Which fits your Confluence replacement: Confluence or BookStack?
Confluence fits better when your documentation depends on what Atlassian's stack already does for you. If your teams rely on Marketplace apps, macros inside pages, space-level permissions that mirror Jira projects, or an existing Atlassian admin team, moving away carries integration work that a simpler wiki will not absorb. Confluence remains the right answer for organizations that have a long-term Cloud or Data Center contract and no regulatory reason to move. The renewal question is not only price: a Data Center subscription for a new customer ends on March 30, 2026, and Data Center licenses become read-only on March 28, 2029, so plan the timeline against your own contract dates rather than the calendar of your last renewal.
BookStack fits when your content already has a clear hierarchy and you want to host it yourself under an MIT license. Its shelves, books, chapters and pages suit handbooks, runbooks and policy libraries that change in predictable sections. It offers a WYSIWYG editor with an optional Markdown editor and built-in diagrams.net diagrams, and it supports OIDC, SAML2 and LDAP sign-in with multi-factor authentication that can be enforced per role, without a paid edition. Confirm with the BookStack documentation that each of these features is available in the version you intend to run, and check whether your identity provider's attribute mapping supports the role model you need.
The decision turns on three things: how your content is structured, which integrations you cannot give up, and how much in-house operating capacity you have. If your knowledge is organized as deep, cross-linked spaces with macros and Marketplace apps, BookStack's fixed hierarchy will feel restrictive, and XWiki may be the closer match. If your content fits shelves and books and your main need is secure self-hosted sign-in, BookStack is a strong candidate. Note that BookStack does not publish official Docker images, so your team must own the installation, upgrades and backups on a supported Linux host, which is a recurring cost to weigh against licensing savings.
Which scenarios favor Confluence and which favor BookStack
This table maps common situations to the platform that fits better and the condition that decides it. Read each row against your own Jira, hierarchy, hosting and operations constraints, since the right answer usually depends on one or two of them. The main takeaway is that BookStack suits structured documentation libraries and self-hosted teams with Linux and PHP skills, while Confluence suits teams whose work runs through Jira and Marketplace apps.
| Scenario | Better fit | Reason and condition |
|---|---|---|
| Team relies on Jira issues, dashboards and Marketplace macros embedded in pages | Confluence | Confluence macros and Marketplace apps have no direct BookStack equivalent. Choose Confluence unless you can confirm that each macro your team uses is replaceable. |
| Documentation library that naturally splits into shelves, books and chapters, such as product manuals or runbook sets | BookStack | Its fixed shelf, book, chapter and page hierarchy matches this structure directly. Fit weakens if content needs many cross-cutting spaces or custom page types. |
| Free-form team spaces where each group creates its own page tree and structure | Confluence | Confluence spaces give each team independent page trees and permissions. BookStack's hierarchy is more prescriptive, so teams may need agreed conventions to avoid sprawl. |
| Regulated organization that must keep content on its own servers | BookStack | BookStack is MIT licensed and runs in your infrastructure, while Confluence Data Center licenses become read-only on March 28, 2029. Confirm your residency and hosting requirements with your assessor. |
| Organization with a Confluence Data Center estate that needs an on-premises successor | Confluence | Migration tooling and page structure may be easier to carry over to XWiki or Docmost than to BookStack. Compare export formats before deciding. |
| Team without Linux, PHP or MySQL/MariaDB operations skills | Confluence | BookStack needs PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later, and has no official Docker images. Confluence Cloud avoids server operations entirely. |
| Team with Linux and PHP operations skills that wants SSO and enforced MFA without a paid edition | BookStack | BookStack supports OIDC, SAML2 and LDAP sign-in and role-based enforced MFA. Confirm the exact setup for your identity provider during evaluation. |
Where BookStack's fixed hierarchy fits better or worse than Confluence spaces
BookStack's shelves, books, chapters and pages hierarchy fits content that has a stable owner and a long shelf life: handbooks, policy libraries, runbooks and onboarding guides. Readers find a policy by walking down a known path, and editors know where a new page belongs. The model becomes harder to live with in project-based organizations that open many loosely related Confluence spaces, each with its own home page, templates and permissions, and that reorganize them every quarter. In BookStack, a page cannot sit outside a book, and moving content between books is a manual operation, so teams that treat a space as a disposable project container will feel the constraint quickly.
Before you decide, export a representative inventory of your Confluence content and map it onto the target model. List every space, its home page and its page tree depth, then note which spaces use labels, which rely on page-tree nesting for meaning, and which contain pages that are referenced from several places. Pages that belong in two spaces need a single chosen home, with links from the other location. Labels and cross-space search do not translate one to one into shelves, so decide in advance whether a label such as a product name becomes a shelf, a chapter or a tag you search on. Confirm with the BookStack documentation how it handles tags and search in your version, because the answer determines how much manual sorting remains.
The restructuring work is usually larger than the data transfer. Plan a pass that merges small or dormant spaces, splits oversized ones into books, and renames chapters so that people searching by team or topic still find content. Assign an owner to each shelf, since BookStack's role and permission system is applied at these levels and an unowned shelf tends to accumulate stale pages. Treat this as a content design exercise with the people who use the wiki daily, and budget the time for it separately from the technical migration, because it is the step most often skipped and most often blamed later.
Where your Confluence content and user data live under each option
Each option places your pages, attachments and user records in a different location, and each one shifts a different set of controls onto your team. The cards below compare Atlassian Cloud, Data Center and a self-hosted BookStack, then cover identity, MFA and the evidence you still produce yourself.
Atlassian Cloud data location
Atlassian Cloud stores site content in infrastructure that Atlassian operates, and its data residency option keeps page content in a region you choose. User account data sits outside that residency commitment, so your identity records may not stay in the same region. Ask Atlassian in writing which data categories are covered, where backups are kept and who at Atlassian can access them. Your organization still controls who gets a Confluence seat, but not where Atlassian runs the service.
Data Center and end of life
Confluence Data Center runs in your own data center or private cloud, so pages and attachments stay under your control. The subscription model is changing, though: new Data Center subscriptions for new customers end on March 30, 2026, and Data Center licenses expire and become read-only on March 28, 2029. Plan for that date in your roadmap, because a self-hosted Atlassian install you cannot renew still needs a replacement.
Self-hosted BookStack under the MIT license
BookStack is MIT licensed, so you can install it on servers you run, in your own cloud account or in an air-gapped network, without a per-user license fee from its authors. Your data sits in the MySQL or MariaDB database and the uploaded files on your storage. You are responsible for database backups, patching and TLS. Confirm the license text and the version you deploy against the BookStack GitHub repository before you build your change record.
Identity through your own IdP
BookStack supports OIDC, SAML2 and LDAP sign-in, so user authentication can run against the identity provider you already operate rather than a separate local password store. Confirm which attributes BookStack maps for roles, whether deprovisioned users lose access on the next sign-in, and how group claims are handled. Test a disabled account from your IdP before go-live, because local accounts can remain active if you do not turn them off.
Enforced MFA without a paid edition
BookStack includes built-in multi-factor authentication that can be enforced per role, with no paid edition required to turn it on. For Confluence customers that paid for Atlassian's access controls, this is the item to verify first. Decide which roles, such as administrators and editors, must enroll, and test what happens to users who have not enrolled yet. Check whether MFA is enforced at the application or only at your IdP, because those are different controls.
Compliance evidence you still produce
Hosting BookStack moves responsibility for evidence to your team. You must collect access reviews, change records, backup restore tests, patch logs and role definitions yourself, and map them to the controls your auditor tests. DeployOpen can prepare the controls, configuration baselines and evidence collection for your assessment, but DeployOpen does not issue audit reports, attestations or certifications. An independent auditor or certification body makes that determination.
Running BookStack without official Docker images
BookStack publishes official installation scripts for Ubuntu 22.04, 24.04 and 26.04, and it does not publish official Docker images. Its installation documentation points teams to community Docker setups, such as the LinuxServer.io image, instead. That means any container you run is a third-party build, and the first decision is whether your security team accepts that provenance. Before standardizing, check who maintains the image, how often it is rebuilt, whether it is signed or published with build provenance, and whether you can build it yourself from the BookStack release tag. Record the image digest you deploy so an unexpected change is visible.
The stack requirements shape the work regardless of packaging. BookStack needs PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later, so the database version in your environment must be checked against the image's own base. Patch cadence becomes your responsibility: you need a process to track BookStack releases, such as v26.09.1 published on September 29, 2026, and to rebuild or pull updated images when PHP, the database or the application receives a fix. Backups must cover the database, the uploaded files directory and the application configuration, and a restore should be tested on a separate host because a container image alone holds none of your content.
Confirm these points before you commit: the image's maintainer and release process, which PHP and database versions it ships, how it handles upgrades between BookStack releases, and whether it supports the sign-in methods you need, including OIDC, SAML2 and LDAP, and enforced MFA. Ask your platform team who will own the rebuild and the emergency patch path, and whether an official installation on a supported Ubuntu release would be simpler for your organization. Write these answers into your runbook so the choice of image is a documented decision rather than a default.
What the MIT license and paid support mean for each option
Confluence is sold as a commercial product, and the price you pay depends on the deployment model you choose. Atlassian's direction of travel is clear: it announced the end of support for all server products, including Confluence Server, on February 15, 2024, and it is ending new Data Center subscriptions for new customers on March 30, 2026. Existing Data Center customers can buy and expand until March 30, 2028, and Data Center licenses, Confluence Data Center included, expire and become read-only on March 28, 2029. Those dates matter for any plan that assumes a self-hosted Atlassian wiki will remain available.
- Subscription terms: You pay Atlassian recurring fees for each product license, and your contract, not the software, sets what you can keep running.
- Server end of support: Confluence Server support ended on February 15, 2024, so a server installation no longer receives vendor fixes.
- Data Center end of life: New Data Center subscriptions end for new customers on March 30, 2026, and licenses become read-only on March 28, 2029.
- Cloud exports: XML site and space export reaches end of life on December 1, 2026, which affects backup and migration plans.
Confirm with Atlassian or your reseller which products, deployment models and renewal terms apply to your contract, and ask what happens to your data and access at each end-of-life date.
BookStack is licensed under the MIT license, which lets you use, modify and run the software without a per-user license fee. Your organization can install it for every employee, contractor and reader without paying the software vendor for seats. The maintainers, led by Dan Brown with community contributors, also offer paid support plans and sponsorship, so commercial help exists without changing the license you hold.
- No per-user software license: The MIT license does not charge for each person who reads or edits a page.
- Optional paid support: Support plans from the maintainers are a separate purchase that you can add or skip.
- Sponsorship: Sponsorship funds development, and it does not give your organization extra rights to the code.
- Modification rights: You can change the code for internal use, although every upgrade then needs a merge or a retest.
- Current release: The latest release, v26.09.1, was published on September 29, 2026.
Before you rely on the license, read the LICENSE file in the project repository and confirm with the maintainers which support plan covers your PHP and database versions.
A free license does not make the platform free to run. Your costs move from a vendor subscription to hosting, administration and support, and each of those is paid to someone, whether an internal team, a cloud provider or a services firm. Most of the cost is recurring, while the initial setup, data migration and integration work are one-time costs.
- Hosting: You pay for servers, storage, backups and network capacity in your own or a cloud account.
- Administration: Someone must apply updates, manage PHP and database versions, rotate secrets and monitor the service.
- Support: Paid support plans from the maintainers, or internal staff time, cover incidents and upgrade questions.
- Integration and migration: Sign-in setup, page migration and content review are often one-time projects.
- Cost drivers: Team size, the number of high-availability nodes and how much custom work you need all raise the total.
Ask any implementation partner for a quote built from a written scope that lists each of these components separately, so the recurring and one-time costs can be compared with your current Confluence renewal.
The honest comparison is between two sets of costs over the same period, not between a subscription and a zero price. A Confluence renewal bundles the software, hosting (in Cloud) and vendor support, while BookStack separates those into items you choose and pay for. The right comparison depends on the number of users, your data residency rules and the skills you already employ.
- Build a like-for-like model: Include license fees, hosting, storage, backups, administration hours and support in both columns.
- Include exit costs: Export effort and content review affect the timing of any move away from Confluence.
- Plan for upgrades: Budget time for PHP, database and BookStack version upgrades on a schedule you control.
- Watch the timeline: Confluence Data Center end-of-life dates and Cloud export changes may force a decision before your current contract ends.
- Ask for itemized quotes: Request a breakdown by component so you can see what recurs and what is one-time.
When you build the model, confirm the current Atlassian renewal terms and the BookStack support plan details directly with each vendor, since neither should be assumed from this page.
How a move from Confluence to BookStack typically proceeds
The sequence turns a Confluence estate into a shelf, book, chapter and page structure in BookStack, with identity, permissions and content checked before users switch over.
Inventory spaces, pages and attachments
List every Confluence space, its owners, page counts, attachment volumes, blog posts and any Marketplace macros or apps that render content. Mark which spaces are stale and can be archived instead of moved. Owners of each space confirm the list. The inventory is done when every space has a named owner, a keep or archive decision and a known attachment total.
Decide the shelf and book mapping
BookStack uses a fixed hierarchy of shelves, books, chapters and pages, so each Confluence space needs a target. Many teams map a space to a book and a parent page tree to chapters, while others group several related spaces on one shelf. Write the mapping down and flag pages whose nesting does not fit, such as deep page trees or pages that sit under several topics. The mapping is complete when a document lists every source space and its destination.
Export content in a format that still has support
Confluence Cloud space admins can export a space as PDF, CSV, HTML or XML, and site admins can create a full site backup from the backup manager. XML site and space export reaches end of life on December 1, 2026, after which Atlassian will no longer fix bugs or accept tickets for it and recommends CSV. Check each export for missing attachments, comments and page history, and keep a copy of the raw export. The export is accepted when a sample of pages opens with its attachments intact.
Import or rebuild pages in BookStack
BookStack does not provide a built-in Confluence importer, so teams either convert exported HTML or Markdown with scripts or a conversion tool, or rebuild priority pages by hand. Confirm which route applies with the BookStack documentation and the converter you choose. Check that headings, tables, code blocks, images and draw.io or other diagrams survive, and that internal links point to the new BookStack URLs. The step closes when a sample of each page type reads correctly in the new book.
Reconnect identity and sign-in
BookStack supports OIDC, SAML2 and LDAP sign-in and multi-factor authentication that can be enforced per role. Configure the identity provider in a test instance, confirm that group or attribute mappings assign the right roles, and test sign-in with MFA enforced. The identity team confirms that accounts created through single sign-on match the Confluence user base. The step is done when test users from each group sign in and land with the expected role.
Migrate permissions to shelves, books and roles
Confluence space permissions do not map one to one onto BookStack roles and permissions, so review each space's groups and restrictions and rebuild them as BookStack roles, with shelf and book permissions where access must differ. Pay attention to pages with restrictions stricter than their space. The security or compliance owner signs off on a permissions matrix. The step is complete when the matrix matches the approved access model and test accounts see only what they should.
Validate content and cut over
Run a validation pass covering page counts, attachments, links, search results and a sample of pages checked against the source by the content owners. Record the issues, fix them and rerun the checks on the final import. Agree the cut-over window with the space owners, set Confluence spaces to read-only or archived after the last sync, and publish a redirect or pointer page. The cut-over is done when owners sign off on each space and the open issue list is empty or accepted in writing.
Questions buyers ask before choosing BookStack over Confluence
What drives the cost of running a self-hosted BookStack instead of Confluence?
The license fee is zero because BookStack is MIT licensed, so the cost is the infrastructure, the database, the people who run it and any support you buy. Infrastructure covers a PHP 8.2 or later server, a MySQL 8.0 or MariaDB 10.6 or later database, backups, TLS and monitoring. Staff time covers upgrades, patching and user administration, which recurs. Paid support plans and sponsorship are optional and come from the BookStack project. Confluence costs are recurring subscription fees, so compare your current Atlassian invoice against your own hosting and staff estimate. Ask any implementation partner for a fixed-scope quote that lists each component separately.
How long does a migration from Confluence to BookStack take?
The duration depends on the volume and structure of your content, not on BookStack itself. The main drivers are the number of spaces and pages, how many attachments and page versions you need to keep, how much your pages rely on Confluence macros, and how many permission rules must be recreated. BookStack's hierarchy of shelves, books, chapters and pages has to be mapped onto your Confluence spaces before any data moves, which takes planning time. Confirm the import method and its limits with the BookStack project and your migration partner before committing to a timeline, and ask for a pilot on one representative space.
What does the migration need from our internal team?
Expect to need named owners for content, identity and infrastructure. Content owners decide how spaces map to shelves and books and sign off on pages that break after conversion. Identity administrators configure OIDC, SAML2 or LDAP sign-in and map groups to BookStack roles. Infrastructure staff provision the server, database, backups and TLS. Someone must also own the decommissioning plan for Confluence, including read-only access and retention for historical content. Ask the migration provider which of these tasks it will perform and which it expects your staff to handle.
Can our own team migrate and run BookStack without outside help?
Yes, a team with Linux administration, PHP and database experience can install BookStack using the official installation scripts for Ubuntu 26.04, 24.04 and 22.04. Running it well for a regulated organization also needs backup testing, patching, access reviews and documented change control. BookStack does not publish official Docker images, so containerized deployments rely on community setups such as LinuxServer.io, which you should evaluate for supply chain and update practices. Outside help is most useful for the migration mapping, identity integration and security testing. Confirm your in-house skills against the installation documentation before deciding.
Do Confluence Marketplace apps have equivalents in BookStack?
Some app functions have equivalents and many do not. BookStack covers core documentation needs: shelves, books, chapters, pages, a WYSIWYG editor with optional Markdown, built-in diagrams.net diagrams, and a role and permission system. Confluence macros, Marketplace apps for approvals, custom page types, Jira-linked reporting, and complex templates will need a different approach, such as a documented manual process, a separate tool, or a custom integration. List the apps and macros your spaces actually use, then mark each as covered, partly covered, or missing before scoping the work.
How is MFA enforced and how are OIDC, SAML2 and LDAP sign-in set up?
BookStack supports OIDC, SAML2 and LDAP sign-in and includes built-in multi-factor authentication that can be enforced per role, without a paid edition. Setup happens in the BookStack configuration, where you register BookStack as a client with your identity provider, map claims or attributes to roles, and decide which roles must enroll in MFA. Test each path with a non-administrator account, confirm what happens when a user leaves your directory, and document the break-glass procedure. Exact configuration keys and provider-specific steps should be confirmed against the BookStack installation and authentication documentation and your identity provider's current guidance.
What should we confirm about BookStack's support and security posture before choosing it?
Confirm the release cadence and the version you plan to run, since BookStack publishes releases on its GitHub releases page, with v26.09.1 published on September 29, 2026. Review its security reporting process and how patches are delivered. Check that the authentication methods, MFA enforcement and audit logging meet your policy, and that your hosting meets data residency requirements. Ask whether you need paid support from the BookStack project and whether an independent security test of your deployment is part of the plan. DeployOpen can plan, implement, harden and test a self-hosted BookStack inside your own infrastructure under a fixed-scope written agreement.
What drives the total cost of ownership on each side
The Confluence side of the comparison is mostly recurring. The cost is a subscription that scales with the number of users and the edition chosen, and the price for your tier should come from a written quote from Atlassian or a partner, not from a list you assume is current. If you run Data Center, add the server or cluster hardware, the database, load balancers, storage and the staff time needed to patch and upgrade the platform. Confirm the Data Center end dates with your Atlassian account team, since the Atlassian Ascend announcement sets the timeline for new subscriptions and expiry, and any renewal you sign now should be priced against that schedule. Each user tier increase, added instance and extra year of subscription raises the bill, while consolidating sites or trimming inactive accounts lowers it.
BookStack carries no license fee, so its costs are the infrastructure and the people who run it. Plan for a virtual machine or container host, a MySQL 8.0 or MariaDB 10.6 or later database, PHP 8.2 or later, backups of both the database and the uploaded files, and regular patching of PHP, the operating system and the web server. These costs recur monthly or annually, and they rise with the number of users, attachment volume and the availability you require. A paid support plan from the BookStack team is optional. Ask whether a plan is needed for your risk profile and what it covers, because it is the only license-like line item. Also ask whether your team will rely on community Docker setups, since that choice shifts maintenance work onto your staff.
The largest one-time cost on both sides is migration labor. Budget for content mapping into shelves, books and chapters, cleanup of Confluence macros and attachments that do not carry over cleanly, permission design, single sign-on configuration, and user onboarding. Scope this in writing before work begins so the quote covers testing and cutover, not only the import. Set a date for recovering the cost of parallel running, when both systems are live. In a fixed-scope engagement, ask the implementation partner to itemize installation, integration, hardening, backup setup and documentation separately, so you can see which items recur and which end at handover.
How DeployOpen helps you evaluate, implement and migrate BookStack
DeployOpen is a Chainscore Labs company that plans, implements, integrates, hardens, backs up and documents self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Confluence vs BookStack, we start with the written scope so you can judge whether BookStack's shelf, book, chapter and page structure fits your content before any migration work begins.
How we scope
- Engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts.
- The written scope maps your Confluence spaces to BookStack shelves, books and chapters, and flags content that will not fit the hierarchy.
- Sign-in requirements are recorded for OIDC, SAML2 or LDAP, along with which roles must enforce multi-factor authentication.
How we build
- We install BookStack on your infrastructure with PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later, as listed in its installation docs.
- Where you need containers, we document the community Docker setup you choose, since BookStack does not publish official Docker images.
- We configure roles, permissions, diagrams.net diagrams and the editor mode your teams will use, then test sign-in and access rules.
How we hand over
- You receive written runbooks covering installation, configuration, sign-in, backup and restore, and the upgrade procedure for each BookStack release.
- Migration results are checked page by page against the Confluence export, with attachment, link and permission gaps listed for your review.
- Your team is walked through role administration, content ownership and the manual fixes the migration could not complete.
How we support
- Ongoing support, upgrades and continuous testing are available as retainers after handover.
- Retainers can cover tracking BookStack releases, such as v26.09.1, and applying them in your test environment before production.
- Ask any vendor or implementation partner to confirm the support tier, response expectations and what the quote includes in writing.

