readystack/authentik repository overview

⁠authentik (Community build)

readystack/authentik:2026.5.5-CE-trixie-r1

A hardened, cosign-signed, offline-rebuildable build of github.com/goauthentik/authentik version/2026.5.5 (MIT core; EE components stripped at build), built clean-room from official upstream source by ReadyStack⁠.

⁠What you get

• Docker Scout Grade A — all 8 default policies pass, 0 fixable Critical/High.
• Signed — cosign signature by the ReadyStack release key; verify with cosign verify --key <(curl -fsSL https://readystack.dev/keys/cosign.pub) readystack/authentik:2026.5.5-CE-trixie-r1.
• Built from source, non-root, on the current toolchain.

⁠Pulling

docker pull readystack/authentik:2026.5.5-CE-trixie-r1

⁠Deployment

ONE product container (the upstream Rust supervisor runs ak allinone: the Go router on :9000 serving the UI/API + the embedded proxy outpost + spawning the gunicorn ASGI app, plus Python task workers on a Postgres-backed dramatiq broker) PLUS one required datastore sidecar the customer provides: PostgreSQL. NO REDIS — authentik 2026.5 moved cache/channels/sessions/broker to Postgres. NOT a single self-contained image: Postgres is a hard external dependency.

See the compose in the ReadyStack Agent-ready Archive: the authentik container + postgres:16 on one network; set AUTHENTIK_SECRET_KEY (long random), AUTHENTIK_POSTGRESQL__HOST/__NAME/__USER/__PASSWORD, and optionally AUTHENTIK_BOOTSTRAP_PASSWORD/_EMAIL (creates the akadmin admin non-interactively; otherwise complete /if/flow/initial-setup/ on first visit).

⁠The full ReadyStack Agent-ready Archive

The complete --network=none build kit to recreate this exact image yourself — plus admin/DB/API handbooks, seed data, a validated test suite, and signed provenance — is at readystack.dev/buy.html⁠.

— ReadyStack · readystack.dev