docker-paperless-ngx

What the image does

This is a community-supported image for paperless-ngx, a document management system that lets you scan, index, and archive all your documents. The introduction calls it a supercharged DMS and the synopsis explains that the image runs paperless-ngx with s6 but rootless. The unique value proposition lists why you might pick this image over others. It runs rootless as user 1000:1000, so the process does not hold root inside the container. It is auto updated to the latest version through CI/CD. It includes a health check. It is scanned for CVEs both before and after publishing. And it is created through a secure and pinned CI/CD process. The author writes that if you value security, simplicity, and extreme optimization, the image may suit you. The framing is for operators who care about how the container is built and run, not just that paperless-ngx is present. The image is about 2 GB in size according to the badge, which is a practical planning number for pulls and storage. The s6 init system is worth noting because it gives the container proper process supervision, so the document services start and stop in a defined order rather than as a loose set of background processes.

Volumes and configuration

The volumes section documents the directories you should mount. The consume directory is where you place documents you want the system to ingest. The media/documents/originals directory holds the original files. There are additional paths implied by the standard paperless-ngx layout for thumbnails and processed data. The environment section lists the settings you can pass to tune the container, and the default settings section records what the image assumes out of the box. A compose snippet shows how to wire the image into a stack. The README notes there is no latest tag, and it tells you what to do about updates: because the build is pinned and auto updated, you track specific tags rather than a moving latest. The registries section lists where the image is published, and there are notes for Unraid and for a nobody-version variant, so the image reaches a few common deployment targets without you rebuilding it. The absence of a latest tag is deliberate: it forces you to pin a version and therefore to make a conscious choice when you upgrade, which is safer for a system holding your documents. The compose example is the fastest way to get a working stack, since it shows the volume mounts and environment together in one place.

Source and posture

The source section points back to the packaging repository where the Dockerfile and CI definitions live, and the README badges mark the image as Swiss Made, a label the author uses for their containers. The security posture is the main reason to choose this image: rootless by default, CVE scanning before and after publish, a health check, and a pinned build pipeline. Those are operational properties rather than features of paperless-ngx itself, which remains the upstream application doing the document work. Because the image is community-supported, you should not expect vendor backing, but the build transparency lets you audit the Dockerfile directly. The repository that packages the image is published under the MIT license, so you can fork the build, adjust the tags, or rebuild with your own base. For a self-hosted document archive, the rootless and scanned defaults remove two common container hardening steps you would otherwise do by hand. The Swiss Made badge is the author's own marking rather than an official certification, so read it as a style signal about how they build images, not as a third-party audit. The practical takeaway is that this image trades the convenience of a moving latest tag for a verifiable, least-privilege deployment of paperless-ngx.

Editorial conclusion

The image is community-supported, built around paperless-ngx, and the packaging repository is published under the MIT license.