Nextcloud All-in-One

Last reviewed Aug 26, 2026 · 882 words

If you want Nextcloud and you are not planning to spend weekends tuning PHP-FPM, Redis and PostgreSQL by hand, Nextcloud All-in-One is the version to install. It is the official packaging: one mastercontainer spawns and updates around ten others, backups are BorgBackup with a button, and the defaults pass Nextcloud's own security and performance checks on day one. The costs are two. It needs your Docker socket, and it has firm opinions about ports and domains that you must follow rather than fight.

Reverse-proxy mode is the one you want

AIO has two ways to reach the internet. Exposed directly, it terminates TLS itself on port 8443 with its own Let's Encrypt handling. Behind a reverse proxy, the Apache container listens on an internal port you choose and your proxy does TLS. The second is the pattern that fits a home server already running other services, and it looks like this:

services:
  nextcloud-aio-mastercontainer:
    image: nextcloud/all-in-one:latest
    container_name: nextcloud-aio-mastercontainer
    init: true
    restart: always
    ports:
      - "8080:8080"
    environment:
      - APACHE_PORT=11000
      - APACHE_IP_BINDING=127.0.0.1
      - NEXTCLOUD_DATADIR=/mnt/ncdata
    volumes:
      - nextcloud_aio_mastercontainer:/mnt/docker-aio-config
      - /var/run/docker.sock:/var/run/docker.sock:ro

volumes:
  nextcloud_aio_mastercontainer:
    name: nextcloud_aio_mastercontainer

The container name and the volume name must be exactly those strings; the mastercontainer looks for them. Port 8080 is the AIO admin interface, self-signed, where you enter your domain and pick optional containers. Your proxy then forwards cloud.example.com to localhost:11000, which in Caddy is one line: reverse_proxy localhost:11000. AIO validates the domain by resolving it from inside the container before it will proceed, so DNS has to be pointing at the box first; the reverse proxy showdown covers the Traefik and Nginx Proxy Manager equivalents.

The Docker socket is the price, so isolate it

The mastercontainer creates, stops and upgrades the other containers, and the only way to do that is access to the Docker socket. The socket is root on the host. AIO mounts it read-only and the project is careful, but the honest framing is that you are trusting one container with your whole Docker host. The mitigation is placement, not configuration: run AIO on a VM or a box that hosts Nextcloud and little else, not next to an experimental container you pulled from someone's GitHub last night. The catalogue lists this as a con, and it is one; it is also the mechanism that makes everything else automatic.

Backups are Borg with a button, and they cost downtime

Inside the AIO interface you set a backup path (local disk, or a mounted remote share) and an encryption password, and it takes BorgBackup snapshots of every container's data, deduplicated and encrypted. You can enable a daily backup at a chosen hour with updates applied afterwards, which is the closest a self-hosted service gets to "maintained for you". The catch: the backup stops all the Nextcloud containers while it runs, so pick an hour nobody is syncing. Write the encryption password somewhere that survives the server dying, because a restore into a fresh AIO instance asks for it and there is no recovery without it. Then test the restore once. Same rule as for any backup: an untested backup is a hope.

Optional containers decide your RAM bill

The catalogue's 1 GB minimum covers the base set: Nextcloud, database, Redis, Apache. Everything optional adds real memory. My rough numbers from watching them idle: Collabora for in-browser documents adds about 1 GB, ClamAV for upload scanning about 1 GB, full-text search (which runs Elasticsearch) about 2 GB, Talk and its high-performance backend a few hundred MB, Imaginary for preview generation and the whiteboard almost nothing. A 4 GB box runs Nextcloud with Collabora comfortably; tick every box and you want 8 GB. Start with only Imaginary enabled, use the thing for a month, then add Collabora if you actually edit documents in the browser.

When plain Nextcloud or Syncthing is the better call

Install Nextcloud manually when you need a database you already run, a custom PHP build, a non-Docker host, or the freedom to bolt on services the way you like. Manual gives you every knob and every failure mode. And if the real requirement is "keep these folders identical on four machines" with no sharing, calendar or office, Nextcloud is the wrong shape entirely; the Nextcloud vs Syncthing comparison is the two-minute read that saves a weekend, and the wider file-sync category has the middle options.

What I'd do

AIO, reverse-proxy mode on port 11000 behind Caddy, on its own 4 GB VM with the data directory on the big disk. Imaginary on, Collabora on, ClamAV and Elasticsearch off. Daily Borg backup at 04:00 to a second disk, password in the password manager, one restore drill in the first fortnight. Automatic updates on, because AIO's whole promise is that upgrading Nextcloud stops being a project. For most households and small teams this is the best Nextcloud has ever been to run, and the Docker-socket trade is one I take without much thought on a dedicated box.