owncloud/ocis repository overview

⁠ownCloud Infinite Scale Docker Image

Docker image for ownCloud Infinite Scale (oCIS)⁠ — a modern file-sync and share platform.

⁠Quick Start

docker run --rm \
  -p 9200:9200 \
  -e OCIS_INSECURE=true \
  owncloud/ocis:8.1.0

⁠Supported Tags

⁠Rolling Image

A daily build tracking the unreleased master branch of oCIS is published to owncloud/ocis-rolling⁠. It is built every night at 02:00 UTC from the latest master commit.

docker pull owncloud/ocis-rolling:latest

⁠Volumes

⁠Ports

⁠Build Arguments

⁠Building

The image is built entirely from source via a three-stage Dockerfile:

node-builder — clones the oCIS git repository at v${VERSION}, builds the IDP React frontend (pnpm build) and downloads the web frontend assets (make pull-assets). Both are required at compile time because services/idp and services/web use //go:embed. The IDP pnpm build runs only when services/idp/package.json is present; newer oCIS master ("no-npm") commits the identifier assets directly and has no package.json, so the step is skipped automatically.

go-builder — compiles the oCIS binary with CGO and libvips enabled using the upstream Makefile target release-linux-docker-${TARGETARCH}. Outputs to dist/binaries/ocis-linux-${TARGETARCH}.

Runtime — minimal Alpine image with the binary copied from go-builder. The stage runs apk upgrade to refresh all installed OS packages to the latest available Alpine patch releases at build time, so security fixes are picked up immediately rather than waiting for a base-image tag bump.

To build locally:

docker buildx build \
  --build-arg VERSION=8.0.1 \
  --build-arg REVISION=$(git rev-parse HEAD) \
  --platform linux/amd64 \
  -f v8/Dockerfile.multiarch v8/

⁠CI

The GitHub Actions workflow (.github/workflows/main.yml) builds and validates the image on every push, pull request, and weekly schedule.

Steps per release matrix entry:

1. Build — multi-arch image (linux/amd64, linux/arm64) pushed to an ephemeral local registry using BuildKit with GHA layer cache.
2. Trivy scan — scans for HIGH/CRITICAL CVEs; unfixable upstream CVEs are listed in v8/.trivyignore.
3. Smoke test — starts the container, polls https://localhost:9200/status.php every 2s for up to 62s, and verifies the .productversion field in the JSON response matches the built tag. Uses OCIS_INSECURE=true to allow self-signed TLS on the test runner.
4. Publish — pushes to Docker Hub with floating major/minor tags (on master only).

⁠Community & Support

• ownCloud Website⁠
• Community Discussions⁠
• Matrix Chat⁠
• Documentation⁠
• Enterprise Support⁠
• OSPO Home⁠

See SUPPORT.md⁠ for the full list of support channels.

⁠Contributing

We welcome contributions! Please read the Contributing Guidelines⁠ and our Code of Conduct⁠ before getting started.

• Rebase Early, Rebase Often! We use a rebase workflow — rebase on the target branch before submitting a PR.
• Signed commits: All commits must be PGP/GPG signed and carry a DCO Signed-off-by line (git commit -S -s).
• Conventional Commits: PR titles must follow the Conventional Commits⁠ format — enforced by CI.
• GitHub Actions Policy: Workflows may only use actions owned by owncloud, created by GitHub (actions/*), or verified in the GitHub Marketplace, pinned to a full commit SHA.

Note: bug reports and feature requests for oCIS itself belong upstream in owncloud/ocis⁠ — this repository tracks only the Docker packaging.

⁠Security

Do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities at https://security.owncloud.com⁠ — see SECURITY.md⁠.

Bug bounty: YesWeHack ownCloud Program⁠

⁠About the ownCloud OSPO

The Kiteworks Open Source Program Office⁠, operating under the ownCloud⁠ brand, launched on May 5, 2026, to steward the open source ecosystem around ownCloud's products. The OSPO ensures transparent governance, license compliance, community health, and sustainable collaboration between the open source community and Kiteworks⁠, which acquired ownCloud in 2023.

• OSPO Home: https://kiteworks.com/opensource⁠
• GitHub: https://github.com/owncloud⁠
• ownCloud: https://owncloud.com⁠

For questions about the OSPO or licensing, contact [email protected]⁠.

This repository is licensed under the Apache License 2.0, which is the license the OSPO is adopting across the ecosystem. No relicensing is required.

⁠License

Apache-2.0 — see LICENSE⁠.