apps/linkwarden/manifest.yaml
Rama main · réplica de lectura del repositorio original.
schema_version: 6
publication_status: published
slug: linkwarden
name: Linkwarden
tagline: Bookmarks and web archives on your own server
summary: >-
Linkwarden saves, organizes, and searches bookmarks, preserves local copies of pages, and shares collections. This recipe includes PostgreSQL 16, Meilisearch 1.13.3, a separate origin for preserved HTML, and a web port safely bound to localhost.
status: active
editorial_status: experimental
links:
website: https://linkwarden.app/
source: https://github.com/linkwarden/linkwarden
documentation: https://docs.linkwarden.app/
issues: https://github.com/linkwarden/linkwarden/issues
classification:
categories:
- Bookmarks and archiving
tags:
- bookmarks
- web-archive
- read-later
- collaboration
- search
implementation_languages:
- TypeScript
alternatives_to:
- Pocket
- Raindrop.io
- Pinboard
license:
spdx: AGPL-3.0-only
kind: open_source
restrictions: []
notes: null
localization:
ui_languages:
- en
- ru
docs_languages:
- en
clients:
web: true
android: true
ios: true
desktop: false
auth:
oidc: native
saml: none
two_factor: none
proxy_header: false
requirements:
architectures:
- amd64
- arm64
min_cpu_cores: 2
min_ram_mb: 2048
recommended_ram_mb: 4096
min_disk_gb: 5
gpu:
required: false
supported: false
database: postgresql
dependencies:
- PostgreSQL 16
- Meilisearch 1.13.3
operations:
install_difficulty: 3
installation_levels:
home: partial
vps: partial
reliable: partial
maintenance_difficulty: 3
backup_supported: true
restore_tested: false
healthcheck: true
reverse_proxy_required: true
update_complexity: manual_steps
recipe:
id: linkwarden-compose
version: 2
compose_file: compose.yaml
env_example: .env.example
installation: installation.md
troubleshooting: troubleshooting.md
supported_docker_compose: ">=2.24.0"
application_version: v2.16.3
images:
- name: ghcr.io/linkwarden/linkwarden
tag_source: pinned
- name: postgres
tag_source: pinned
- name: getmeili/meilisearch
tag_source: pinned
tested_at: "2026-10-09"
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
check_history:
- tested_at: "2026-10-09"
application_version: v2.16.3
recipe_version: 2
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
restore_tested: false
- tested_at: "2026-09-20"
application_version: v2.16.2
recipe_version: 1
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
restore_tested: false
- tested_at: "2026-09-03"
application_version: v2.16.2
recipe_version: 1
tested_architectures:
amd64: passed
arm64: not_tested
smoke_test: full
restore_tested: false
license: MIT
smoke_test_limitations:
- The application smoke test passed on amd64 on 2026-10-09. arm64 were not tested in this run.
- Backup, restore, PostgreSQL migrations, and Meilisearch index restoration have not passed practical testing.
security:
public_exposure: supported
default_bind: localhost
privileged: false
host_network: false
docker_socket: false
known_risks:
- A headless browser fetches untrusted URLs and processes active content; upstream or network-policy flaws can cause SSRF or exhaust CPU, RAM, and disk.
- Preserved HTML can contain active content and must be served from a separate origin that does not share application cookies.
- ALLOW_PRIVATE_NETWORK_ACCESS and ALLOW_INSECURE_TLS are pinned to false; enabling them permits internal-service access or invalid TLS certificates.
- Open registration is required only for the first account and must be disabled immediately after it is created.
- NEXTAUTH_SECRET, the PostgreSQL password, and the Meilisearch key live in .env; encrypt that file and backups and keep them out of Git.
assessment:
status: not_assessed
assessed_at: null
upstream:
release_source: github
repository: linkwarden/linkwarden
last_release_at: "2026-08-31"
last_checked_at: "2026-09-01T00:22:20Z"
stars: 19653
stars_checked_at: "2026-09-01T00:22:20Z"
releases_last_year: 13
releases_checked_at: "2026-09-02T17:47:54Z"
update_tracking:
releases:
status: current
checked_at: "2026-10-09T13:58:07.386Z"
latest_version: v2.16.3
critical_vulnerabilities:
status: findings
checked_at: "2026-10-09T13:58:51Z"
critical_count: 18
scanner: trivy
ids:
- CVE-2023-45853
- CVE-2025-68121
- CVE-2025-7458
- CVE-2026-102422
- CVE-2026-106445
- CVE-2026-106446
- CVE-2026-13221
- CVE-2026-25896
- CVE-2026-42496
- CVE-2026-58016
- CVE-2026-59873
- CVE-2026-6653
- CVE-2026-73420
- CVE-2026-75604
- CVE-2026-8376
breaking_updates:
status: unknown
checked_at: null
compose_changes:
status: not_tracked
checked_at: null
outdated_images:
status: unknown
checked_at: null
images: []
update_policy:
# PostgreSQL and Meilisearch follow their own versions and their tags do not
# track the application version, so only the Linkwarden image is in the policy.
images:
- image: ghcr.io/linkwarden/linkwarden
provider: ghcr
repository: linkwarden/linkwarden
compose: null
content:
description: description.md
logo: assets/logo.svg
screenshots:
- file: assets/dashboard.webp
alt: Dashboard in light theme with counts of links, collections and tags, and the four most recent bookmarks showing the previews Linkwarden saved
- file: assets/collection.webp
alt: One collection in dark theme with three saved pages, each with its preview, the site it came from and the date it was kept
- file: assets/links.webp
alt: Every bookmark in one grid with previews, source sites, collections and the icons of the formats preserved for each
- file: assets/reader.webp
alt: A bookmark's own page in dark theme with its tag, the reader's note, and the four preserved formats — webpage, screenshot, PDF and readable copy
- file: assets/settings.webp
alt: Account settings with the display name, username and interface language, and the import, export and account deletion controls
updated_at: "2026-10-09"