iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The most practical way to run a private document archive at home is to deploy Paperless-ngx with Docker Compose on a host you control. Compose starts the application, database, message broker, volumes and any optional conversion services as one managed stack. You keep the files on your own storage, but you also become responsible for updates, access control, backups and recovery testing.
This guide walks through the supported interactive and manual installation paths, storage planning, OCR and filesystem settings, security boundaries, backup design, NAS considerations and routine maintenance. It does not assume a particular CPU, memory size or storage product; choose capacity from your document volume, OCR workload and retained backup copies.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsWhat a self-hosted document management system does
Paperless-ngx turns scanned or already-digital records into a searchable online archive. It stores the original files, extracts text with OCR, and lets you organize documents with metadata such as correspondents, document types and tags. A web interface provides access from a browser on your local network.
Docker packages the application and its supporting software into containers. Docker Compose is the declaration and control layer: a Compose file describes the containers, networks, persistent volumes, environment values and secrets, and the Compose command creates and starts that set together. Docker documents Compose as suitable for a single-server deployment, while noting that production deployments often need configuration overrides for ports, environment values, extra services and restart behavior.
#1 Best Overall
- PORTABLE SCANNER FOR USE ON-THE-GO — The fastest and lightest mobile single-sheet-fed compact document scanner in its class¹
- QUICK DOCUMENT SCANNING ― This Epson ultra-fast scanner scans a single page as quickly as 5.5 seconds²; Windows and Mac compatible
- VERSATILE PAPER HANDLING ― Portable scanner scans documents up to 8.5 x 72 in; Also easily digitizes receipts and ID cards to make accounting, bookkeeping, and organizing simpler
- INTUITIVE, HIGH-SPEED SOFTWARE — Epson ScanSmart Software³ is a smart tool allowing you to easily scan, review, and save; Stay organized easily with the help of this Epson scanner
- EASY SETUP — USB-powered connect to your computer for quick and simple scanning; No batteries or external power supply required to operate portable document scanner; Standard Connectivity: USB 2.0
Self-hosting is therefore an operational choice, not just an installation method. You decide where data resides and who can reach it, but you must also keep the host patched, protect credentials, maintain storage, make independent backups and prove that a restore works.
What do I need to run a document management system at home?
- A trusted, always-available host: Use a computer, server or NAS that you administer and can keep powered whenever documents need to be ingested or searched. Paperless-ngx explicitly warns against running on an untrusted host.
- Docker Engine and the Compose plugin: Install the versions supported by your host operating system, then verify that
dockeranddocker composerun for the account that will manage the stack. - Persistent storage: Plan separate locations for document media, application data and the database. Do not rely on a container’s writable layer; it is disposable when a container is recreated.
- A backup destination outside the Docker host: A second disk, another computer, a NAS or an off-site location can be used, but one copy on the same host is not a recovery plan.
- Scanning or file-ingestion equipment: A duplex document scanner is useful for paper records, but it is optional if your documents already exist as PDFs or image files.
- Network access: Start with local or trusted-network access. Public access requires a separately designed authentication, TLS, firewall and threat model; the default Compose setup should not be treated as an Internet-facing security solution.
The reviewed project materials do not publish a universal minimum CPU, memory or disk requirement. Size the system from the number and size of originals, OCR intensity, conversion needs and the number of backup copies you intend to retain.
Choose an installation route
Paperless-ngx provides two supported ways to create the Compose deployment. Both ultimately run the same type of multi-container application; the difference is how much setup is automated for you.
| Route | What it does | Best fit | Trade-off |
|---|---|---|---|
| Interactive Compose installer | Asks configuration questions, creates the required Compose and environment files, pulls the image, starts containers and creates the initial superuser. | First-time users who want the project to generate a working baseline. | Less direct control over every generated value until you review the files. |
| Manual Compose templates | You download the template for the selected database backend and its environment files, review paths and settings, then pull and start the stack yourself. | Operators who need deliberate path, backend or service choices. | More decisions and more responsibility for checking variables, mounts and permissions. |
Current setup guidance recommends PostgreSQL for new installations. Alternate database templates exist, so do not silently substitute a different backend when following a manual guide; choose the template that matches the database you intend to operate and document that choice for future recovery.
How do I install Paperless-ngx with Docker Compose?
1. Prepare the host and storage directories
- Log in to the host with an account allowed to run Docker. Create a dedicated project directory for the Compose files and keep it under your normal configuration-backup process.
- Decide where the three durable data classes will live: media for original and processed documents, application data for auxiliary files and search-related state, and the database volume for PostgreSQL (or the database selected by your template).
- Use local, reliable filesystems for the initial deployment. If you later move a mount to network storage, confirm ownership, permissions, locking behavior and filesystem notification support before changing production paths.
- Record the host paths, the Compose project directory, the database choice and the image version in an operations note. Those details are needed when rebuilding the host.
Paperless-ngx administration guidance identifies the Docker volumes commonly used for these roles, including paperless_media for documents and paperless_data for auxiliary data and SQLite-based deployments, plus a database volume for PostgreSQL or MariaDB. Your current template may use bind mounts or differently named volumes, so inspect the actual file rather than assuming a name.
2. Use the interactive installer, or download the manual templates
For the guided route, run the interactive installer supplied by the Paperless-ngx project on the host. Answer its prompts for the database, hostname, timezone, OCR language and other requested settings. It creates the Compose and environment files, pulls the image, starts the services and creates the initial superuser.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- FAST SPEEDS - Scans color and black and white documents a blazing speed up to 16ppm (1). Color scanning won’t slow you down as the color scan speed is the same as the black and white scan speed.
- ULTRA COMPACT – At less than 1 foot in length and only about 1. 5lbs in weight you can fit this device virtually anywhere (a bag, a purse, even a pocket).
- READY WHENEVER YOU ARE – The DS-640 mobile scanner is powered via an included micro USB 3. 0 cable allowing you to use it even where there is no outlet available. Plug it into you PC or laptop and you are ready to scan.
- WORKS YOUR WAY – Use the Brother free iPrint&Scan desktop app for scanning to multiple “Scan-to” destinations like PC, Network, cloud services, Email and OCR. (2) Supports Windows, Mac and Linux and TWAIN/WIA for PC/ICA for Mac/SANE drivers. (3)
- OPTIMIZE IMAGES AND TEXT – Automatic color detection/adjustment, image rotation (PC only), bleed through prevention/background removal, text enhancement, color drop to enhance scans. Software suite includes document management and OCR software. (4)
For manual control, download the current Compose template for your chosen database and the accompanying environment files from the project’s setup documentation. Optional templates that include Tika add support for Office and other document types. Release-specific filenames and defaults can change, so use the template associated with the version you are deploying rather than copying an old filename from a forum post.
Before starting either route, open the generated or downloaded files. Confirm every host path, exposed port, database setting, timezone, OCR language and secret reference. Treat the Compose file as executable configuration: Docker warns that it can request privileged operations, host bind mounts, host networking, device access and arbitrary images.
3. Resolve and validate the Compose configuration
From the directory containing the Compose file, ask Docker to render the fully resolved configuration:
docker compose configReview the output for interpolated environment values, bind mounts, published ports, service dependencies, restart policies and secret declarations. This catches missing variables and accidental path substitutions before containers are created. Only proceed when the file came from a source you trust and the resolved permissions and mounts match your plan.
4. Pull images and start the stack
After editing the required settings, pull the images and start the services in detached mode:
docker compose pull
docker compose up -dCompose creates the network and persistent volumes, starts the application and supporting services, and runs the database initialization required by the selected template. Watch startup output if the web service does not become available:
Rank #3
- FAST DOCUMENT SCANNING — Document scanner with feeder allows you to speed through stacks with a 50-sheet Auto Document Feeder (ADF); Efficient office scanner to help you scan more productively
- INTUITIVE, HIGH-SPEED SOFTWARE — Quickly scan with this desktop document scanner; Epson ScanSmart Software lets you easily preview scans, email files, upload to the cloud, and more; Plus, automatic file naming saves even more time
- SEAMLESS INTEGRATION — Easily incorporate your data into most document management software with the included TWAIN driver; Office document scanner integrates seamlessly with business workflows
- EASY SHARING — Duplex scanner allows you to scan straight to email or popular cloud storage2 services like Dropbox, Evernote, Google Drive, and OneDrive for simple storage and sharing
- SIMPLE FILE MANAGEMENT — Scanner allows the creation of searchable PDFs with Optical Character Recognition (OCR) and convert scans to editable Word or Excel files effortlessly; Designed for home and office document scanning
docker compose ps
docker compose logs --followStop following logs with Ctrl+C; detached containers continue running. The default example is normally reachable from the local host on port 8000 unless you changed the published port. Open that address in a browser, sign in with the superuser created by the installer, and immediately verify that the account has a strong, unique password.
Configure OCR, timezone and document ingestion
Set the language and timezone for this installation
Choose the OCR language that matches the documents you will scan and set the timezone used by the host and application. These values influence text recognition and timestamps. They do not add new file formats; format conversion is a separate concern handled by optional services such as Tika.
Free tools Windows power users keep installed
One-click scans. No signup required.
Understand the consume directory
Paperless-ngx watches a consume directory for new files. On a normal local filesystem, filesystem notifications can signal the application immediately. If that directory is on NFS or another filesystem without inotify support, the default notification method may not see new files. Configure PAPERLESS_CONSUMER_POLLING_INTERVAL to use polling in that situation, and choose an interval that balances prompt ingestion against unnecessary filesystem checks.
Ingest safely
- Copy a small test batch first and confirm that originals appear, OCR text is searchable and metadata is assigned as expected.
- Keep an untouched copy of important originals until you have verified the import and your backup process.
- Use consistent filenames and metadata conventions even though search reduces dependence on filenames.
- When a file fails, inspect the service logs and the document’s format before changing broad permissions or disabling validation.
Security: keep a private archive private
The Paperless-ngx repository states: “Paperless-ngx should never be run on an untrusted host because information is stored in clear text without encryption.” That warning applies directly to tax records, identity documents, invoices, contracts and other sensitive material. A trusted host means one whose operating system, Docker installation, administrator accounts and physical access are under your control.
Begin with local or trusted-network access. If you later need remote access, design and verify authentication, TLS certificates, firewall rules, exposure limits and account recovery separately. The project materials reviewed here do not establish compliance with a particular regulated-data framework, and a default Compose deployment should not be described as compliant or secure for one.
Review Compose trust boundaries
Docker treats a Compose file as trusted input. A malicious or careless file can mount host directories, request devices or privileged access, use host networking, publish ports or pull an arbitrary image. Check the project source, inspect the complete file and run docker compose config before up. Avoid copying a Compose file from an unknown source simply because it uses familiar service names.
Rank #4
- Scanner type: Document
- Connectivity technology: USB
- With Auto Scan Mode, the scanner automatically detects what you're scanning
- Digitize documents and images
Limit secret exposure
Compose can provide a named secret to only the services that need it, as a file under /run/secrets/. Use that scoped mechanism when the image supports the required credential, rather than placing every password in environment variables visible to all processes. Compose secrets do not encrypt the underlying host file and do not guarantee protection at rest; secure the host filesystem and backup copies as well.
How do I back up Paperless-ngx?
Plan recovery around three separate components: the document files, application data and database contents. A backup of only one component can leave you with incomplete records or an unusable index.
Back up the persistent volumes and database
- Identify the actual media, application-data and database volumes or bind mounts from
docker compose configanddocker volume ls. - Schedule copies of the media volume, including originals and processed files, to storage that survives loss of the Docker host.
- Back up the application-data volume and the PostgreSQL database according to the database’s supported dump or volume procedure. Paperless-ngx specifically notes that the database must be backed up for PostgreSQL and MariaDB deployments.
- Protect the Compose file, environment files, secret material, host-path map and image version with the backup set. Without those, a volume copy may be difficult to restore correctly.
- Encrypt backup media and restrict access to the people who administer the archive. The application stores information in clear text, so a stolen backup can expose the same records.
Use the document exporter as an additional recovery path
Paperless-ngx documents export and import tools for moving documents and their associated information. An application-level export is useful for migration or selective recovery, but it is not a substitute for a complete infrastructure backup of volumes, database, configuration and secrets. Keep both approaches when the records justify the extra resilience.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Test a real restore
Periodically build a temporary Compose project or spare host, restore the database and volumes, apply the saved configuration and verify that documents open, OCR text is searchable and users can sign in. Record the restore date, software image, commands used and any permission fixes. A backup that has never been restored is an assumption, not evidence of recoverability.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Can I run Paperless-ngx on a NAS?
Yes, if the NAS provides a supported Docker environment, sufficient persistent storage and an administration model you can secure. The application does not become a managed service merely because it runs on NAS hardware; you still own updates, permissions, backups, database maintenance and recovery.
Check NAS-specific storage behavior
- Use separate durable locations for media, application data and the database, and verify that the NAS snapshots or replication include all of them.
- Confirm that the consume share supports the filesystem notifications Paperless-ngx expects. NFS and other notification-limited mounts may require
PAPERLESS_CONSUMER_POLLING_INTERVAL. - Check UID/GID ownership, ACLs, file locking and performance before importing a large archive.
- Keep at least one backup copy independent of the NAS. A NAS failure, ransomware event or administrator mistake can affect both the live archive and local snapshots.
When a NAS is a poor fit
A NAS is not a good host if its Docker implementation is unsupported or tightly sandboxed, if database storage is unreliable, or if you cannot patch the operating system and restore data independently. In those cases, run the containers on a maintained server and use the NAS as a carefully tested storage or backup target instead.
Best Value
- OUR MOST ADVANCED SCANSNAP. Large touchscreen, fast 45ppm double-sided scanning, 100-sheet document feeder, Wi-Fi and USB connectivity, automatic optimizations, and support for cloud services. Upgraded replacement for the discontinued iX1600
- CUSTOMIZABLE. SHARABLE. Select personalized profiles from the touchscreen. Send to PC, Mac, mobile devices, and clouds. QUICK MENU lets you quickly scan-drag-drop to your favorite computer apps
- STABLE WIRELESS OR USB CONNECTION. Built-in Wi-Fi 6 for the fastest and most secure scanning. Connect to smart devices or cloud services without a computer. USB-C connection also available
- PHOTO AND DOCUMENT ORGANIZATION MADE EFFORTLESS. Easily manage, edit, and use scanned data from documents, receipts, photos, and business cards. Automatically optimize, name, and sort files
- AVOIDS PAPER JAMS AND DAMAGE. Features a brake roller system to feed paper smoothly, a multi-feed sensor that detects pages stuck together, and skew detection to prevent paper damage and data loss
Maintain and upgrade the deployment
Before an upgrade
- Read the release notes and confirm that the Compose template, image tag and database combination remain supported.
- Complete and verify a current backup of media, application data, database and configuration.
- Record the currently running image and resolved Compose configuration so you can compare behavior or roll back deliberately.
Apply an image update
Pull the newer images and start the Compose application again:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchdocker compose pull
docker compose up -dPaperless-ngx can run database migrations during startup. Watch the logs, confirm all services are healthy, sign in, open representative documents and test a new ingestion before declaring the upgrade complete.
Use restart policies appropriately
A production-oriented Compose override may set a restart policy so a service is brought back after an unexpected termination. That policy improves availability but is not a backup, monitoring system or proof that the application is healthy. Pair it with log review, disk-capacity alerts and a tested recovery procedure.
Deployment choices at a glance
| Decision | Guided choice | Manual choice | Operational implication |
|---|---|---|---|
| Initial setup | Interactive installer creates files and starts services. | Download, edit and validate templates yourself. | Manual control requires you to preserve the exact configuration for recovery. |
| Database | Use the current recommended PostgreSQL template for a new installation. | Select an alternate supported backend template when there is a specific reason. | Database choice affects volume layout, backup commands and any later migration. |
| Document formats | Use the base stack for its standard supported formats. | Add a Tika-enabled template for Office and other document types. | Additional services add configuration and another component to update and back up. |
| Consume filesystem | Use local notifications where inotify works. | Enable polling on filesystems without inotify support. | Polling can improve detection on network storage but adds periodic checks. |
| Access model | Keep the service on a local or trusted network. | Design a separately verified remote-access architecture. | Remote exposure adds authentication, TLS, firewall and threat-model obligations. |
Troubleshooting checkpoints
The web interface does not load
- Run
docker compose psand confirm the web and dependency services are running. - Check the published port in the resolved configuration; the default example uses port 8000 only when unchanged.
- Review
docker compose logs --followfor database connection, permission or migration errors.
New files are not detected
- Verify that the file was copied into the configured consume directory and that the container account can read it.
- If the directory is on NFS or another filesystem without inotify, configure
PAPERLESS_CONSUMER_POLLING_INTERVAL. - Check logs for an unsupported format, conversion failure or malformed document.
Documents disappear after recreation
Inspect mounts and volumes. Files stored only in the container layer vanish when that container is replaced. Confirm that media and application data are mapped to the intended persistent locations and that the database volume is included in backups.
An upgrade behaves differently
Compare the saved image tag and resolved Compose output with the new deployment, review migration logs and restore the tested backup to an isolated host if you need to distinguish data corruption from a configuration change.
Practical operating checklist
- Use a host and Docker installation you control and can patch.
- Review the complete Compose configuration before first start and before adding third-party overrides.
- Choose PostgreSQL for a new installation unless a documented operational reason requires another supported backend.
- Set OCR language and timezone deliberately.
- Keep media, application data and database persistence distinct and documented.
- Use polling when the consume filesystem lacks inotify support.
- Keep initial access local or on a trusted network; design remote access separately.
- Store Compose files, environment values, secrets and image versions with the recovery documentation.
- Back up the volumes and database to a location that survives host loss.
- Perform and document a real restore before trusting the archive with irreplaceable records.
- Back up before upgrades, review migrations and verify representative documents afterward.
Bottom line
Paperless-ngx with Docker Compose is a strong home-lab pattern when you want control over where personal documents live and are willing to operate the service. Use the project’s installer for the quickest supported setup or its manual templates for finer control, choose persistent storage deliberately, keep the host trusted, and treat database-plus-volume backups and restore tests as part of the installation—not as optional housekeeping.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
