---
title: "Deploy Penpot"
description: "Open-source Figma alternative for design and prototyping"
category: "Other"
url: https://railway.com/deploy/deploy-penpot-design-tool-on-railway
---

# Deploy Penpot

Open-source Figma alternative for design and prototyping

**[Deploy Penpot on Railway](https://railway.com/template/deploy-penpot-design-tool-on-railway)**

Machine-readable deploy manifest (JSON, validated by TemplateCI): https://railway.com/deploy/deploy-penpot-design-tool-on-railway/manifest.json

- **Creator:** onepush
- **Category:** Other

## Template content

### Valkey

- **Image:** valkey/valkey:8.1.10@sha256:640c5e62cea04b6d6f2084232651d0cc70362d31f4f805e7be94dbed6855e8f2

### penpot-exporter

- **Image:** penpotapp/exporter:2.18.3@sha256:418232d6ca3120b1c2bfde298a56a05a1f41f567cd8494deac3fe7fbc186cfbd
- **Health check:** /readyz

### penpot-backend

- **Image:** penpotapp/backend:2.18.3@sha256:2df1b3440d2a82cc3571db211b4ffdfa2b89ccc910759e8d5e9387fb62971b5c
- **Start command:** `/bin/bash -c 'python3 -m http.server 6070 --bind :: --directory /opt/data/assets >/dev/null 2>&1 & exec /bin/bash run.sh'`
- **Health check:** /readyz

### Postgres https://devicons.railway.app/i/postgresql.svg

- **Image:** ghcr.io/railwayapp-templates/postgres-ssl:18.6@sha256:fcc6686a3f4f1962fe4ed77a15884553b7bd611ae1cea3204687968c5c09d517

### penpot-frontend

- **Image:** penpotapp/frontend:2.18.3@sha256:bb8abe27d53de84c95597f2c02c0e702b2779971fb0703e543f9ecf183e999f6
- **Start command:** `/bin/bash -c 'printf "upstream penpot-backend { zone penpot_backend 64k; server %s:6060 resolve; }\nupstream penpot-exporter { zone penpot_exporter 64k; server %s:6061 resolve; }\nupstream penpot-assets { zone penpot_assets 64k; server %s:6070 resolve; }\n" "$PENPOT_BACKEND_HOST" "$PENPOT_EXPORTER_HOST" "$PENPOT_BACKEND_HOST" > /etc/nginx/overrides/http.d/railway-upstreams.conf && printf "location ~ ^/internal/assets/(.*)\$ { internal; proxy_pass http://penpot-assets/\$1; proxy_hide_header Content-Type; include /etc/nginx/nginx-security-headers.conf; }\n" > /etc/nginx/overrides/server.d/railway-assets.conf && exec /bin/bash /entrypoint.sh nginx -g "daemon off;"'`
- **Health check:** /
- **Public domain:** Yes

## Documentation

# Deploy and Host self hosted Penpot (Open-Source Figma Alternative) on Railway

Five services (frontend, backend, exporter, Postgres, Valkey), every image pinned by tag and digest, filesystem assets on one volume, no deploy-time input. Open the URL, create an account, design. It suits small teams leaving Figma seats behind.

## About Hosting Penpot open-source software on Railway (self hosted Penpot template)

This template runs Penpot 2.18.3 as five services: frontend, backend, exporter, Postgres and Valkey. Design files land in a Postgres database you own, and uploads, fonts and thumbnails stay on one backend volume.

Railway handles TLS, the public domain, private networking and secret generation, so you open the URL and create an account. No seats, no per-editor billing, and no design files in someone else's cloud. Backups are a database dump plus a copy of that volume.

## Why Deploy Penpot, the Figma alternative on Railway (Railway Free Trial)

Figma bills per editor seat and keeps your files in its cloud. Penpot is MPL-2.0, free to self host, and this template keeps every design file on your own Postgres and volume, with no seat count to track. The Railway $5 trial is enough to see it load.

Railway is a singular platform to deploy your infrastructure stack. Railway will host your infrastructure so you don't have to deal with configuration, while allowing you to vertically and horizontally scale it.

By deploying Penpot on Railway, you are one step closer to supporting a complete full-stack application with minimal burden. Host your servers, databases, AI agents, and more on Railway.

### Railway vs Other Hosting Providers and VPS for Penpot self hosting

Railway runs the same five Penpot services without a compose file, a patched OS or a database you have to wire up by hand.

| Provider | What You Get with Railway | What You Get with the Other Provider |
| --- | --- | --- |
| DigitalOcean | Postgres, Valkey and TLS wired for you | A droplet plus a managed database to patch and back up |
| AWS | Private networking and volumes, no ALB or S3 bucket | ECS, RDS, ElastiCache and an IAM policy before first boot |
| Hetzner | Pinned image tags and push to deploy, no server admin | A CX22 running compose, but you own TLS and updates |

You still get plain upstream images, just with less wiring between them.

## Common Use Cases for hosted Penpot

- **Moving a team off Figma seats:** designers keep components, variants and design tokens, and developers read CSS, SVG and HTML from inspect mode instead of asking for redlines.
- **Design systems in the open:** tokens, shared libraries and plugin output live in your Postgres, so a rebrand ships with a redeploy, not a vendor migration.
- **Client work under NDA:** private-by-default networking keeps files off public SaaS, and exports render in the exporter and download from your own domain.
- **Real-time critique sessions:** multiplayer editing and comments run over Valkey pub/sub, so a squad can review one prototype at once.
- **Specs that stay current:** grid and flex layout plus interactive prototypes replace static screenshots, and inspect mode hands over real CSS.

## Dependencies for Penpot Docker hosted on Railway

Five services, every image pinned by tag and digest, and no deploy-time input from you.

### Deployment Dependencies for Managed Penpot Service (Design and Prototyping Platform)

penpotapp/frontend:2.18.3 is the only public service, on port 8080. penpotapp/backend:2.18.3 runs migrations and workers, opens private ports 6060 and 6070, and mounts /opt/data/assets on a volume. penpotapp/exporter:2.18.3 renders PNG, JPEG, SVG and PDF on private port 6061. Postgres 18.6 holds every file; Valkey 8.1.10 needs a password and has no volume.

### Implementation Details for Penpot (Using the official Penpot 2.18.3 images)

PENPOT_OBJECTS_STORAGE_BACKEND=fs with PENPOT_OBJECTS_STORAGE_FS_DIRECTORY=/opt/data/assets keeps uploads, fonts and thumbnails on that volume, so no MinIO or S3 bucket. PENPOT_SECRET_KEY is generated per deploy, PENPOT_FLAGS carries enable-registration and disable-email-verification, and PENPOT_PUBLIC_URI points at the Railway domain.

## How does Penpot compare against other design tools

### Penpot vs Figma (Figma Alternative)

- **Pricing:** Figma bills per editor seat monthly; self hosted Penpot on Railway costs the same however many people you invite.
- **Ownership:** Figma holds your files in its cloud; here files sit in your own Postgres and asset volumes.
- **Where Figma wins:** bigger plugin ecosystem, tighter Dev Mode handoff and more polished prototyping.

### Penpot vs Sketch (Sketch Alternative)

- **Platform:** Sketch is macOS-only; Penpot runs in any browser, so Windows and Linux teammates open the same file.
- **Collaboration:** Penpot does real-time multiplayer editing and comments in the browser.
- **Where Sketch wins:** native Mac performance, a deep plugin market and fully offline work.

### Penpot vs Adobe XD (Adobe XD Alternative)

- **Momentum:** Adobe moved XD into maintenance mode; Penpot 2.18.3 keeps shipping under MPL-2.0.
- **Standards:** Penpot is built on SVG, CSS and HTML, so inspect mode gives developers real CSS and SVG.
- **Where XD wins:** existing Creative Cloud licenses and Adobe ecosystem hooks.

### Penpot vs Framer (Framer Alternative)

- **Scope:** Framer is a design-to-website builder that hosts the site; Penpot is a design and prototyping tool you self host.
- **Handoff:** Penpot exports PNG, JPEG, SVG and PDF, while Framer publishes live responsive sites.
- **Where Framer wins:** mockup to published marketing page with no separate engineering step.

## How to use Penpot (the OSS design tool)?

1. Wait for penpot-backend to report healthy on first boot, since that run applies the database migrations.
2. Open https://your-domain and click Create an account with a name, email and password. No email verification, so you land in the dashboard right away.
3. Make a team, then a project, then a file. Start blank or from a template, and drag a frame onto the canvas to begin drawing.
4. Invite the rest of the team while registration is open, then add disable-registration to PENPOT_FLAGS on penpot-backend and redeploy the three Penpot services.
5. Export PNG, JPEG, SVG or PDF from the file menu; the exporter service renders each one on demand.

## How to self host Penpot on other VPS Services (Penpot self hosting guide)

Upstream's guide runs the same five containers, wired by hand on a box you patch yourself.

### Clone the Repository

Grab the compose file from the penpot repo, docker/images folder.

```
git clone https://github.com/penpot/penpot.git
cd penpot/docker/images
```

### Install Dependencies

Install Docker Engine and the Compose plugin.

```
docker compose version
```

### Configure Environment Variables

Point PENPOT_PUBLIC_URI at your HTTPS domain and replace the shipped PENPOT_SECRET_KEY.

```
PENPOT_PUBLIC_URI=https://your-domain
PENPOT_SECRET_KEY=your-generated-64-char-key
```

### Start the Penpot Application

Start it detached, let the backend finish its migrations, put HTTPS in front with a reverse proxy, then open your-domain.

```
docker compose -p penpot -f docker-compose.yaml up -d
```

Railway handles the wiring: pinned images, generated secrets, private networking, Postgres and Valkey, and one assets volume, so you just open the URL and create your account.

## Official Pricing of Penpot (Penpot pricing)

Penpot itself is free. The source is MPL-2.0, so self-hosting costs you nothing in licenses, and the whole bill is infrastructure: Railway usage for the five services, mostly RAM, at roughly $10-25 a month for a light team. Railway's $5 trial is enough to spin the stack up and look around. Penpot's hosted cloud at design.penpot.app has a free plan plus paid Professional and Enterprise tiers. Check their site for current numbers, since we don't quote them here.

## Penpot cloud vs self hosted comparison (Pricing, features, costs, and more)

Self hosting keeps files on infrastructure you control and adds no license fees, while Penpot's hosted cloud trades that for a free plan plus paid Professional and Enterprise tiers. Here is what each one actually costs you.

### Monthly cost of self hosting Penpot on Railway

Railway bills by RAM and usage, not by editor seat, so adding a reviewer costs nothing extra. At light team use the whole stack lands around $10-25/mo, mostly RAM, and Penpot itself stays free under MPL-2.0.

### System Requirements for Hosting Penpot on a VPS

Off Railway you need Docker and about 2 GB of RAM or more, plus a reverse proxy to terminate HTTPS. The five services idle near 1.5 GB, so 2 GB is tight but workable; give the exporter headroom and bigger PDF renders go smoother.

## Frequently Asked Questions (FAQs)

### How do I close registration after my team signs up?

Add disable-registration to PENPOT_FLAGS on penpot-backend and redeploy the three Penpot services. Existing sessions keep working, new accounts stop.

### How do invites work without SMTP?

They don't send. Add enable-log-invitation-tokens and copy the invite link from the backend logs, or configure PENPOT_SMTP_* with the enable-smtp flag.

### Where do designs live, and what do I back up?

Postgres holds every design file; the backend volume at /opt/data/assets holds uploads, fonts, thumbnails and exports. Back up both, not just the database.

### Do PNG, SVG and PDF exports work as shipped?

Yes. The exporter renders PNG, JPEG, SVG and PDF through headless Chromium, so export works out of the box with no bucket or extra service.

### Can I use SSO instead of passwords?

Yes. Add enable-login-with-google, github, gitlab, oidc or ldap plus the matching PENPOT_* variables on the backend.

### How do I upgrade to a new Penpot version?

Change the tag and digest on frontend, backend and exporter together, and back up Postgres first because the backend migrates on boot.


## Similar templates

- [Rocky Linux](https://railway.com/deploy/rocky-linux) — Hosted Rocky Linux 9 workspace with SSH and persistent storage. 🚀
- [Foundry Virtual Tabletop](https://railway.com/deploy/X5tR6G) — A Self-Hosted & Modern Roleplaying Platform
- [Letta Code Remote](https://railway.com/deploy/letta-code-remote) — Run a Letta Code agent 24/7. No inbound ports, just deploy.

Open this page in a browser: https://railway.com/deploy/deploy-penpot-design-tool-on-railway