grocy
Household stock, chores and batteries in one PHP app on a single SQLite file
grocy tracks what food is in your house, what it cost, when it expires and what you consumed, then extends the same idea to chores, tasks, equipment manuals and battery changes. It replaces pantry apps like AnyList or Out of Milk, and a whiteboard of household chores, with one self-hosted web app.
Our verdict on grocy#
grocy is the lowest-maintenance thing in this category and the most likely to be abandoned. It is one PHP application over one SQLite file: no database service, no cache, no worker, no queue. The container idles under 50 MB and the backup is a directory copy. It is nine years old and moves slowly on purpose, 4.5.0 in March 2025, 4.6.0 a full twelve months later, then 4.7.1 on 4 September 2026. The reason most installs die inside a month is not the software. Stock tracking is double-entry bookkeeping for food: every purchase and every consumption has to be recorded or the numbers lie, and a pantry that says four tins of tomatoes when you have none is worse than no pantry at all. What predicts success is a routine: you shop at one or two places on a schedule, you buy shelf-stable goods in quantity, and you scan with the Android or iOS companion app as you unpack, not from a laptop later.
Who grocy is for#
Choose it if
- A household that buys bulk shelf-stable goods and genuinely loses money to expiry
- Someone who wants chore rotation, battery changes and equipment manuals tracked in the same place as food
- A Raspberry Pi or low-power box where a Postgres container is an unwelcome tenant
- Anyone who will scan barcodes at the counter with the companion app rather than typing later
Look elsewhere if
- You shop ad hoc and cook from whatever is there, in which case stock levels will be wrong within a week
- You want a shared shopping list and nothing else: this is a full inventory system and the list is a byproduct
- You cannot run PHP 8.5, because since 4.6.0 that is the only supported runtime outside the container image
What running it actually looks like#
Technically trivial. The project ships a zip you unpack on any web server running PHP 8.5 with SQLite 3.40 or newer, plus the fileinfo, pdo_sqlite, gd, ctype, intl, zlib and mbstring extensions. There is no database to provision. Most people run the LinuxServer.io image instead: one container, one /config volume, port 80 inside and published as 9283 by convention. First login is admin / admin, which you change on the spot. Configuration is a PHP file, data/config.php, copied from config-dist.php, and that is where feature toggles, currency, ENERGY_UNIT and AUTH_CLASS live rather than in environment variables. After every upgrade, load the root URL once in a browser: that request is what runs the schema migrations.
Resource profile#
- Memory
- 40 MB idle, around 90 MB in ordinary use. PHP-FPM and a small web server in one container. There is no database service, no cache and no background worker, so the figure barely moves as your product catalog grows.
- CPU and acceleration
- Effectively idle between requests. The heaviest thing it does is render a stock overview table with a few hundred rows, and barcode decoding happens in the browser, not on the server.
- Storage growth
- Tiny. A well-used household database is a few tens of MB after years; growth comes from uploaded product pictures and equipment manuals rather than from stock transactions.
- Operational load
- 1 of 5, Set and forget. One process, one SQLite file, no external services to coordinate. Backup is copying a directory and restore is copying it back. The only recurring operational duty is loading the root URL once after an upgrade so the schema migration runs.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
One directory. Under data/ sit the SQLite database, config.php, and the uploaded product pictures and userfiles. That is the entire backup surface. Because it is SQLite, a live cp can catch a torn write, so use sqlite3 grocy.db ".backup out.db" or stop the container for the copy; the file is small enough that either is instant. Nothing here is regenerable except image thumbnails. Restore is the reverse copy plus one page load to migrate. There is no external database, no cache and no search index to rebuild, which is precisely why this scores a 1 for ops load.
Derived backup shape
SQLite backup. sqlite3 <db> ".backup out.db" while running, or stop the container and copy. A live cp of a WAL-mode SQLite file can restore corrupt.
Traps and surprises#
PHP 8.5 became the only supported runtime in 4.6.0
4.6.0 (March 2026) made PHP 8.5 with SQLite 3.40 or newer the sole supported runtime. If you run grocy on distribution PHP packages rather than the container, that is a genuine blocker, because plenty of stable distributions were still shipping 8.2 or 8.3. The LinuxServer.io image handles it. The same release added a workaround for SQL errors seen on FreeBSD with SQLite 3.41 and later.
Upgrades migrate on page load, not on start
grocy does not migrate the schema when the process starts. It migrates when someone requests the root route. Unpack a new version or pull a new image, then browse to / before doing anything else, including before any API client hits it. Skip that and you are running new code against an old schema, which shows up as scattered SQL errors rather than a clear upgrade message.
4.7.0 reorganized auth and killed every session
4.7.0 (August 2026) reorganized the authentication middleware and invalidates all web frontend sessions on upgrade, so everyone logs in again. Its release note tells you to review your AUTH_CLASS setting against the current config-dist.php. If you were using ReverseProxyAuthMiddleware or LdapAuthMiddleware, diff your config before restarting rather than after users report a login loop.
Stock only stays accurate if you record consumption
The barcode workflow is quick on the way in and tedious on the way out. grocy has no way to know you ate something, so unless you consume from the app or a phone scanner, stock drifts high within days and the due-soon warnings and minimum-stock shopping lists start generating noise you learn to ignore. That is the failure mode: not a crash, just a slow loss of trust in the numbers, and then nobody opens it.
Barcode lookup is a plugin with patchy coverage
grocy ships an Open Food Facts lookup plugin, and 4.6.0 improved it (extension inference from Content-Type, support for data: image URLs, and a fix for German umlauts being stripped from product names). Coverage outside Europe is still thin and store-brand items commonly return nothing, so expect to create a fair number of products by hand on your first full shop. Third-party helpers like Barcode Buddy exist to queue unknown barcodes for later.
Specifications#
- Category
- Tasks, recipes and personal finance
- Licence
- MIT (Permissive)
- Written in
- PHP
- First release
- 2017
- Maturity
- Mature
- Datastore
- SQLite
- Default ports
9283- Ships as
- docker (LinuxServer.io image), PHP zip on any web server, Windows desktop installer
- arm64 builds
- Yes
- Identity
- Trusted proxy header. `AUTH_CLASS` swaps the auth middleware: local users by default, `ReverseProxyAuthMiddleware` reading a `REMOTE_USER` header, or `LdapAuthMiddleware`. No OIDC.
- Replaces
- AnyList, Out of Milk, Cozi, Sortly
- Project site
- grocy.info
- Source
- github.com/grocy/grocy
- Documentation
- github.com/grocy/grocy#how-to-install
Alternatives to grocy#
Everything else in tasks, recipes and personal finance, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| Actual Budget | 2, Light | 120 MB | MIT |
| Mealie | 2, Light | 300 MB | AGPL-3.0-or-later |
| Vikunja | 2, Light | 70 MB | AGPL-3.0-or-later |
| Firefly III | 3, Moderate | 250 MB | AGPL-3.0-or-later |
| PLANKA | 3, Moderate | 220 MB | PLANKA Community License (Fair Use License 1.1) |
Where grocy comes up elsewhere#
Migration guides
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
- Project repository, requirements and install steps
- Official changelog 4.6.0, PHP 8.5 requirement
- Official changelog 4.7.0, auth middleware and session invalidation
- config-dist.php, AUTH_CLASS and reverse proxy or LDAP options
- LinuxServer.io image documentation, ports and architectures
- Project site, feature modules and companion apps
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.