PLANKA
Trello-style kanban with live updates, now under a source-available Fair Use License
PLANKA is a real-time kanban board: projects, boards, lists and cards with drag and drop, markdown descriptions, attachments and instant sync between everyone looking at the same board. It replaces Trello for teams and households that want the boards on their own Postgres.
Our verdict on PLANKA#
PLANKA is not open source any more, and that is the first thing to settle. It was MIT, then AGPL-3.0 from 2023, and since the 2.0 release candidates in May 2025 the community edition ships under the PLANKA Community License, a Fair Use License derived from n8n's Sustainable Use License and held by PLANKA Software GmbH. For a homelab or an internal company board this costs you nothing: personal, hobby, educational and internal-organization use are all explicitly permitted, free, indefinitely. What it forbids is giving board access to anyone outside your own legal entity in a commercial relationship, running it as a hosted service, or selling anything whose value derives from PLANKA. Consulting about PLANKA is fine. The sharper practical problem for most self-hosters is 2.2.0 (August 2026), which removed OIDC from the community edition and deactivated every SSO-based account, leaving an admin to set passwords by hand.
Who PLANKA is for#
Choose it if
- A household or a single company running internal boards, where the Fair Use License restricts nothing you were going to do
- Teams that specifically want Trello's drag-and-drop feel and live multi-user updates, not a task list with a board view attached
- Anyone who wants markdown cards, attachments and per-board notification providers without a per-seat SaaS bill
- Small agencies keeping internal delivery boards, as long as clients never get logins
Look elsewhere if
- You give board access to clients or contractors outside your legal entity in a paid relationship, which requires a Pro licence
- You depend on OIDC single sign-on: 2.2.0 moved it to Pro and deactivated existing SSO users on upgrade
- You need an OSI-approved licence for procurement or policy reasons, or you want to fork and redistribute freely
What running it actually looks like#
Two containers: ghcr.io/plankanban/planka and Postgres (the shipped compose uses postgres:16-alpine on an internal network). The app listens on 1337 inside the container and the stock compose publishes it as 3000. Three environment variables decide whether it works at all: BASE_URL must be the exact external URL, DATABASE_URL points at the Postgres service, and SECRET_KEY signs every access token. The published example value is literally notsecretkey, so generate one with openssl rand -hex 32; recent versions warn on every start until you do. Mount /app/data for uploads. Node.js 24 is required for source and manual installs since 2.2.0, though Docker users are unaffected. First boot creates the admin from DEFAULT_ADMIN_EMAIL and friends if you set them.
Resource profile#
- Memory
- 220 MB idle, around 400 MB in ordinary use. A Node.js process holding open websockets per connected client, so it grows with concurrent viewers rather than with card count. The Postgres container adds another 60 to 120 MB on top.
- CPU and acceleration
- Near zero at rest. Spikes come from image processing on attachment upload (2.0 parallelized it) and from the initial load of a board with hundreds of cards.
- Storage growth
- Attachments dominate. The database itself stays in the tens of MB for a busy team, while card attachments and board background images grow without limit unless you set `STORAGE_LIMIT` or push files to S3.
- Operational load
- 3 of 5, Moderate. Two services with a real database, a schema that migrates on start, and a restore that needs the database and the uploads directory put back in a defined order. The 2.x line has also shipped breaking changes worth reading before every minor upgrade, including a feature removal that deactivated user accounts.
Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.
Data and backup surface#
The Postgres database plus the /app/data volume, and the order matters. The repo ships docker-backup.sh whose own header is refreshingly blunt about its limits: it runs pg_dumpall first and copies files second, so anything created in the gap leaves an inert orphan file rather than a row pointing at a file that was never copied. Neither order survives a deletion landing in that window, so stop the app or use point-in-time recovery with a volume snapshot for a clean point. The archive is written in the clear unless you set BACKUP_PASSPHRASE, and it contains password hashes, live sessions, TOTP secrets and recovery codes, SMTP credentials and API keys.
Derived backup shape
Postgres dump. pg_dump (or pg_dumpall) into a file, then snapshot that file plus the app's data volume.
Traps and surprises#
Older articles state the licence wrong
PLANKA went MIT, then AGPL-3.0 in 2023, then to the Fair Use License with the 2.0 release candidates in 2025. Anything describing 2.x as AGPL or MIT predates that. The 1.x tags remain AGPL-3.0, so pinning 1.x keeps you on a copyleft licence but off all 2.x security fixes. Separately, files with .pe. in the name or path are Pro/Enterprise and are not covered by the community licence at all.
2.2.0 removed OIDC and deactivated SSO users
The 2.2.0 breaking changes list is short and expensive: OIDC/SSO moved to PLANKA Pro, and all SSO-based users were deactivated because they no longer have a password login. An admin has to set a password for each one and reactivate them individually. If you front PLANKA with Authelia or Keycloak, plan that migration before you pull the image, not after users report they cannot log in.
SECRET_KEY ships as a published default
The example compose sets SECRET_KEY=notsecretkey. Every access token is signed with it, so leaving the example value means anyone who has read the repo can mint a token for any account on your instance. Generate 32 random hex bytes and set it before the first user logs in; changing it later invalidates every existing session. SECRET_KEY__FILE reads it from a Docker secret if you would rather not put it in the compose file.
The shipped compose trusts all Postgres connections
The official docker-compose.yml sets POSTGRES_HOST_AUTH_METHOD=trust and uses a passwordless DATABASE_URL. That is contained while the database is only reachable on the compose network, but publish 5432 for a backup tool, or attach the database to a shared network, and anyone who can reach it connects as superuser. Set a real password and use the DATABASE_PASSWORD__FILE secret support the compose file already documents.
Path traversal fixed only in 2.2.1
2.2.1, released 10 August 2026, one day after 2.2.0, fixed a path traversal in the static file routes that let any authenticated user read arbitrary files from the server, config included. If you are on 2.2.0 or earlier in the 2.x line, that is the upgrade to do first. There is no configuration workaround short of not letting anyone you do not trust hold an account.
Specifications#
- Category
- Tasks, recipes and personal finance
- Licence
- PLANKA Community License (Fair Use License 1.1) (Source available)
- Written in
- JavaScript / Node.js (Sails.js and React)
- First release
- 2019
- Maturity
- Stable
- Datastore
- PostgreSQL
- Default ports
1337- Ships as
- docker, docker compose, helm chart, node source install
- arm64 builds
- Yes
- Identity
- Local accounts only. OIDC existed in the community edition until 2.2.0 removed it to PLANKA Pro; local accounts with optional TOTP are what remains.
- Replaces
- Trello, Asana, Monday.com, Jira
- Project site
- planka.app
- Source
- github.com/plankanban/planka
- Documentation
- docs.planka.cloud/docs/welcome
Alternatives to PLANKA#
Everything else in tasks, recipes and personal finance, closest in operational weight first.
| Tool | Ops load | Idle RAM | Licence |
|---|---|---|---|
| Firefly III | 3, Moderate | 250 MB | AGPL-3.0-or-later |
| Actual Budget | 2, Light | 120 MB | MIT |
| Mealie | 2, Light | 300 MB | AGPL-3.0-or-later |
| Vikunja | 2, Light | 70 MB | AGPL-3.0-or-later |
| grocy | 1, Set and forget | 40 MB | MIT |
Where PLANKA comes up elsewhere#
Head to head
Migration guides
Sources#
Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.
- PLANKA Community License, Fair Use License 1.1 text
- PLANKA License Guide, permitted and prohibited use
- Official changelog, 2.2.0 breaking changes and 2.2.1 fix
- Official docker-compose.yml, ports and required variables
- Official backup script and its stated limitations
- Project repository and licence summary
Published . Last reviewed . Found something out of date? Tell us and we will fix it and log the change.