English | 简体中文

documentserver

Based on ONLYOFFICE Community Edition 9.4.0.1, this image recompiles docservice from source to remove the connection/user limits, and adds: mobile editing, configurable memory, common CJK fonts, increased upload limit, no bundled plugins by default, and a Chinese UI.

Base image: onlyoffice/documentserver:9.4.0.1 (latest official stable, 2026-07-22).

Published image: ghcr.io/jiangchuanso/documentserver (auto-built & pushed by GitHub Actions).

Features implemented (from official source, self-buildable)

Feature	Status	Notes
Unlimited connections	✅	Recompiled docservice, set LICENSE_CONNECTIONS/LICENSE_USERS to a very large value (effectively unlimited)
Full mobile editing	✅	Patched isSupportEditFeature=()=>!0 (covers every app's mobile app.js)
Common CJK fonts	✅	Sans / Serif / Kai styles covered: Noto CJK, WenQuanYi Zen Hei, WenQuanYi Micro Hei, AR PL UMing (Serif), AR PL UKai (Kai)
China timezone	✅	TZ=Asia/Shanghai, fixes document timestamps, logs and scheduled times
Pre-generated font cache	✅	Generates AllFonts.js at build time, avoiding a multi-minute stall on first editor load
Larger nginx upload limit	✅	Default 2048m, adjustable via UPLOAD_MAX_SIZE
Large-file timeouts	✅	Default NGINX_TIMEOUT=3600s, prevents large uploads/conversions being cut off at 60s
Offline / intranet ready	✅	External CDN resources redirected to local paths, no waiting on outbound requests
No plugins by default	✅	Bundled default plugins removed for a clean install
Chinese welcome / UI	✅	UI language zh-CN, plus a Chinese welcome page
Configurable max memory	✅	MAX_OLD_SPACE_SIZE(MB) injected via NODE_OPTIONS (supported by yao-pkg)

Build

docker build -t documentserver:9.4.0.1 .

本地产物出现 unknown/unknown？ 这通常是用 docker buildx build --platform linux/amd64,linux/arm64 --load 把多架构镜像强行加载到本地导致的：本地 Docker 无法以单条 repo:tag 形式承载多架构 manifest list，于是显示为 unknown/unknown。直接用上面的普通 docker build（单平台）即可得到带标签的 documentserver:9.4.0.1；多架构镜像只能 --push 到 registry（见下方 Auto-publish），不能 --load 到本地。

The build is heavy: it clones the ONLYOFFICE/server source from GitHub, runs npm install, and compiles docservice with @yao-pkg/pkg. Use an environment with ≥ 4GB RAM and access to GitHub and npm.

Auto-publish to GitHub Container Registry

The repo is configured with GitHub Actions (.github/workflows/build.yml), which automatically builds and pushes the image to ghcr.io/<owner>/documentserver on:

Images are built for linux/amd64 + linux/arm64 as a single multi-arch manifest, so docker pull automatically picks the variant matching the host.

• push to main / master → branch-name tag;
• push of a v*.*.* tag (e.g. v9.4.0.1) → semver tags 9.4.0.1 and 9.4;
• push to the default branch → also tags latest;
• every build also gets a short commit-SHA tag;
• opening a PR → build only, no push.

The arm64 build runs under QEMU emulation and is noticeably slower than native amd64. Both platforms are built in parallel, so wall time is bounded by the slower arm64 leg. If CI gets too slow, split the job per architecture and build arm64 on GitHub's native ARM runner (ubuntu-24.04-arm).

It authenticates with the built-in GITHUB_TOKEN (no extra secrets needed). The image inherits the repo's visibility by default (public repo → public package); change it on the repo's Packages page if needed.

Pull the published image

docker pull ghcr.io/jiangchuanso/documentserver:latest
# or a specific version
docker pull ghcr.io/jiangchuanso/documentserver:9.4.0.1

Then in docker-compose.yml, replace build: . with the image reference, e.g.:

services:
  onlyoffice:
    image: ghcr.io/jiangchuanso/documentserver:9.4.0.1
    # build: .   # comment out when not building locally
    container_name: onlyoffice
    # ...rest unchanged

Run

With docker-compose (recommended)

docker compose up -d

Open: http://localhost:8080 (welcome page / editor / examples)

Run standalone

docker run -d --name onlyoffice --restart=always \
  -p 8080:80 -p 8443:443 -p 8000:8000 \
  -e MAX_OLD_SPACE_SIZE=6144 \
  -e UPLOAD_MAX_SIZE=2048m \
  -e DS_LANG=zh-CN \
  -e JWT_ENABLED=false \
  -e ALLOW_PRIVATE_IP_ADDRESS=true \
  -v $(pwd)/data:/var/www/onlyoffice/Data \
  -v $(pwd)/logs:/var/log/onlyoffice \
  -v $(pwd)/app_data:/var/lib/onlyoffice \
  documentserver:9.4.0.1

Environment variables

Variable	Default	Description
MAX_OLD_SPACE_SIZE	6144	Node max heap (MB), injected via NODE_OPTIONS
UPLOAD_MAX_SIZE	2048m	nginx per-file upload limit, e.g. 512m / 5g
NGINX_TIMEOUT	3600s	nginx timeouts (connect/read/send/send_timeout/client_body); raise for large files
TZ	Asia/Shanghai	Container timezone
DS_LANG	zh-CN	Default UI language
JWT_ENABLED	false	Enable JWT authentication
JWT_SECRET	—	JWT secret (required when enabled)
ALLOW_PRIVATE_IP_ADDRESS	true	Allow deployment on private IP addresses

Offline / intranet mode

The official image references some external endpoints (Google Fonts, cloud-storage SDKs, the plugin market, etc.). On a pure intranet, the browser waits for those requests to time out, which noticeably slows the editor's first load.

This image runs offline.sh at build time, which:

• scans and prints every external URL found in the image (visible in the build log, for auditing);

• rewrites the following hosts to a local path /offline-disabled/<host>, so nginx answers immediately and the request fails fast instead of hanging:

  fonts.googleapis.com, fonts.gstatic.com, apis.google.com, www.dropbox.com, js.live.net, api.onlyoffice.com

Only the hostname is replaced — no logic is removed — so the JS stays syntactically intact. To add or remove hosts, edit the HOSTS variable in offline.sh.

The host list is based on known Community Edition external dependencies. Check the scan report in the build log; if other external references show up, add them to HOSTS and rebuild.

Data persistence

Mount the following directories so data survives container recreation:

• /var/www/onlyoffice/Data: document storage
• /var/log/onlyoffice: logs
• /var/lib/onlyoffice: app data (installed plugins, config)

Notes

• This image is based on the official ONLYOFFICE Community Edition and complies with its open-source license; only source recompilation and config customization within the community-allowed scope are performed.
• Once JWT is enabled, all integrators (e.g. Nextcloud / your own systems) must use the same JWT_SECRET.