Analytics cookies only (Google Analytics, PostHog). No ad networks, no cross-site tracking. See our privacy policy.
Self-host draw.io
updated Oct 2026deployed by usprices checked · Jul 2026Install verified on Ubuntu 26.04 · Oct 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →
The diagrams.net (draw.io) editor as a self-hosted container: flowcharts, UML, network and architecture diagrams in the browser. The official image from the project is built on Tomcat and serves HTTP on port 8080 and HTTPS with a self-signed certificate on 8443.
Runs on a VPS from $6/mo (Kamatera 2GB, 2 GB RAM) · prices checked Sep 2026
Our recommendation
Pick draw.io when your team already makes flowcharts, UML, network and architecture diagrams in diagrams.net and you want the editor running on your own server instead of a third-party site. The project publishes the official image, built on Tomcat; it serves HTTP on port 8080 and HTTPS with a self-signed certificate on 8443, and the Docker Hub page documents Let's Encrypt, your own keystore and `DRAWIO_*` variables for cloud integrations. It is Apache-2.0. Our snippet is the page's `docker run` as a Compose file, pinned to a release tag and publishing port 8080 only. We did not find an upstream RAM minimum, so our 512 MB floor is an estimate for a Java container. The catalog's Excalidraw and WBO are whiteboards for sketching and live collaboration; draw.io is for structured diagrams.
What you need
Any VPS with at least 512 MB of RAM
A domain you control — most self-hosted setups need HTTPS in front of them
The draw.io image's Docker Hub page flags these before you rely on it:
non-negotiableThe page documents http://localhost:8080/?offline=1&https=0 and https://localhost:8443/?offline=1 as the way in, and says ?offline=1 disables support for cloud storage, which it describes as a security feature. Without it the editor offers its usual storage choices, so decide which ones you want your users to see.
non-negotiableHTTPS on 8443 uses a self-signed certificate unless you set LETS_ENCRYPT_ENABLED=true and PUBLIC_DNS, or mount your own keystore (the page gives the path); the defaults for KEYSTORE_PASS and the certificate fields are published in the page, so change them. For a normal setup, publish 8080 and let a reverse proxy terminate TLS.
non-negotiableExporting diagrams to PDF and images server-side needs a separate export-server image that the page describes but does not give a Compose file for; we do not run it.
non-negotiableThe page lists only latest, but versioned tags exist and we pin 32.6.1. Since 16.5.3 the Alpine and Debian variants are no longer maintained and there is one Tomcat-based image.