Skip to content
BranchesTags
 
 

Repository files navigation

nextExplorer logo

NextExplorer

A modern, self-hosted file explorer with secure access control, polished UX, and a Docker-first deployment.

Live demo · Documentation

demo@example.com / demo1234 — everything resets when the demo restarts.

About this fork

NextExplorer was created by Vikram Soni and developed at nxzai/NextExplorer. That repository has had no commits since 13 July 2026, and its documentation and demo sites are offline — both are back here.

This fork carries the work that accumulated in the meantime — chunked uploads, per-user access control, ONLYOFFICE integration, native transfers with progress, and a good deal more — and is where issues are answered and releases are cut. It remains GPL-3.0, like the original.

Image variants

Two images are published, on both registries:

Tag Contains
latest, 3.1.2 Everything, including hardware video acceleration (VA-API) and RAW photo support
latest-lean, 3.1.2-lean The same application without VA-API or RAW — a considerably smaller image

Take the full image unless you know you need neither: VA-API only helps where the host exposes a render device to the container, and RAW support only matters if you keep camera files. Both variants are built for linux/amd64 and linux/arm64.

ghcr.io/cerede2000/explorer:latest
ghcr.io/cerede2000/explorer:latest-lean

They are also on Docker Hub under the same tags.

latest and latest-lean follow main, so a fix reaches them without waiting for a release. Every build is also published under the version in package.json — 3.1.2, 3.1.2-lean — republished for as long as that version is current, and left alone once the next one is cut.

Only the last two versions stay published: on Docker Hub the older one is removed as the next is published, and on GHCR a weekly job does the same. Pin a version you intend to keep running and move it forward deliberately rather than expecting an old tag to still be there.

Highlights

  • Secure by default: local users & groups, optional OIDC SSO.
  • Fast previews: images, videos, PDFs, thumbnails (FFmpeg), and inline players.
  • Built-in editor: edit text/code with syntax highlighting (extensible via EDITOR_EXTENSIONS).
  • Sharing workflows: link-based sharing (read-only/read-write), guest access, “Shared with me”.
  • Smart search: ripgrep-backed filename + content search with tunable limits, filename patterns (*.ps1), and an optional full-text index that reads Office documents and PDFs.
  • Modern UX: grid/list/column views, drag-and-drop, context menus, keyboard shortcuts.
  • Docker-native: single image, mount volumes under /mnt, reverse-proxy friendly via PUBLIC_URL.

Quickstart (Docker Compose)

services:
  nextexplorer:
    image: ghcr.io/cerede2000/explorer:latest
    container_name: nextexplorer
    restart: unless-stopped
    ports:
      - '3000:3000'
    volumes:
      - ./config:/config
      - ./cache:/cache
      # Each /mnt/<Label> mount becomes a top-level volume in the UI
      - /path/to/your/files:/mnt/Files
    environment:
      - NODE_ENV=production
      - PUBLIC_URL=http://localhost:3000
Full docker-compose with all configurations 
services:
  nextexplorer:
    image: ghcr.io/cerede2000/explorer:latest
    container_name: nextexplorer
    restart: unless-stopped
    ports:
      - '3000:3000'
    volumes:
      - ./config:/config # contains config files, db, settings etc.
      - ./cache:/cache # contains thumbnail cache and other files which are generated automatically

      # Each /mnt/<Label> mount becomes a top-level volume in the UI
      - /path/to/your/files:/mnt/Files

    environment:
      # Required basics
      NODE_ENV: production # Set to `production` for the Docker image defaults.
      PORT: '3000' # Port the Express API + frontend listen on *inside* the container.
      PUBLIC_URL: 'http://localhost:3000' # External URL (no trailing slash); drives cookies, CORS defaults, and derived callback URLs. Accessing the app via a different URL may cause CORS/cookie/OIDC issues.


      # Reverse proxy / networking (optional)
      # INTERNAL_URL: "http://192.168.1.250:3017,http://192.168.1.251:3017" # Extra origin(s) the app may also be reached from, comma-separated. They are accepted by CORS and OIDC returns to the origin used to start login. PUBLIC_URL stays canonical for share links and integrations. Register `${PUBLIC_URL}/callback` and every `${INTERNAL_URL}/callback` with your IdP.
      # TRUST_PROXY: "loopback,uniquelocal" # Express trust proxy config; set when running behind a reverse proxy (often auto-derived when `PUBLIC_URL` is set).
      # CORS_ORIGINS: "" # Comma-separated allowed origins; aliases: `CORS_ORIGIN`, `ALLOWED_ORIGINS` (defaults to `PUBLIC_URL` origin when set).

      # Logging & debugging (optional)
      # LOG_LEVEL: "info" # `trace|debug|info|warn|error` (defaults to `debug` when `DEBUG=true`).
      # DEBUG: "false" # When `true`, forces `LOG_LEVEL=debug` and enables more verbose diagnostics.
      # ENABLE_HTTP_LOGGING: "false" # When `true`, logs HTTP requests (recommended with centralized logs in production).
      # PERFORMANCE_DIAGNOSTICS_ENABLED: "false" # Log CPU, Node/cgroup memory, event-loop latency, thumbnail queues, and folder-size activity when a pressure threshold is reached.
      # PERFORMANCE_DIAGNOSTICS_INTERVAL_MS: "15000" # Sampling interval; at least 5000 ms.
      # PERFORMANCE_DIAGNOSTICS_LOG_EVERY_INTERVAL: "false" # Set `true` for a complete time series while investigating an issue.
      # PERFORMANCE_DIAGNOSTICS_CPU_THRESHOLD: "75" # Log a sample when the Node process reaches this CPU percentage.
      # PERFORMANCE_DIAGNOSTICS_RSS_THRESHOLD_MB: "768" # Log a sample when Node RSS reaches this level.
      # PERFORMANCE_DIAGNOSTICS_EVENT_LOOP_DELAY_MS: "250" # Log a sample when p99 event-loop latency reaches this level.

      # Paths & volumes (optional)
      # VOLUME_ROOT: "/mnt" # Root directory that houses all mounted volumes. App will display all directores inside this directory as volumes.
      # CONFIG_DIR: "/config" # Location for SQLite, `app-config.json`, extensions, and settings.
      # CACHE_DIR: "/cache" # Location for thumbnails, ripgrep indexes, and temporary data.
      # USER_ROOT: "/mnt/_users" # Root directory for per-user personal folders (defaults to `<VOLUME_ROOT>/_users` when unset). Make sure you persist this path if you use USER_DIR_ENABLED.

      # Authentication (optional)
      # AUTH_MODE: "both" # `local|oidc|both|disabled` what authentication methods you want to enable.
      # AUTH_ENABLED: "true" # Deprecated: use `AUTH_MODE=disabled` to skip login.
      # SESSION_SECRET: "please-change-me" # Session cookie secret (alias: `AUTH_SESSION_SECRET`); set a long, random, stable value (>= 32 chars) to keep sessions valid across restarts/replicas.
      # AUTH_MAX_FAILED: "5" # Failed login attempts before temporary lockout.
      # AUTH_LOCK_MINUTES: "15" # Lockout duration (minutes) when max failures reached.
      # AUTH_ADMIN_EMAIL: "" # First-run bootstrap (local auth): when set with `AUTH_ADMIN_PASSWORD`, creates an admin user on startup and skips setup.
      # AUTH_ADMIN_PASSWORD: "" # Password for `AUTH_ADMIN_EMAIL` bootstrap; overrides/resets password on startup if the user already exists.

      # OIDC & SSO (optional)
      # OIDC_ENABLED: "false" # Enable Express OpenID Connect auth flow.
      # OIDC_ISSUER: "https://auth.example.com/application/o/next/" # IdP issuer URL (discovery).
      # OIDC_AUTHORIZATION_URL: "" # Optional discovery override.
      # OIDC_TOKEN_URL: "" # Optional discovery override.
      # OIDC_USERINFO_URL: "" # Optional discovery override.
      # OIDC_CLIENT_ID: "nextexplorer" # IdP client ID.
      # OIDC_CLIENT_SECRET: "" # IdP client secret.
      # OIDC_CALLBACK_URL: "http://localhost:3000/callback" # Explicit canonical callback URL (defaults to `${PUBLIC_URL}/callback`). When INTERNAL_URL is set, also register each internal `/callback` URL with the IdP.
      # OIDC_SCOPES: "openid profile email" # Add `groups` to propagate group claims.
      # OIDC_ADMIN_GROUPS: "" # Space/comma-separated group names that grant admin rights (matched in `groups`, `roles`, or `entitlements`).
      # OIDC_REQUIRE_EMAIL_VERIFIED: "false" # When `true`, requires IdP to verify user email before allowing user creation/auto-linking.
      # OIDC_AUTO_CREATE_USERS: "true" # When `false`, denies OIDC login unless the user already exists in the DB.

      # Feature toggles (optional)
      # SEARCH_DEEP: "false" # Enables deep content search (ripgrep used when `SEARCH_RIPGREP=true`).
      # SEARCH_RIPGREP: "true" # Prefer ripgrep for fast searches; fallback search used when unavailable.
      # SEARCH_MAX_FILESIZE: "" # Skip files larger than this when searching contents (e.g., `5MB`, `5M`).
      # SEARCH_INDEX: "false" # Answer content searches from a full-text index instead of reading the volume every time.
      # SEARCH_INDEX_CPU_PERCENT: "25" # Share of one core the background indexing pass may take.
      # SEARCH_INDEX_EXCLUDE: "" # Folders search leaves alone, comma separated, relative to the volume root.
      # SHOW_VOLUME_USAGE: "false" # Show volume usage badges in the sidebar.
      # USER_DIR_ENABLED: "false" # Enables per-user “My Files” spaces under `USER_ROOT`.
      # USER_VOLUMES: "false" # Restrict non-admin users to only volumes assigned by an admin.
      # SKIP_HOME: "false" # When `true`, `/browse/` redirects into the first volume.

      # Editor (optional)
      # EDITOR_EXTENSIONS: "" # Extra file extensions supported by the inline editor (comma-separated, added to built-in defaults).

      # OnlyOffice & thumbnails (optional)
      # ONLYOFFICE_URL: "" # Public URL for OnlyOffice Document Server (must reach your app's `PUBLIC_URL`).
      # ONLYOFFICE_SECRET: "" # JWT secret shared with OnlyOffice Document Server for `/api/onlyoffice`.
      # ONLYOFFICE_LANG: "en" # Language code for the editor UI.
      # ONLYOFFICE_FORCE_SAVE: "false" # When `true`, the OnlyOffice Save button writes the current version immediately.
      # ONLYOFFICE_AUTO_SAVE_INTERVAL_MS: "30000" # Background save cadence for changed OnlyOffice files; set `0` to save only when closing.
      # ONLYOFFICE_FORCE_SAVE_TIMEOUT_MS: "10000" # Retry window for the background save started when closing an OnlyOffice document.
      # ONLYOFFICE_FILE_EXTENSIONS: "" # Extra file extensions to surface to the Document Server.
      # FFMPEG_PATH: "" # Point to a custom ffmpeg binary (defaults to bundled binary).
      # FFPROBE_PATH: "" # Point to a custom ffprobe binary (defaults to bundled binary).
      # THUMBNAILS_ENABLED: "true" # Set to "false" to disable thumbnail generation globally.
      # THUMBNAIL_CACHE_MAX_FILES: "3000" # Max files kept in /cache/thumbnails; set 0 to disable cleanup.
      # THUMBNAIL_CACHE_CLEANUP_BATCH_SIZE: "500" # Max thumbnail cache files deleted per cleanup pass.
      # THUMBNAIL_SHARP_CACHE_MEMORY_MB: "0" # Sharp/libvips thumbnail cache memory budget.
      # THUMBNAIL_VIDEO_CONCURRENCY: "1" # Max concurrent ffmpeg thumbnail jobs.
      # THUMBNAIL_VIDEO_SEEK_SECONDS: "5" # Timestamp used for video thumbnails; avoids probing every video by default.
      # THUMBNAIL_VIDEO_SEEK_PERCENT: "" # Optional 0-1 value to seek by duration percentage; enables ffprobe per video.
      # THUMBNAIL_VIDEO_THREADS: "1" # ffmpeg thread limit for video thumbnail extraction.
      # THUMBNAIL_VIDEO_SCALE_FLAGS: "fast_bilinear" # ffmpeg scale flags; use lanczos for sharper but heavier thumbnails.
      # THUMBNAIL_BACKGROUND_QUEUE_LIMIT: "8" # Max pending/in-flight thumbnail jobs accepted before clients retry later.
      # THUMBNAIL_DIAGNOSTICS_ENABLED: "false" # Enable detailed thumbnail queue/memory/process logs.
      # THUMBNAIL_DIAGNOSTICS_INTERVAL_MS: "30000" # Interval for thumbnail diagnostics logs.
      # THUMBNAIL_SLOW_JOB_MS: "10000" # Log thumbnail jobs/processes slower than this threshold.

      # Container user mapping (optional)
      # PUID: "1000" # Map container processes to host UID so created files have consistent ownership.
      # PGID: "1000" # Map container processes to host GID so created files have consistent ownership.

Documentation

About

Modern, self-hosted web file explorer: per-user access control, previews and media gallery, sharing, ONLYOFFICE editing, resumable uploads. Docker-first.

cerede2000.github.io/NextExplorer/

Resources

Readme
License

Contributing

Contributing
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages