ZFile's four storage-facing features, its sample Dockerfile, and its donation-only limits

Rate limiting and per-user file type rules are still donation-only

Two capabilities in the feature list are tagged 捐赠版, the donation edition: throttled downloads, and restricting which file types a given user may view or upload. Everything else in the list, from storage unification to previews to short links, is presented as part of the program itself. The version note complicates that split further: ZFile 5.x has been released, the open source edition and the donation edition have been merged into a single version, and the donation code is to be stripped out later and opened into this repository. Consequence for an administrator: two controls that matter for a shared deployment, bandwidth limits and file type policy per account, are marked as donation-edition features, and the note describes opening that code as a future step rather than a shipped one.

The fast install is three commands and one of them executes a remote script

The quick start is exactly this:

curl -fsSL https://docs.zfile.vip/install.sh -o install.sh
chmod +x install.sh
./install.sh

The first line pulls a shell script from the documentation host, the second makes it executable, and the third runs it, so the whole install is decided by what that host serves at the moment you fetch it. The README prints the script's contents nowhere, and every other installation route, including the Docker and Docker Compose paths for AMD64 and ARM64, sits behind the install documentation at docs.zfile.vip/install/ rather than in the page itself. Consequence for readers on a locked-down machine: the documented fast path is remote code execution by design, and the alternative routes have to be fetched from a separate site before you can see them.

The repository Dockerfile is a sample, and it bakes in Asia/Shanghai

The comment at the top of the Dockerfile says the file is only an example and differs from the Dockerfile ZFile actually packages, because the real build uses Graal Native packaging and that part is not open source. What the sample does show is the shape of the build: a Maven builder stage on eclipse-temurin-21-alpine runs `mvn clean package -Dmaven.test.skip=true`, and the runtime is a Jammy JRE image exposing port 8080, with the built jar copied to /root/app.jar and started as `CMD ["java", "-jar", "app.jar"]`. It also sets `ENV LANG=C.UTF-8` and `ENV LC_ALL=C.UTF-8`, installs fontconfig, and symlinks the timezone database so that /etc/timezone reads Asia/Shanghai. Consequence: anyone who assumes this file produces the shipped image is wrong on the packaging step, and anyone who reuses it unchanged runs the service in the Asia/Shanghai timezone.

Storage sources are the point, and write-back behaviour is undocumented

The unified list is S3, OneDrive, SharePoint, Google Drive, 多吉云, 又拍云, local storage, FTP, and SFTP, all reachable through one file browser that also previews images, audio and video, text, PDF, Office documents, and OBJ 3D files. Multi-user support means you can assign a storage source or a directory to a given user rather than exposing everything. What the README does not say is what happens when you change a file through the interface: whether the change is written back to the origin storage, whether the tool is read-only for some providers, or whether deletes propagate. Consequence: for a team that treats these drives as the source of truth, that gap has to be closed in the documentation site before the UI is trusted with write operations.

Sharing is direct links plus short links with an expiry date

Two kinds of link are generated: a direct file link and a short link, and the short link can be given a validity period. That is the entire sharing mechanism described in the page, and the feature list says nothing about link passwords, download counts, per-link quotas, or a revocation list. The project also advertises a responsive layout for phones, tablets, and desktops, and a set of keyboard gestures for the file list: `Ctrl + A` selects everything, `Ctrl + left click` multi-selects, `Shift + left click` selects a range, and `Esc` clears the selection. Consequence for sharing anything sensitive: an expiring short link is the only access control in evidence, so the decision about who receives a link is the entire security decision, and expiry is the only lever available to limit its damage.

Five preview formats are promised by screenshot, not by specification

The feature preview is a grid of labelled screenshots: file list, gallery mode, video preview, audio preview, text preview, PDF preview, Office preview, 3D file preview, direct link generation, and page settings, plus five collapsed admin shots covering backend login, the storage source list, adding local storage, user management, and display settings. No file size limit appears next to any preview type, no list of supported Office formats is given, and no statement covers which codecs the audio and video previews need. The demo instance at demo.zfile.vip is offered as the place to see the behaviour. Consequence: if your storage is full of large Office files or uncommon video formats, the screenshots confirm the feature exists and nothing else, so the only reliable test is your own upload.

The version line jumps from 4.5.0 to 5.0.5 with no mapping in the README

The three most recent releases are 4.4.0 on 2025-08-24, 4.5.0 on 2025-11-12, and 5.0.5 on 2026-08-13, and the last push to the default branch main is dated 2026-11-02. The numbered jump means anyone pinning a version cannot infer anything about compatibility from the digits, and the README maps no version to a set of changes. That job is handed to the changelog at docs.zfile.vip/changelog/, which also holds whatever the 5.x merge of the two editions changed. Consequence for an upgrade: the README gives you a version number and no migration note, so a team moving from a 4.x install has to diff the changelog on the documentation site before touching a running deployment.

Editorial conclusion

ZFile fits a person or a small team that already has files scattered across object storage, office drives, and a file server and wants one browser UI with previews and expiring share links. It does not fit anyone who needs the documented rate limiting or per-user file type restrictions today, since the README marks both as donation version features, and it does not fit anyone who must reproduce the shipped container, because the repository's Dockerfile says outright that the real one uses Graal Native packaging that is not open source. Before installing, read the install script from docs.zfile.vip instead of executing it blind, check the changelog for what changed in 5.x, and decide how you will handle the Asia/Shanghai timezone the sample image hardcodes.

Frequently asked questions

Official sources

1. License: MIT
2. Project website
3. README
4. Releases
5. zfile-dev/zfile on GitHub