Deploy Penpot with Dokploy

Dokploy is an open-source server management platform that simplifies deploying Docker Compose applications on your VPS. It handles reverse proxy configuration, SSL certificates, and deployment management — making it manageable to run Penpot's multi-service design platform.

This guide walks you through deploying Penpot with its frontend, backend, exporter services, PostgreSQL database, and Redis. Penpot is an open-source design and prototyping platform — a self-hosted alternative to Figma.

Prerequisites

• A VPS with at least 2 vCPUs, 4 GB RAM, and 20 GB storage
• Dokploy installed and running on your server (installation docs)
• A domain name (e.g., penpot.yourdomain.com) with DNS A record pointing to your server's IP

Docker Compose Configuration

Create a new Compose project in Dokploy and paste the following configuration:

version: "3.8"

services:
  penpot-frontend:
    image: penpotapp/frontend:latest
    restart: unless-stopped
    ports:
      - "9001:8080"
    environment:
      - PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification disable-smtp disable-telemetry
    depends_on:
      - penpot-backend
      - penpot-exporter

  penpot-backend:
    image: penpotapp/backend:latest
    restart: unless-stopped
    environment:
      - PENPOT_FLAGS=enable-registration enable-login-with-password disable-email-verification disable-smtp disable-telemetry
      - PENPOT_PUBLIC_URI=https://${PENPOT_DOMAIN}
      - PENPOT_SECRET_KEY=${PENPOT_SECRET_KEY}
      - PENPOT_DATABASE_URI=postgresql://penpot-db/penpot
      - PENPOT_DATABASE_USERNAME=penpot
      - PENPOT_DATABASE_PASSWORD=${PENPOT_DB_PASSWORD}
      - PENPOT_REDIS_URI=redis://penpot-redis/0
      - PENPOT_ASSETS_STORAGE_BACKEND=assets-fs
      - PENPOT_STORAGE_ASSETS_FS_DIRECTORY=/opt/data/assets
    volumes:
      - ../files/penpot-assets:/opt/data/assets
    depends_on:
      penpot-db:
        condition: service_healthy
      penpot-redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD-SHELL", "curl -f http://localhost:6060/readyz || exit 1"]
      interval: 30s
      timeout: 10s
      retries: 5

  penpot-exporter:
    image: penpotapp/exporter:latest
    restart: unless-stopped
    environment:
      - PENPOT_PUBLIC_URI=http://penpot-frontend:8080
      - PENPOT_REDIS_URI=redis://penpot-redis/0
    depends_on:
      penpot-redis:
        condition: service_healthy

  penpot-db:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      - POSTGRES_DB=penpot
      - POSTGRES_USER=penpot
      - POSTGRES_PASSWORD=${PENPOT_DB_PASSWORD}
    volumes:
      - ../files/penpot-db-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U penpot"]
      interval: 10s
      timeout: 5s
      retries: 5

  penpot-redis:
    image: redis:7-alpine
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

Note: The PENPOT_FLAGS setting controls features. This configuration enables password login and registration while disabling email verification and SMTP. To enable email verification, add SMTP settings and replace disable-email-verification with enable-email-verification and disable-smtp with enable-smtp.

Environment Variables

Set these in Dokploy's Environment tab for your compose project:

Variable	Purpose	Example
PENPOT_DOMAIN	Your Penpot domain	penpot.yourdomain.com
PENPOT_SECRET_KEY	Master encryption key (base64, 512-bit recommended)	a-very-long-random-secret-key
PENPOT_DB_PASSWORD	PostgreSQL database password	a-strong-random-password

In Dokploy, environment variables are set via the Environment editor in the project settings. Do not create a .env file manually — Dokploy manages this for you. The secret key is used to derive encryption keys for sessions and invitations — keep it consistent across redeployments.

Volumes & Data Persistence

This setup uses Dokploy's ../files convention for bind-mounted volumes:

• ../files/penpot-assets — Design files, uploaded images, fonts, and exported assets
• ../files/penpot-db-data — PostgreSQL database files (user accounts, projects, designs)

The ../files path is relative to the compose file inside Dokploy's project directory. This ensures your data persists across redeployments. Avoid using absolute paths because Dokploy may clean them during redeployment.

If you need S3 backup support, consider using named Docker volumes or configuring Penpot's S3 storage backend by changing PENPOT_ASSETS_STORAGE_BACKEND=assets-s3 with appropriate S3 credentials.

Domain & SSL Setup

1. In your Dokploy project, navigate to the Domains tab
2. Click Add Domain and enter your domain (e.g., penpot.yourdomain.com)
3. Set the container port to 8080 (Penpot frontend's internal port)
4. Enable HTTPS — Dokploy automatically provisions a Let's Encrypt SSL certificate
5. Save and wait for the certificate to be issued (usually under a minute)

Dokploy's built-in Traefik reverse proxy handles TLS termination and routes traffic to the Penpot frontend, which proxies API requests to the backend.

Verifying the Deployment

1. In Dokploy, go to your project's Deployments tab and click Deploy
2. Watch the build logs — services should start in order (database and Redis first, then backend and exporter, then frontend)
3. Check the Logs tab for penpot-backend. Look for the readiness endpoint responding
4. Open https://penpot.yourdomain.com in your browser — you should see the Penpot login page
5. Register a new account and create a project to verify the design editor loads
6. Test exporting a design to verify the exporter service is working

Troubleshooting

Frontend loads but shows API errors The frontend proxies API calls to the backend. Ensure penpot-backend is running and healthy. Check backend logs for database connection errors. The PENPOT_PUBLIC_URI must match your domain with https://.

Registration fails or login errors Verify PENPOT_FLAGS includes enable-registration and enable-login-with-password. If email verification is enabled, SMTP must be configured. Check that the PENPOT_SECRET_KEY has not changed between deployments — changing it invalidates sessions.

Export feature not working The exporter service runs a headless browser to render designs. It requires at least 1 GB of available RAM. Check penpot-exporter logs for memory or connection errors. The exporter connects to the frontend internally via http://penpot-frontend:8080.

SSL certificate not issuing Ensure your domain's DNS A record points to your server's IP and has propagated. Dokploy uses Let's Encrypt HTTP-01 challenges, so port 80 must be accessible. Check Traefik logs in Dokploy for certificate-related errors.

---

Learn more about Penpot in our complete overview.

Need a VPS? Hostinger VPS starts at $4.99/mo — perfect for running Penpot.

---

For more on Docker Compose deployments in Dokploy, see the Dokploy Docker Compose documentation.

App data sourced from selfh.st open-source directory.