authentik-worker

Overview

The Authentik worker container processes background jobs, scheduled tasks, and asynchronous operations for the server. It handles actions such as sending emails, running LDAP/SCIM syncs, processing login events, and managing provisioning.

Requirements

The worker runs alongside the server and connects to the same PostgreSQL (16 and above) and Redis instances. It depends on PostgreSQL and Redis, install them first.

Running as non-root
If you remove --user root from Extra Parameters, you must ensure file/share permissions are handled manually so the worker can read/write any mapped paths.

Docker socket options (choose ONE):
1- Direct socket (easiest, least safe):
Map /var/run/docker.sock and set the socket path in the template. This gives Authentik broad Docker control - use only in trusted environments.
2- Socket-proxy:
Point Authentik’s Outpost Integration to your proxy and enable only the endpoints needed for outpost lifecycle:
IMAGES=1, CONTAINERS=1, POST=1, INFO=1, VERSION=1
Type: Docker Service-Connection, URL: http://socket-proxy:2375, Local: toggled off
3- No socket (recommended):
Don’t expose Docker Socket at all. Manage outposts manually from Authentik (create/update/remove them yourself).

Runtime arguments

Network: bridge
Shell: sh
Privileged: false
Extra Params: --user root

Template configuration

Secret KeyVariable

Cryptographic key for Authentik.

Target: AUTHENTIK_SECRET_KEY

Redis HostVariable

Host/IP of the Redis server.

Target: AUTHENTIK_REDIS__HOST
Default: redis
Value: redis

Redis PasswordVariable

Password of Redis server.

Target: AUTHENTIK_REDIS__PASSWORD

PostgreSQL HostVariable

Host/IP of the PostgreSQL database.

Target: AUTHENTIK_POSTGRESQL__HOST
Default: postgresql16
Value: postgresql

PostgreSQL UserVariable

Username for PostgreSQL access.

Target: AUTHENTIK_POSTGRESQL__USER
Default: postgres
Value: postgres

PostgreSQL Database NameVariable

Name of the PostgreSQL database.

Target: AUTHENTIK_POSTGRESQL__NAME
Default: authentik
Value: authentik

PostgreSQL PasswordVariable

Password for the PostgreSQL user.

Target: AUTHENTIK_POSTGRESQL__PASSWORD

Docker Socket VolumePathrw

Mounts Docker socket for container management.

Target: /var/run/docker.sock

Media VolumePathrw

Stores uploaded media and assets.

Target: /media
Default: /mnt/user/appdata/authentik/media
Value: /mnt/user/appdata/authentik/media

Certificates VolumePathrw

Stores SSL/TLS certificates.

Target: /certs
Default: /mnt/user/appdata/authentik/certs
Value: /mnt/user/appdata/authentik/certs

Custom Templates VolumePathrw

Stores custom Authentik templates.

Target: /templates
Default: /mnt/user/appdata/authentik/templates
Value: /mnt/user/appdata/authentik/templates

Enable Error ReportingVariable

Enable/disable sending error reports (true/false).

Target: AUTHENTIK_ERROR_REPORTING__ENABLED
Default: true
Value: true

Email HostVariable

SMTP server hostname.

Target: AUTHENTIK_EMAIL__HOST
Default: smtp.gmail.com
Value: smtp.gmail.com

Email PortVariable

SMTP server port.

Target: AUTHENTIK_EMAIL__PORT
Default: 587
Value: 587

Email UsernameVariable

SMTP account username.

Target: AUTHENTIK_EMAIL__USERNAME
Default: example@localhost

Email PasswordVariable

For Gmail, visit https://myaccount.google.com/apppasswords

Target: AUTHENTIK_EMAIL__PASSWORD

Email Use TLSVariable

Enable TLS for SMTP (true/false).

Target: AUTHENTIK_EMAIL__USE_TLS
Default: true
Value: true

Email Use SSLVariable

Enable SSL for SMTP (true/false).

Target: AUTHENTIK_EMAIL__USE_SSL
Default: false
Value: false

Email TimeoutVariable

SMTP timeout in seconds.

Target: AUTHENTIK_EMAIL__TIMEOUT
Default: 10
Value: 10

Email From AddressVariable

Default “From” email address.

Target: AUTHENTIK_EMAIL__FROM
Default: authintik@localhost

Links

Template Support Registry Project

Details

Repository

ghcr.io/goauthentik/server:2025.8.1

Registry

https://github.com/goauthentik/authentik

Last Updated2026-05-31

First Seen2025-08-28

Run authentik-worker on Unraid.

authentik-worker is listed in Community Apps for Unraid OS. Explore Unraid to build a flexible home server, NAS, or homelab.

Explore Unraid OS