- Replaces
- Confluence, Notion, Google Sites, SharePoint wiki
- Project site
- www.bookstackapp.com
- Source
- codeberg.org/bookstack/bookstack
- Documentation
- www.bookstackapp.com/docs
Alternatives to BookStack#
Everything else in documents, notes and knowledge, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| HedgeDoc | 2, Light | 250 MB | AGPL-3.0 |
| Trilium Notes | 2, Light | 200 MB | AGPL-3.0 |
| Docmost | 3, Moderate | 500 MB | AGPL-3.0 core, proprietary Docmost Enterprise licence for `ee` directories |
| Paperless-ngx | 3, Moderate | 450 MB | GPL-3.0 |
| Wiki.js | 3, Moderate | 260 MB | AGPL-3.0 |
| Outline | 4, Heavy | 550 MB | BUSL-1.1 (Change Date 2030-09-01, converts to Apache-2.0) |
Where BookStack comes up elsewhere#
Head to head
Migration guides
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.