This is the easiest self-hosting path for beginners.
- Docker Desktop installed and running
- Internet connection (first run downloads the image)
git clone https://github.com/nexu-io/open-design.git
cd open-design/deployWhat this does:
- Downloads the project
- Moves into the folder that contains
docker-compose.yml
Create deploy/.env from the tracked template:
cp .env.example .envGenerate a token if you want the default protected mode:
openssl rand -hex 32Then edit .env and configure one of these before first start:
- recommended default: paste the generated token into
OD_API_TOKEN= - trusted authenticated reverse proxy only: leave
OD_API_TOKEN=empty and setOPEN_DESIGN_DISABLE_API_AUTH=1
If you expose Open Design through a reverse proxy, also set:
OPEN_DESIGN_ALLOWED_ORIGINS=https://yourdomain.comdocker compose up -dWhat to expect:
- First run can take 1-2 minutes while Docker pulls the image
- You should see container creation and startup messages
docker compose psSuccess looks like:
open-designcontainer is listedSTATUSshowsUpand eventuallyhealthy- Port mapping includes
127.0.0.1:7456->7456/tcp
curl -i http://127.0.0.1:7456/api/healthSuccess looks like:
- HTTP status
200 OK
Open:
http://127.0.0.1:7456/
If the browser displays a sign-in dialog, enter open-design as the username
and the OD_API_TOKEN value from deploy/.env as the password. You should then
see the Open Design interface. Docker bridge peers remain authenticated; no host
networking override is required.
failed to connect to the docker API: Docker Desktop is not running yetaddress already in use: Port7456is occupied by another processcurl: (7) Failed to connect: container is still starting; wait 10-20 seconds and retrypull access deniedorauthentication requiredforghcr.io/nexu-io/od: the GHCR package must be public for anonymous Docker, Compose, and Dokploy pulls. An organization maintainer must open GitHub -> Packages ->od-> Package settings and change visibility to Public.- reverse proxy +
OD_API_TOKEN: either injectAuthorization: Bearer <OD_API_TOKEN>at the proxy, or setOPEN_DESIGN_DISABLE_API_AUTH=1only when that proxy already authenticates every request and the daemon is not directly exposed. - browser sign-in repeats: use username
open-designand the exactOD_API_TOKENvalue fromdeploy/.env; recreate the container after changing the token.




