How to Self-Host Excalidraw in 2026: Collaboration, TLS and Data Boundaries

If you already tried to self-host Excalidraw, the frustrating state is probably familiar: the UI appears, but the UI loads but collaboration fails because its WebSocket endpoint is wrong. Recreating the container rarely fixes a disagreement between URLs, state and dependencies.

This walkthrough uses one concrete completion criterion — draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser. Every configuration choice is evaluated against that criterion rather than against a green container badge.

Restore Excalidraw on an empty host

For the base Excalidraw deployment, the container layer is disposable and no data volume is required. The recovery manifest is no server data in the basic image; back up any separate collaboration service. Keep the image digest, configuration and any separately maintained assets under change control.

Delete and recreate the service in a clean environment, then prove that the client rebuilds from its pinned image and the separate room service restores any collaboration state it promises to keep. The Git repository to production guide is the relevant model here: rebuild the artifact, and back up only external state that actually exists.

Do not label a directory persistent unless Excalidraw writes meaningful data there. Empty or unused mounts create false confidence and make later operators search for state in the wrong place.

Map Excalidraw before touching Docker

The Excalidraw HTTP process listens on 80; keep that port on the application network and publish only the platform route. The local runtime requirement is a separate room server and storage layer for persistent collaboration. Keep its lifecycle explicit so moving Excalidraw between hosts does not silently change behavior.

Write the boundary down as a short contract: who owns the requirement, which credential is used, what timeout is acceptable and how failure appears. Then run this transaction: draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser. Observe static asset delivery for the base image, with WebSocket connections and room state belonging to the separate collaboration service during the run, because that workload gives a more useful starting size than an idle container.

A production acceptance run for Excalidraw

A release candidate for Excalidraw earns traffic by completing a fixed scenario: draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser. Capture the image digest, effective non-secret configuration, public origin and timestamps for that scenario. The test data should be disposable but realistic enough to exercise the same path as users.

Run it after replacing the runtime, then rebuild the service from no server data in the basic image; back up any separate collaboration service. Recovery passes when the client rebuilds from its pinned image and the separate room service restores any collaboration state it promises to keep. Compare resource measurements for static asset delivery for the base image, with WebSocket connections and room state belonging to the separate collaboration service with the prior release and investigate meaningful drift before promotion.

Finally, exercise this controlled failure: submit harmless input near the resource or format limit associated with this boundary: the UI loads but collaboration fails because its WebSocket endpoint is wrong. Verify that Excalidraw explains the failure, does not damage existing state and resumes after the valid condition returns. Save a redacted log excerpt and the recovery time. Together these checks cover behavior, durability and operability rather than just process uptime.

Turn the local command into an inspectable service

A production-shaped launch is intentionally boring: named state, explicit port and no secret inside the image.

docker run -d \
  --name excalidraw \
  --restart unless-stopped \
  -p 127.0.0.1:80:80 \
  excalidraw/excalidraw:latest

The example is a baseline rather than a complete supporting stack. Confirm the local requirement before exposure: a separate room server and storage layer for persistent collaboration. Check the effective mounts and listener, then try to draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser. Pin the working image before the next restart.

Security decisions specific to Excalidraw

With Excalidraw, account rotation is not the hardening task because the standard image has no account store. Focus on assuming the static image alone provides durable shared-room storage, and protect any private collaboration rooms and do not claim durable collaboration when only the Excalidraw web image is deployed.

Use HTTPS, optional platform authentication and a reviewed image digest. Mount no unrelated host data and cap the workload represented by static asset delivery for the base image, with WebSocket connections and room state belonging to the separate collaboration service. A clean external client should see the intended build, while an unauthorized client should be rejected before reaching the container when access is restricted.

Route Excalidraw without lying about HTTPS

TLS issuance is only half of the Excalidraw route. Serve the client over HTTPS and configure collaboration endpoints separately. Send traffic internally to 80 and forward the external scheme so generated URLs and secure cookies remain consistent.

Use the complete Excalidraw scenario from a clean network, not merely the root page. A 502 or certificate failure can be isolated with automatic domain and TLS setup. If traffic reaches the process and the UI loads but collaboration fails because its WebSocket endpoint is wrong, diagnose that condition where it occurs instead of stacking redirects.

Upgrade Excalidraw without guessing

The useful service indicator for Excalidraw is successful completion of “draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser”. Pair that result with static asset delivery for the base image, with WebSocket connections and room state belonging to the separate collaboration service; a green root page says nothing about output compatibility or resource exhaustion.

Before replacing the image, account for this risk: frontend, room-server and storage versions should be tested together rather than assuming the static client owns shared data. Test representative and boundary inputs against both versions and retain the old digest until the candidate passes. If the UI loads but collaboration fails because its WebSocket endpoint is wrong, inspect the request format, client behavior and runtime logs before changing route or storage settings.

Use Dockup for the platform layer

A one-click Excalidraw template should encode the image digest, port 80, health timing, domain and TLS. Because the base service is stateless, Dockup can recreate it directly on Dockup compute or an attached machine without pretending an empty volume is a backup.

After launch, Serve the client over HTTPS and configure collaboration endpoints separately. Dockup should preserve the Excalidraw runtime settings while the operator confirms this local requirement: a separate room server and storage layer for persistent collaboration. Verify this outcome: draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser. Any later stateful extension must declare its own mount, secret and restore test rather than changing the meaning of the base template silently.

Frequently asked questions

What does Excalidraw need for a production deployment?

Route the Excalidraw container on port 80 through one HTTPS origin. The local runtime requirement is a separate room server and storage layer for persistent collaboration. Do not call Excalidraw ready until you can draw and export a diagram, share a collaboration link through the configured room service and reconnect a second browser.

Which Excalidraw data belongs in a backup?

The standard Excalidraw image has no required application-data mount. Preserve its deployment configuration and back up any connected state separately; recovery passes when the client rebuilds from its pinned image and the separate room service restores any collaboration state it promises to keep.

Does Excalidraw require HTTPS behind a reverse proxy?

Use HTTPS for the public Excalidraw origin and keep port 80 on the internal route. Apply the Excalidraw setting correctly: serve the client over HTTPS and configure collaboration endpoints separately. For Excalidraw, HTTPS protects credentials or user content in transit and keeps origin-sensitive client behavior consistent.

How should an Excalidraw upgrade be tested?

Deploy the candidate Excalidraw image beside the current one and repeat the acceptance transaction with known input. Pay particular attention because frontend, room-server and storage versions should be tested together rather than assuming the static client owns shared data. The standard container has no data migration, so retain the previous digest until output and compatibility checks pass.