Every feature
The self-hosted edition and the cloud are the same release. Single sign-on, the audit log, both agents: all of it.
Open source · AGPL-3.0
Your servers. Half an hour. Every feature.
OpenOKR is open source and complete. Run it on one server with Docker Compose, or on your own Kubernetes with Helm. PostgreSQL is the only thing it needs. Nothing is held back for a paid edition, and nothing limits how many people use it.
$ git clone https://github.com/open-okr/open-okr.git$ cd open-okr/deploy/docker$ OPENOKR_DOMAIN=okr.example.com ./openokr upopenokr: generating secrets (first run)openokr: secrets written to ./secrets (mode 600). Back up ./secrets/app.env.openokr: waiting for the instance to become healthyopenokr: ready. Open https://okr.example.com to finish setup.
No seat limit
A thousand people cost the same as ten: nothing.
No licence key
Nothing to activate, renew or check in with us.
No phone-home
No version check leaves your network. Telemetry is off unless you turn it on.
Install in four steps
From nothing to signed in.
-
Get the deployment files.
git clone https://github.com/open-okr/open-okr.git cd open-okr/deploy/docker -
Start it.
$./openokr upOn a real server, give it a domain and it gets its own certificate:
$OPENOKR_DOMAIN=okr.example.com ./openokr upOn the first run it generates every secret it needs, pulls the signed image, starts PostgreSQL, runs the migrations, starts the application and the proxy, and waits until it answers its own health check.
-
Finish in the browser.
Open the address it prints. The setup wizard asks for one thing: the account that owns the instance. Registration closes the moment that account exists, and everybody after you joins by invitation. You are signed in, you have a workspace, and both agents are already members of it.
-
Back up
secrets/.It holds the root encryption key. Lose it, and stored credentials such as mail passwords and AI keys become unreadable. That is the worst way to find out.
The account that owns the instance
Name
Sara
Email
sara@northwind.example
Password or passkey
••••••••••••
Create the owner accountThen registration closes
SASaraOwnerSigned in
OKR CoachAI teammateMember
OKR ChampionAI teammateMember
Everybody after youJoins by invitation
What you need
| Requirement | Why |
|---|---|
| Docker and Docker Compose | The whole instance runs as containers |
| 2 CPU cores, 4 GB memory, 20 GB disk | Comfortable for a few hundred people. The database is what grows |
| Ports 80 and 443 | The bundled proxy answers on them. Both can be changed |
| A DNS name, for HTTPS | Certificates are issued automatically for a real name |
No mail server, no AI provider and no identity provider are required. Each is optional, and the product is whole without them.
Three ways to run it
One server
For most organisations. Docker Compose, a bundled proxy with automatic certificates, and a lifecycle helper for upgrades and backups.
$
./openokr upKubernetes
For universities, government and large enterprises. A Helm chart with your PostgreSQL, your ingress and your backups. Migrations run as a hook before the application rolls.
$
helm install openokr oci://ghcr.io/open-okr/charts/openokrFrom a checkout
For contributors and evaluators. Node 22 and pnpm. Read the code while it runs.
$
pnpm dev
Day two
Run it without a platform team.
The lifecycle helper that installed it also runs it.
| Command | What it does |
|---|---|
$ ./openokr status | What is running, and whether it is healthy |
$ ./openokr upgrade | Back up, pull the new release, restart, migrate, report |
$ ./openokr backup | An encrypted database dump and a copy of the files, with a checksum |
$ ./openokr verify-backup | Prove a backup would restore, without touching the live database |
$ ./openokr restore | Restore from a backup |
$ ./openokr rotate-key | Re-wrap every stored secret under a new root key |
$ ./openokr logs | Follow the application log |
Upgrades you control
Nothing updates itself.
You choose when to upgrade. Releases follow semantic versioning: a major release names any action you must take, a minor one needs nothing from you, a patch is a fix. Any release upgrades straight to any later release in the same major, with no stops in between. The helper takes a backup first and stops if the backup fails, because rolling back means restoring that backup. Skipping it takes a deliberate setting, for a database backed up elsewhere.
Offline, if you need it
Runs with no route to the internet.
- AI: a local model through Ollama or your own inference server, or no AI at all
- Assets: fonts and scripts served from the instance, never from a CDN
- Telemetry: none, unless you opt in
- Chat: optional. Email and the browser cover everything
- Checked: an air-gap checklist runs against the source on every change, so every outbound request has to go through one guarded path
Verify what you run
Signed, with a bill of materials.
Every release publishes a multi-architecture image to ghcr.io/open-okr/open-okr, signed with cosign and shipped with a software bill of materials, and the Helm chart to oci://ghcr.io/open-okr/charts/openokr. Verify the signature before you run it. Pin the version you tested.
ghcr.io/open-okr/open-okrSigned
v0.5.0Latest release
cosignSignature
SBOMBill of materials
ghcr.io/open-okr/open-okroci://ghcr.io/open-okr/charts/openokr
The licence, in plain English
AGPL-3.0, and what it means for you.
| If you | Then |
|---|---|
| Run OpenOKR for your own organisation's staff | Unchanged, you have no obligations. Changed, offer the people who use your version its source, your own staff included |
| Change it and offer it to other people over a network | You must offer them your changed source, under the same licence |
| Want to sell a closed hosted version | You cannot. That is what the licence is for |
Contributions come under a lightweight contributor licence agreement, signed with one click. The full reasoning is in PLAN.md §4.
Help when you want it
The community, or us.
Community
GitHub issues, the documentation, and the runbooks for upgrades, incidents and the air gap. Free.
Support from OKR Institute
For organisations that want a named contact, response times in a contract, help with the rollout and help passing the security review. Same open source product.
Questions
Is the self-hosted edition really complete?
Yes. It is the same release the cloud runs. There is no enterprise edition, no licence key and no feature flag that a payment turns on.
What does it cost to run?
The server. A small machine with 2 CPU cores and 4 GB of memory is comfortable for a few hundred people. If you connect an AI provider, you pay that provider for what you use, and you can cap it.
Can we start self-hosted and move to the cloud later, or the other way round?
Yes. Export the workspace to an encrypted archive, sealed with a passphrase you choose, and import it into the other, after a dry run. It works in both directions.
Do we need Kubernetes?
No. One server with Docker Compose is the main path. The Helm chart is there for organisations that already run Kubernetes.
How do we get security fixes?
Watch the repository's releases. A patch release carries fixes only and upgrades with one command.
Can we use it commercially?
Yes. Running it for your own business is exactly what it is for.