Remark42

Last reviewed Sep 13, 2026 · 761 words

Remark42 is the comment system I would put on a personal blog today: one Go binary, an embedded Bolt database, no tracking, and a Disqus importer that actually works. It needs about 128 MB of RAM and a reverse proxy, and that is the entire operations story. The catch is narrow but real: comments are the only thing it does, the theme is close to fixed, and one mistyped REMARK_URL will make every social login silently fail.

Why it beats the Disqus you are leaving

Disqus injects third-party trackers, shows ads on the free tier, and owns your readers' comment history. Remark42 (5,600 GitHub stars, MIT, first released 2017) stores everything in a Bolt file on your disk, sets no tracking cookies, and lets readers log in with Google, GitHub, Microsoft, Apple, Telegram, email, or an anonymous name if you allow it. The Disqus alternatives page lists the field; Remark42 wins in it because the migration is a single admin API call that takes a Disqus XML export and reproduces threads, authors, and timestamps.

If you want something even smaller, Cusdis is lighter still, but it has no social login and no threading worth the name. Remark42 is the point where "lightweight" and "comments people will actually use" overlap.

The compose file is short, and the URL line is the one that bites

services:
  remark42:
    image: umputun/remark42:latest
    environment:
      - REMARK_URL=https://comments.example.com
      - SECRET=change-this-to-a-long-random-string
      - SITE=myblog
      - AUTH_GITHUB_CID=your-github-oauth-client-id
      - AUTH_GITHUB_CSEC=your-github-oauth-secret
      - AUTH_ANON=true
      - ADMIN_SHARED_ID=github_abc123
    volumes:
      - ./var:/srv/var
    restart: unless-stopped

The container listens on port 8080; put Caddy or Traefik in front with TLS. REMARK_URL must match the public origin exactly, scheme included, because every OAuth callback is built from it. Set it to http:// while testing behind an https:// proxy and GitHub will bounce the callback with a redirect mismatch and Remark42 will log nothing useful. SITE is the site ID your embed script references; you can host comments for several blogs from one instance by listing more IDs.

ADMIN_SHARED_ID is your own user ID, which you only learn after logging in once. So the first-run sequence is: start without the admin line, log in, copy the ID from your avatar menu, add the line, restart. Ten minutes, but nobody warns you.

The embed is four lines and the theming stops there

<script>
  var remark_config = { host: "https://comments.example.com", site_id: "myblog" };
</script>
<script src="https://comments.example.com/web/embed.mjs" defer></script>
<div id="remark42"></div>

Dark and light themes are built in and follow a theme key in the config. Beyond that you get CSS custom properties and not much else. If your site has a strong visual identity you will notice the comment box looks like Remark42 rather than like you. That is the cost of a comment widget that weighs about 60 KB and does not phone home.

Backups: Bolt is a single file, but do not copy it live

Everything lives under /srv/var: the Bolt database per site, avatars, and the automatic nightly backups Remark42 writes to /srv/var/backup as gzipped JSON, kept 10 days by default. Those JSON dumps are the restore path, not the raw .db file, which can be mid-write when you copy it. Ship the backup directory off the box nightly and you are covered. To restore, use the admin import endpoint with the JSON file, the same mechanism the Disqus migration uses.

Where it does not fit

Remark42 is comments on pages. It is not a forum, not a guestbook with rich media, and not a moderation platform; you get delete, pin, block-user, and verified badges, plus email or Telegram notifications for new comments if you configure them. A site that gets 500 comments a day and needs moderator queues is better served by a real discussion system from the communication category. For a blog getting a handful a week, that machinery would be dead weight.

What I'd do

Run Remark42 as the container above on the same box as the blog, AUTH_ANON=true so readers without accounts can still say something, GitHub plus email as the real login options. Point the embed at it, import the Disqus XML on day one, and add /srv/var/backup to whatever already backs up the server. After that it is the rare self-hosted service that needs an update roughly twice a year and nothing else.