Roundcube

Last reviewed Sep 13, 2026 · 779 words

You almost certainly do not need to install Roundcube, because the mail stack you are considering ships it. mailcow offers it alongside SOGo, iRedMail and Mail-in-a-Box have shipped it for a decade, and Mailu lists it as one of two webmail choices. The standalone question only arises when your IMAP server comes with nothing in front of it: Dovecot you built yourself, Stalwart, or a mailbox at a provider whose webmail you dislike. In those cases Roundcube is the boring, correct answer: 18 years old, GPL-3.0, PHP, a plugin for everything, and an interface that, with the Elastic skin, is no longer the 2010 artefact people remember.

Standalone Roundcube is one container and one IMAP host

services:
  roundcube:
    image: roundcube/roundcubemail:latest
    ports:
      - "8000:80"
    environment:
      - ROUNDCUBEMAIL_DEFAULT_HOST=ssl://imap.example.com
      - ROUNDCUBEMAIL_DEFAULT_PORT=993
      - ROUNDCUBEMAIL_SMTP_SERVER=tls://smtp.example.com
      - ROUNDCUBEMAIL_SMTP_PORT=587
      - ROUNDCUBEMAIL_DB_TYPE=sqlite
      - ROUNDCUBEMAIL_PLUGINS=archive,zipdownload,managesieve
    volumes:
      - ./roundcube/db:/var/roundcube/db
      - ./roundcube/config:/var/roundcube/config
    restart: unless-stopped

SQLite is fine for a household; Roundcube only stores preferences, contacts and session cache, and the mail itself stays on the IMAP server. Switch to Postgres above about 20 users. The official image reads these environment variables and writes the base config for you; anything beyond them goes into a PHP file in the config directory using the same keys as config.inc.php. Put it behind TLS on your proxy, because the login form takes your real mail password.

Sizing, and the two settings that generate most support requests

Roundcube is light: 256 MB of RAM covers a household, and PHP-FPM with 4 workers handles 20 concurrent users without complaint. Two config keys cause most of the questions I get. des_key encrypts the IMAP password held in each session, and the image generates one for you; lose the config volume and everyone is logged out, nothing worse. imap_conn_options is where a self-signed certificate on your own Dovecot goes, with verify_peer set to false while you test and back to true before anyone else logs in. Set product_name too, so the login page carries your name rather than the project's.

Four plugins earn their place

managesieve is the one that turns Roundcube from a viewer into a mail client: server-side filters edited in the UI, stored on Dovecot or Stalwart, and applied whether or not you are logged in. RCMCardDAV, a third-party plugin, syncs the address book with a CardDAV server so the contacts you keep in Nextcloud or Radicale appear in compose autocomplete. enigma adds OpenPGP signing and encryption with keys held server-side, which is a compromise, but a workable one for people who will never run Thunderbird. And two_factor_authenticator puts a TOTP prompt on the login page, worth having on anything internet-facing. Beyond those, treat the long tail of the plugin registry with suspicion; many entries are abandoned, and PHP deprecation warnings in the log are the tell.

SnappyMail is faster; Roundcube is more complete

SnappyMail is the maintained fork of RainLoop and renders noticeably faster on a phone, with a lighter PHP footprint and no database requirement. It is a fine choice for one or two users who mostly read mail. Roundcube wins on the things administrators care about: LDAP and SQL address books, per-user identities and signatures managed centrally, the Sieve editor, a stable plugin API, and translations into more than 70 languages. If you are choosing the webmail for a family or a small company, Roundcube; for yourself alone, try both, since each takes 5 minutes to stand up.

The Nextcloud news changes little day to day

Roundcube joined the Nextcloud project in 2024. The practical effect so far is funding and maintainers with salaries, not a rewrite; releases keep coming on the old cadence and the standalone product is unchanged. Nextcloud Mail remains a separate, simpler app inside Nextcloud. If you already run Nextcloud and want mail inside it, use that; if you want a full client, Roundcube stays the answer, and the two will converge over years rather than months, if at all.

What I'd do

Running mailcow or Mailu: use the Roundcube they ship and spend the time on the honest self-hosted email checklist instead. Running a bare Dovecot or Stalwart: the compose file above, SQLite, managesieve and two_factor_authenticator enabled from day one, RCMCardDAV once you have a CardDAV server. Pick SnappyMail only if you are the sole user and phone speed is the thing you notice. Everything else in the email category is harder than webmail; Roundcube is the easy part.