Docker image
Snipe-IT in Docker. Asset tracking, keys kept.
Snipe-IT is the open source IT asset management system: hardware, licenses, accessories and consumables, who has what, since when, and when the warranty dies.
# Snipe-IT in Docker, base pinned by digest docker pull ghcr.io/remarkablecloud/snipeit:8.7.2-r1 docker compose up -d
- Current build
8.7.2-r1, updated Sep 12, 2026- Base
- Snipe-IT official, digest-pinned
- What's inside
- Persisted APP_KEY, headless superuser, /setup closed, MySQL 8 pairing
- Upstream license
- Snipe-IT: GNU AGPL-3.0.
The image
What our image adds.
What changes from upstream Snipe-IT, and why it matters in production.
APP_KEY generated and persisted
The single most damaging Snipe-IT mistake, losing the key on container recreation, cannot happen; it lives on a volume.
Headless superuser, /setup closed
The admin exists with a generated password before first request, and the setup wizard is disabled, so a fresh install is never claimable.
MySQL 8 pairing
Wired, healthchecked, on the internal network.
Digest-pinned base
Rebuilt and scanned on our schedule.
Proxy-aware APP_URL
Links, emails and QR labels follow your real domain.
The guide
Run it in production.
Compose file, environment reference, hardening, backups and upgrades, written by the people who build the image.
On this page
Architecture at a glance
Two containers: snipeit (Laravel app on 80 internal) and db (MySQL 8). Volumes hold the database and the app’s persistent data including the APP_KEY and uploads.
Docker Compose walkthrough
Set DB_PASSWORD, DB_ROOT_PASSWORD and SITE_URL, bring it up, read the generated superuser credentials from the log, log in, and start with locations and categories before importing assets; Snipe-IT rewards ten minutes of taxonomy before the first CSV import.
Environment variable reference
| Variable | Purpose |
|---|---|
| DB_HOST / DB_PORT / DB_USERNAME / DB_PASSWORD | MySQL connection |
| APP_URL | Public https URL; drives links, emails and label QR codes |
| APP_KEY (persisted on volume) | Encrypts sensitive fields; never rotate casually |
| SMTP settings | Needed for user invites, alerts and expected check-in reminders |
Hardening notes
Treat the APP_KEY volume as the crown jewels: with the database dump but without the key, encrypted custom fields are unrecoverable. Keep /setup closed (the image already does), the DB internal, and 80 behind your proxy.
Backups
Database dump plus the data volume, together, always; they are only useful as a pair because of the key. Snipe-IT also has its own backup tool, which is a fine extra, not a substitute.
Upgrades
Pull the new tag and recreate; migrations run on boot. Snipe-IT upgrades are generally uneventful when you ride promoted tags in order.
Changelog
Each build is pinned by digest and recorded here, so you can see what changed before you pull a new tag.
-
8.7.2-r1Current Sep 12, 2026
Snipe-IT and other product names are trademarks of their respective owners. RemarkableCloud is not affiliated with or endorsed by them.
FAQ
Snipe-IT in Docker, answered.
Short answers from the people who build and run this image.
Why is the APP_KEY such a big deal?
Laravel encrypts sensitive fields with it. New key means old ciphertext is permanently unreadable. Persisting it is the whole game, and this image does it for you.
Can employees check gear in and out themselves?
Yes, Snipe-IT has self-service checkout requests and per-user views; you control it with roles and permissions.
Does it print labels?
It generates label sheets with QR and barcodes out of the box; APP_URL must be right for scans to resolve.
LDAP or SSO?
Supported by Snipe-IT (LDAP built in, SAML available); configure it in the admin settings once the base install is healthy.
Pull it, or let us run it.
The same images our managed apps use, free on GHCR.