Vikunja

Task manager with list, kanban, gantt and CalDAV, shipped as one Go binary

ProductivityAGPL-3.0-or-laterStablearm64 buildsNative OIDC

Last reviewed 8 September 2026Profile maintained against the project's own documentation

Operational load

2 / 5

Light

Idle memory

70 MB

typical use ~180 MB

Moving parts

containers in a normal deployment

Backup shape

SQLite backup

needs a dump or a stop

Vikunja is a self-hosted task and project manager with list, table, kanban, calendar and gantt views over the same tasks, plus a CalDAV endpoint at /dav for phone task apps. It replaces Todoist or Trello for people who want the task history sitting in a database they control.

Our verdict on Vikunja#

Vikunja shipped 1.0.0 on 27 January 2026 after more than a year with no stable release, then 2.0.0 on 25 February 2026 to fix four CVEs and rebuild session handling. That cadence is the thing to plan for: the project is eight years old (first tagged release 0.1 in September 2018) but its stable line is barely a year old, and 2.0 logged out every session and required matching desktop client builds. What you get in exchange is the only task manager here that is a single Go binary. One container, SQLite if you want it, under 100 MB idle, no worker, no cache, no search service. Two honest limits. CalDAV works with DAVx5, OpenTasks, Tasks and Evolution, but the docs still describe it as early alpha and list Thunderbird and iOS CalDAV Sync as not working. And Typesense search was removed in 2.0 in favor of ParadeDB, so a Typesense sidecar you set up in 2025 is now dead weight.

Who Vikunja is for#

Choose it if

Someone leaving Todoist who wants the task history in a database they can dump and grep
A household or small team needing shared projects with per-project permissions rather than one flat personal list
Anyone who would rather run one container with SQLite than a four-service stack
Android users who want tasks to land in DAVx5 and OpenTasks instead of a second proprietary app

Look elsewhere if

You need dependable two-way CalDAV with iOS Reminders or Thunderbird, because neither is supported today
You cannot absorb a major release that invalidates all sessions and requires updating desktop clients in step
You want strong recurring-task handling across clients: recurrence rules sync out to CalDAV clients only, never back in

What running it actually looks like#

One container, vikunja/vikunja, serving the UI, /api/v1 and /dav all on port 3456. The official walkthrough pairs it with Postgres 18, so budget for two containers; SQLite works and puts you back to one. Before it starts, VIKUNJA_SERVICE_PUBLICURL has to be the exact external URL, because CORS has been on by default since 1.0 and a mismatched value gives you a UI that loads and then fails every request. Set VIKUNJA_SERVICE_SECRET too, or sessions reset whenever the container restarts. Mount /app/vikunja/files for attachments and project backgrounds; the container runs as uid 1000 with no group, so chown the host directory first. First run drops you on a registration screen rather than a seeded admin account, so register immediately and then disable open registration.

Resource profile#

Memory: 70 MB idle, around 180 MB in ordinary use. A single Go binary with the compiled frontend embedded, so the number tracks attachment handling and the size of the project you have open rather than user count. Add roughly 60 to 100 MB more if you run the Postgres container instead of SQLite.
CPU and acceleration: Idle CPU is negligible. Gantt rendering and search across a large project are the only real spikes, and both are short; no GPU, no transcoding, no background indexer.
Storage growth: The database stays small, a few tens of MB for thousands of tasks. Growth comes almost entirely from task attachments and project background images in the files volume.
Operational load: 2 of 5, Light. One app container plus a database, with schema migrations applied automatically on start and upgrades that are usually a pull and a restart. It scores 2 rather than 1 because the major releases in 2026 changed config keys, invalidated every session and removed a search backend, so release notes are not optional.

Figures describe a small single-household install and are the working assumptions behind our stack planner. Your numbers will differ with library size, user count and hardware. See methodology.

Data and backup surface#

Two things matter: the database and /app/vikunja/files. On Postgres take a pg_dump; on SQLite copy the database file, but check where it actually is first, because 1.0 changed relative SQLite paths to resolve against service.rootpath. The files directory holds task attachments and project background images and is not regenerable from anything. The bundled vikunja dump command bundles config, database and files into one zip, which is convenient, though the matching restore path had a zip traversal bug fixed in 2.0.0 (CVE-2026-27819), so only restore archives you made yourself. Nothing else inside the container is worth preserving.

Derived backup shape

SQLite backup. sqlite3 <db> ".backup out.db" while running, or stop the container and copy. A live cp of a WAL-mode SQLite file can restore corrupt.

Traps and surprises#

The separate api and frontend containers are gone

Through 0.22 Vikunja ran as two containers, usually with an nginx in front splitting /api from /. 0.23.0 merged the repositories and deprecated the vikunja/frontend image. The migration is: run vikunja/vikunja alone, delete the frontend container and the splitting proxy, and send all traffic to port 3456. The staticpath option was removed and frontendurl became publicurl. Upgrading an old stack without doing this leaves 502s and a blank page.

CORS on by default breaks reverse proxy setups

Since 1.0, CORS is enabled and service.publicurl must match the URL the browser actually uses, scheme and port included. Get it wrong and the app renders but every API call fails with an opaque error rather than anything that says CORS. Fix the public URL first before you go looking at the proxy. VIKUNJA_CORS_ENABLE=false is the documented escape hatch for genuinely unusual fronting.

2.0.0 invalidates every session and desktop build

2.0.0 rebuilt session management to fix CVE-2026-27575, where sessions stayed valid after a password change. Every session dies on upgrade, the desktop app has to be updated to a matching build, and API clients that relied on the old token behavior need retesting. The same release dropped Typesense in favor of ParadeDB, so any Typesense container in your stack can be removed rather than reconfigured.

OpenID config changed from a list to a map

1.0 changed OpenID provider configuration from an array of providers to a map keyed by provider name, and the upgrade does not rewrite it. An old-format config silently produces no provider buttons on the login page rather than an error. Edit config.yml or the matching VIKUNJA_AUTH_OPENID_* variables by hand before upgrading, and keep password login enabled until you have confirmed the new config actually works.

CalDAV is labeled early alpha

The endpoint is /dav, authenticated with your account password, a dedicated CalDAV token, or from 2.3.0 an API token carrying the CalDAV permission. Evolution, DAVx5, OpenTasks, Tasks for Android and KOrganizer are listed as working; Thunderbird 68 and iOS CalDAV Sync are listed as not. ATTACH, LOCATION and ORGANIZER are unsupported, and recurrence rules flow out to clients only.

Specifications#

Category: Tasks, recipes and personal finance
Licence: AGPL-3.0-or-later (Copyleft)
Written in: Go / Vue
First release: 2018
Maturity: Stable
Datastore: SQLite by default, PostgreSQL or MySQL/MariaDB supported
Default ports: 3456
Ships as: docker, deb/rpm/apk package, native binary
arm64 builds: Yes
Identity: Native OIDC. Built-in OpenID Connect against any provider, plus LDAP added in 1.0.0; no plugin needed.
Replaces: Todoist, Trello, Microsoft To Do, Asana
Project site: vikunja.io
Source: github.com/go-vikunja/vikunja
Documentation: vikunja.io/docs

Alternatives to Vikunja#

Everything else in tasks, recipes and personal finance, closest in operational weight first.

Tool	Ops load	Idle RAM	Licence
Actual Budget	2, Light	120 MB	MIT
Mealie	2, Light	300 MB	AGPL-3.0-or-later
Firefly III	3, Moderate	250 MB	AGPL-3.0-or-later
PLANKA	3, Moderate	220 MB	PLANKA Community License (Fair Use License 1.1)
grocy	1, Set and forget	40 MB	MIT

Where Vikunja comes up elsewhere#

Sources#

Facts on this page were checked against the project's own material. Where a number is our own estimate rather than a published figure, the text says so.

Published 8 September 2026. Last reviewed 8 September 2026. Found something out of date? Tell us and we will fix it and log the change.