Install Nextcloud All-in-One with Docker

Nextcloud All-in-One (AIO) packages Nextcloud, its database, cache, reverse proxy and backup tooling into a container set that one master container manages. That removes most of the manual wiring a hand-written docker compose stack needs, but it expects specific ports and a publicly resolvable domain. This tutorial installs AIO on a Linux host with Docker Engine and gets you to a working instance reachable over HTTPS.

What is Nextcloud All-in-One?

Nextcloud All-in-One is the official Docker deployment method in which one mastercontainer creates, configures and updates every other Nextcloud container (Apache, PostgreSQL, Redis, Collabora, Talk, BorgBackup) through the Docker socket.

You never write a compose file yourself. You start exactly one container, open a web interface on port 8080, and the mastercontainer pulls and wires up the rest. Configuration that would normally live in config.php, postgresql.conf and a reverse proxy vhost is handled by AIO through environment variables and its own interface.

graph TD
  A["Admin browser"] -->|"Port 8080 / 8443"| B["nextcloud-aio-mastercontainer"]
  B -->|"/var/run/docker.sock"| C["Docker Engine"]
  C --> D["nextcloud-aio-apache"]
  C --> E["nextcloud-aio-nextcloud"]
  C --> F["nextcloud-aio-database"]
  C --> G["nextcloud-aio-redis"]
  C --> H["nextcloud-aio-borgbackup"]
  U["User browser"] -->|"Port 443"| D
  D --> E
  E --> F
  E --> G

Prerequisites

• A Linux host with Docker Engine 20.10 or newer, installed from the official Docker repository. Docker Desktop and rootless Docker are not supported for the default setup.
• Root access or a user with sudo rights.
• At least 2 vCPU and 4 GB RAM. Enable Collabora or ClamAV only with 6 GB or more.
• A domain name with a public DNS A record (and AAAA record if you use IPv6) pointing at the host.
• Ports 80, 443, 8080 and 8443 free on the host. No other web server may occupy port 80 or 443.

A plain Linux VM is enough. On a scalable Cloud-VPS from centron you can size the instance to the storage your users actually need and resize later.

Point the DNS record at your server

AIO validates the domain before it starts the remaining containers. Confirm the record resolves to the public IP of your host:

$ dig +short cloud.example.com
203.0.113.10

If the output is empty or shows a different address, fix DNS first. Propagation delays cause most failed installations.

Which ports does Nextcloud AIO need?

Nextcloud AIO needs TCP port 80 for the ACME HTTP-01 challenge, TCP ports 8080 and 8443 for the AIO admin interface, and TCP plus UDP port 443 for Nextcloud itself through the Apache container.

Open them in the firewall before you start the container:

$ sudo ufw allow 80/tcp
$ sudo ufw allow 443
$ sudo ufw allow 8080/tcp
$ sudo ufw allow 8443/tcp
$ sudo ufw reload

Port 8080 is only needed during the initial setup and for recovery. You can close it once the instance runs and use port 8443 instead.

Start the mastercontainer

Run the mastercontainer with a single docker run command. It publishes the three admin ports and mounts the Docker socket read-only so it can manage the other containers:

$ sudo docker run \
  --init \
  --sig-proxy=false \
  --name nextcloud-aio-mastercontainer \
  --restart always \
  --publish 80:80 \
  --publish 8080:8080 \
  --publish 8443:8443 \
  --volume nextcloud_aio_mastercontainer:/mnt/docker-aio-config \
  --volume /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/nextcloud-releases/all-in-one:latest

The named volume nextcloud_aio_mastercontainer must keep exactly that name. AIO hardcodes it, and renaming it breaks updates and backups.

Two environment variables are worth setting at this point, because they cannot be changed later without a reinstall:

• NEXTCLOUD_DATADIR points the user data directory at a host path instead of a Docker volume, for example --env NEXTCLOUD_DATADIR="/mnt/ncdata". Use this when data lives on a separate block device.
• APACHE_PORT moves the Nextcloud port away from 443, for example --env APACHE_PORT=11000. Set this only when you run AIO behind an existing reverse proxy.

For a standard installation on a dedicated host, leave both unset.

Complete the setup in the AIO interface

Open https://<your-server-ip>:8080 in a browser and accept the self-signed certificate warning. The first page shows the AIO passphrase. Store it in a password manager immediately, because it is the only way back into the interface.

1. Enter your domain, for example cloud.example.com, and start the domain validation. AIO checks that the domain resolves to this host and that port 80 is reachable from the internet.
2. Select the optional containers you need. Collabora, Talk, Imaginary and ClamAV each add RAM usage, so enable only what you use.
3. Set the timezone and the daily backup window.
4. Click Download and start containers. The first run pulls several gigabytes of images and takes a few minutes.

When all containers report a green status, the interface shows the initial Nextcloud admin credentials. The username is admin. Log in at https://cloud.example.com and change the password.

From this point on, use https://cloud.example.com:8443 for the AIO interface. It serves a valid certificate, so the browser warning disappears.

Configure backups with BorgBackup

AIO ships a BorgBackup container that creates deduplicated, encrypted snapshots of every Docker volume plus the Nextcloud data directory. It stops the containers during the run, so the backup is consistent rather than a live copy.

Create an empty target directory on a separate disk before you enable it:

$ sudo mkdir -p /mnt/backup
$ sudo chown root:root /mnt/backup

Enter /mnt/backup in the backup section of the AIO interface and create the first backup manually. AIO prints a Borg encryption passphrase. Without it, the archive cannot be restored, so store it separately from the server.

A backup on the same physical host protects against a broken update, not against host loss. Mirror the Borg repository to a second location, for example with rsync to another VM or to S3-compatible object storage, and verify the copy on a schedule. Additional block storage on the same scalable Cloud-VPS platform works as an intermediate target before the offsite copy.

Verify the installation

Check that the container set is up and healthy:

$ sudo docker ps --filter "name=nextcloud-aio" --format "table {{.Names}}\t{{.Status}}"
NAMES                            STATUS
nextcloud-aio-apache             Up 6 minutes (healthy)
nextcloud-aio-notify-push        Up 6 minutes
nextcloud-aio-nextcloud          Up 6 minutes (healthy)
nextcloud-aio-redis              Up 7 minutes (healthy)
nextcloud-aio-database           Up 7 minutes (healthy)
nextcloud-aio-mastercontainer    Up 20 minutes (healthy)

Query the instance state through occ inside the Nextcloud container:

$ sudo docker exec --user www-data -it nextcloud-aio-nextcloud php occ status
  - installed: true
  - version: 31.0.5.1
  - versionstring: 31.0.5
  - edition:
  - maintenance: false
  - needsDbUpgrade: false

installed: true and maintenance: false mean the instance is serving requests. Finally confirm the public endpoint answers with a valid certificate:

$ curl -sI https://cloud.example.com | head -n 1
HTTP/2 302

The 302 is the redirect to /login and is the expected response for an anonymous request.

Update Nextcloud AIO

Updates run in two stages. The mastercontainer updates itself only when you replace its image, and it then updates everything else.

Update the mastercontainer with a one-off watchtower run:

$ sudo docker run --rm \
  --volume /var/run/docker.sock:/var/run/docker.sock \
  containrrr/watchtower \
  --run-once nextcloud-aio-mastercontainer

After that, open the AIO interface on port 8443, stop the containers and click Update containers. AIO creates a backup first if the backup section is configured, which is the main reason to set backups up before the first update.

Troubleshooting

Domain validation fails. Verify the A record with dig +short cloud.example.com and confirm that port 80 is reachable from outside. Split-horizon DNS is the usual cause on internal networks. In that case start the mastercontainer with --env SKIP_DOMAIN_VALIDATION=true, but only when you are certain the domain resolves correctly for your users.

Port 80 is already in use. A distribution package such as nginx or apache2 may already bind it. Identify the process and stop it:

$ sudo ss -tulpn | grep ':80 '
$ sudo systemctl disable --now nginx

Containers restart in a loop. Read the mastercontainer log, which records why a child container was stopped:

$ sudo docker logs --tail 50 nextcloud-aio-mastercontainer

Out-of-memory kills during the Collabora or ClamAV start are common on hosts with 4 GB RAM. Disable those containers in the AIO interface or increase memory.

Wrap-up

The instance now runs behind a valid certificate, updates through the AIO interface and writes encrypted Borg snapshots. Two follow-up tasks are worth scheduling: copy the Borg repository offsite and store the AIO passphrase plus the Borg passphrase where they survive the loss of the server. Both are needed for a restore, and neither can be recovered from the running instance.

Read next

• Back Up and Restore Nextcloud: Data, Database, Config
• Install Nextcloud on Ubuntu 24.04 with nginx
• Mount Nextcloud via WebDAV on Linux, Windows and macOS
• Nextcloud vs ownCloud vs Seafile: Which One Fits?
• Run Nextcloud with Docker Compose
• Set Up Nextcloud Office: Collabora or OnlyOffice
• Updating Nextcloud: Web Updater, occ and a Rollback Plan
• What Is Nextcloud? Architecture, Components and Use Cases
• Which Server for Nextcloud? Sizing RAM, CPU and Storage