# Verified compose for ownCloud Infinite Scale, tested 2026-10-16 by the SelfHostBench lab (3 runs; the figures are the median).
# Lab host: AMD EPYC 9V45 96-Core Processor, 2 vCPU, 7.8 GiB RAM, x86_64, Docker 28.0.4.
# Floating image tags below were replaced by the version resolved at test time;
# the registry digest is in the comment on each image line.
# Measurements: owncloud.json (schema 3).
# Companion env file: owncloud.env (save it as .env next to this file).
# Secrets are not published: the lab's values are public. In owncloud.env:
#   OCIS_ADMIN_PASSWORD is commented out. Uncomment it and set your own value (the comment above it explains how).

# ownCloud Infinite Scale (oCIS) 8.2: the single-container ownCloud that ownCloud calls its flagship product.
# Follows the Docker examples of ownCloud's own documentation: "Minimalistic Evaluation Guide for oCIS with Docker" (https://owncloud.dev/ocis/guides/ocis-mini-eval/)
# and the `ocis` service of the ocis_full example (https://github.com/owncloud/ocis/tree/stable-8.2/deployments/examples/ocis_full), without that example's
# Traefik, Collabora, ONLYOFFICE, Tika, ClamAV, Keycloak and mail containers. Differences from both, all marked below.
# Infinite Scale has no separate database and no cache container: users, metadata and search index live inside this one container's volumes.
# TLS: oCIS answers on HTTPS with a certificate it generates itself (self-signed). That is fine on a private network and for a browser
# on the same machine; for the internet put a reverse proxy in front (see the article).
name: owncloud

services:
  ocis:
    image: owncloud/ocis:8.2.1  # sha256:5e007d702b78d70e5aeade14ec9da46044664996df6c9482630dedadcc74bffc  (version 8.2.1, from label:org.opencontainers.image.version)
    restart: unless-stopped
    # `ocis init` writes /etc/ocis/ocis.yaml with random secrets on the first start. It fails on later starts because the file exists,
    # so the error is ignored and the server starts (the same line as the ocis_full example).
    entrypoint: ["/bin/sh"]
    command: ["-c", "ocis init || true; exec ocis server"]
    ports:
      # Localhost only. A reverse proxy on the host sends traffic here.
      - "127.0.0.1:9200:9200"
    environment:
      # The address you type in the browser. It is also the OpenID Connect issuer, so it must be the address users really use
      # (with a reverse proxy: https://your.domain). The default works for a browser on the same machine.
      OCIS_URL: "${OCIS_URL:-https://localhost:9200}"
      # Listen on all interfaces, not only inside the container (the evaluation guide sets this too).
      PROXY_HTTP_ADDR: 0.0.0.0:9200
      # oCIS generates a self-signed certificate; the services call each other (and the identity provider) over it, so do not verify it.
      # The ocis_full example sets this to false only when a proxy with a real certificate is in front.
      OCIS_INSECURE: "true"
      # Password of the first account, "admin". Used when oCIS creates its user database on the first start; later changes here do not
      # change an existing password. The official example defaults to the public password "admin"; here it must be set.
      IDM_ADMIN_PASSWORD: "${OCIS_ADMIN_PASSWORD:?set OCIS_ADMIN_PASSWORD in .env}"
      # Not in the evaluation guide. Lets WebDAV clients and scripts that cannot do OpenID Connect log in with user name and password
      # (the ocis_full example has the same switch, off by default and described as "not recommended"). The web interface and the
      # official apps use OpenID Connect and do not need it. Remove it if you only use those.
      PROXY_ENABLE_BASIC_AUTH: "true"
      OCIS_LOG_LEVEL: "${OCIS_LOG_LEVEL:-info}"
    volumes:
      # Configuration with the generated secrets (ocis.yaml). Back it up: without it the data cannot be used.
      - ocis-config:/etc/ocis
      # Every user's files and the metadata. This is your data: back it up.
      - ocis-data:/var/lib/ocis
    healthcheck:
      # The official examples have no healthcheck. status.php answers when the proxy and the frontend are up; the image has curl.
      # -k because the certificate is self-signed.
      test: ["CMD-SHELL", "curl -fsSk https://localhost:9200/status.php | grep -q '\"installed\": true'"]
      interval: 10s
      timeout: 10s
      retries: 30
      start_period: 20s

volumes:
  ocis-config:
  ocis-data: