BookStack vs Docmost: which to choose

BookStack vs Docmost: which fits a self-hosted knowledge base

If your team needs a simple self-hosted knowledge base and must know exactly which features cost money, BookStack is the option whose core feature set is fully MIT licensed. Its shelves, books, chapters and pages, its OIDC, SAML2 and LDAP sign-in, and its built-in multi-factor authentication that can be enforced per role are all part of the software you download, with no paid tier needed to use them. BookStack fits teams that want a fixed, easy-to-explain content hierarchy, that run PHP and MySQL 8.0 or MariaDB 10.6 or later already, and that do not expect several people to edit the same page at once. Its installation docs cover official scripts for Ubuntu 26.04, 24.04 and 22.04, but no official Docker images, so plan on a community container setup if you want containers.

Docmost fits a different brief. Its Community edition is free and self-hosted, and its feature list centers on real-time collaborative editing, spaces, permissions, comments, page history, and Draw.io, Excalidraw and Mermaid diagrams. Several controls that enterprise teams often expect are on the paid side of Docmost's documentation: SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning, MFA, and page-level permissions are listed among paid-edition features, and the Business plan is priced at $6 per seat per month billed annually with a 10-seat minimum. Docmost's installation runs on PostgreSQL 18 and Redis 8 images, and its real-time editor needs WebSockets enabled on any reverse proxy. Confirm current edition boundaries with Docmost before you rely on them, because the paid list is the part most likely to change.

The decision turns on four questions. First, which identity controls are mandatory on day one, and whether LDAP, SAML or OIDC without a paid tier is enough. Second, whether real-time co-editing is a daily need or a nice-to-have. Third, which stack your operations team can support: PHP with MySQL or MariaDB, or PostgreSQL and Redis with WebSocket proxying. Fourth, what you must bring in, since Docmost's importers cover Confluence, DOCX, Notion and Markdown or HTML, while BookStack's import path should be tested against your own export before you commit. Write those answers down, then request a written quote for the scope you need from DeployOpen.

Which platform fits which scenario

This table maps common team situations to the platform that fits better and the condition under which the other one wins. Read each row against your own requirements for licensing, sign-in, editing style and hosting, then confirm paid-tier details with the vendor before you decide.

Scenario	Better fit	Reason and condition for the other platform
Small team wants a free knowledge base with SSO	BookStack	BookStack is MIT licensed and supports OIDC, SAML2 and LDAP sign-in in its base product. Docmost lists SSO with SAML 2.0 or OIDC as a paid-edition feature, so Docmost wins only if the team accepts a paid tier.
Team needs live co-editing of the same page	Docmost	Docmost's README lists real-time collaboration as a core feature. BookStack's editing model is page-based, so choose Docmost if simultaneous editing is a daily habit rather than an occasional need.
Team migrating from Confluence exports	Docmost	Docmost's documentation lists a Confluence importer as a paid-edition feature, and its free import dialog accepts Markdown, HTML and Word DOCX. Confirm which importer your export needs and whether it works on the edition you plan to run.
Team needs SCIM user provisioning	Docmost (paid tier)	Docmost's documentation lists SCIM provisioning in paid editions, with audit logs and SIEM integration on Enterprise. BookStack's supplied facts do not list SCIM, so confirm with the vendor before assuming it is absent.
Air-gapped network or PHP hosting standard	BookStack	BookStack runs on PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6 or later, which many PHP hosting teams already operate. Docmost's compose template uses PostgreSQL, Redis and a WebSocket-capable reverse proxy, which adds services to mirror and maintain offline.
Need a free, fully open license with no paid tiers	BookStack	BookStack is MIT licensed with no paid feature gate listed in its supplied facts. Docmost's core is AGPL-3.0, but enterprise-licensed code sits in separate ee directories, so confirm which features your deployment uses.
Need page-level permissions and approval workflows	Docmost (paid tier)	Docmost lists page-level permissions and page verification with approval as paid features. BookStack offers a full role and permission system, so choose BookStack if shelf, book and role-level control is enough.

How BookStack and Docmost are built and deployed

BookStack and Docmost take different routes to the same goal: a self-hosted team knowledge base. One runs as a classic PHP application with official install scripts, the other as a containerized Node service with a real-time editing layer. The differences show up in patching, backups, reverse proxy setup and the skills your team must already have.

BookStack runs on PHP and a SQL database

BookStack requires PHP 8.2 or later with MySQL 8.0 or MariaDB 10.6 or later, and it is built on the Laravel framework. Your team needs PHP runtime and extension upkeep, plus database administration for backups and restores. Confirm which PHP version your operating system ships and whether your patch process can move it forward without breaking other applications on the same host.

Official install scripts cover Ubuntu

BookStack provides official installation scripts for Ubuntu 26.04, 24.04 and 22.04. If your standard server image is a different distribution or a hardened minimal build, you will be adapting those steps yourself. Document the exact host image you approve, because the script path is the supported path and any deviation moves the install out of the vendor's tested route.

BookStack has no official Docker images

BookStack does not publish official Docker images and points to community Docker setups such as LinuxServer.io. If your platform standard is container-first, decide whether a community image meets your image provenance, scanning and update policy before you commit. Ask who rebuilds the image when BookStack releases a security fix, and how quickly that happens.

Docmost is Docker-first with PostgreSQL and Redis

Docmost recommends Docker, and its compose template runs PostgreSQL 18 and Redis 8 images alongside the application. Your team must be comfortable operating a multi-container stack, including image pinning, volume backups and the APP_SECRET, which must be at least 32 characters. Confirm how you will rotate that secret and where it is stored, since changing it without a plan can disrupt sessions.

Docmost storage defaults to local disk

Docmost stores files locally by default, with S3-compatible or Azure Blob storage as options. Local storage means your backup scope must include the attachment volume alongside the database, and capacity planning falls on your team. If you expect large attachments or need object storage with its own retention rules, plan that storage backend before go-live rather than migrating files later.

WebSockets must reach the editor

Docmost's real-time editor needs WebSockets enabled on any reverse proxy in front of it. Load balancers, WAFs and ingress controllers that buffer or strip upgrade headers will break live editing in ways that look like intermittent faults. Test collaborative editing through your actual proxy chain during evaluation, not only on a direct connection to the container.

Why real-time editing changes the operating model

The practical difference is where collaboration happens. BookStack organizes content into books, chapters and pages grouped on shelves, and authors edit one page at a time in a WYSIWYG editor or, if they prefer, an optional Markdown editor. Docmost organizes content into spaces and adds real-time collaboration, so several people can edit the same page at once. That single feature changes what you run, not just how authors work.

The operational consequence is in the stack. Docmost's Docker template runs the application with PostgreSQL 18 and Redis 8 images, requires an APP_SECRET of at least 32 characters, and needs WebSockets enabled on any reverse proxy in front of it for the real-time editor. Your proxy, load balancer and firewall rules must pass WebSocket upgrades, and Redis becomes a service you back up, monitor and patch. BookStack, by contrast, is a classic PHP application on Laravel that needs PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later, with no persistent connection layer in front of it. Confirm the Redis and WebSocket requirements against the current Docmost installation documentation before you size the platform.

Real-time co-editing is worth that cost when teams draft the same runbooks, policies or architecture pages at the same time, or when reviewers need to comment inline while content is still changing. A classic editor is enough when pages have one owner at a time, changes go through review, and page history and comments cover your needs. Decide this with the authors who will use the tool, then test a page edited by two people through your real proxy path before you commit.

Capabilities side by side

This table compares the features that matter most for a self-hosted knowledge base, marking what each platform includes free and what sits in Docmost's paid editions. Read each row as a checklist: where a cell says to confirm, verify it against the current release and your own test instance before you commit.

Capability	BookStack	Docmost
License	MIT licensed, with all documented features in the open-source package	Core under AGPL-3.0; enterprise-licensed code in ee directories covers paid features
Core structure	Books, chapters and pages grouped on shelves	Spaces with pages, groups and permissions management
Editors and diagrams	WYSIWYG editor with optional Markdown editor and built-in diagrams.net diagrams	Real-time collaborative editing with Draw.io, Excalidraw and Mermaid diagrams included in the README feature list
Single sign-on	OIDC, SAML2 and LDAP sign-in included	Email and password, LDAP, SAML or OIDC listed as methods; SAML 2.0 or OIDC SSO and LDAP are paid-edition features, so confirm the free tier scope
Multi-factor authentication	Built-in MFA, enforceable per role	TOTP listed as an authentication method; MFA is a paid-edition feature, so confirm what the free edition offers
Role and permission model	Full role and permission system included	Page-level permissions are a paid-edition feature; base spaces and groups permissions are free, so confirm the boundary
Page history and search	Included in the core product; confirm retention and search depth in your version	Page history and search included; search inside PDF and DOCX attachments is a paid-edition feature
Import and export	Confirm supported import formats and export options in the installation documentation for your release	Markdown and HTML import, including ZIP; Confluence, DOCX and PDF importers are paid; pages and spaces export as Markdown or HTML
API access	Confirm API scope and token management for your version before relying on it	REST API with personal keys is a paid-edition feature

What is free in BookStack and what is paid in Docmost

BookStack is licensed under the MIT license, and the project's documentation and feature set are available to self-host without a paid edition. The maker, Dan Brown, develops the project with community contributors and offers paid support plans and sponsorship, so the paid relationship is a service choice rather than a feature gate. Current release v26.09.1 was published on September 29, 2026.

Full feature set: Books, chapters, pages and shelves, the WYSIWYG and optional Markdown editors, and built-in diagrams.net diagrams are part of the project itself.
Authentication: OIDC, SAML2 and LDAP sign-in, built-in multi-factor authentication enforceable per role, and the full role and permission system are included.
Paid support: Support plans and sponsorship come from the maker and are optional, so you pay for assistance rather than for capabilities.
Installation: Official installation scripts exist for Ubuntu 26.04, 24.04 and 22.04, and community Docker setups are used in place of official images.
Ongoing costs: Your own staff time, hosting and any third-party support contract are the recurring costs.

Confirm current support plan terms and any sponsorship tiers directly with the BookStack maker before budgeting.

What drives the running cost of each

Running cost for BookStack and Docmost comes from the same few places: the database and storage the platform needs, the skills your team already has, the subscription tier you pick, and the upgrade work you absorb. Most of these costs recur, so a written quote should separate one-time setup from yearly fees and staff time.

Database and storage footprint

BookStack runs on MySQL 8.0 or MariaDB 10.6 or later, with files handled by the application host. Docmost's compose template runs PostgreSQL 18 and Redis 8, stores files locally by default, and can use S3-compatible or Azure Blob storage. That means Docmost adds a cache service and an object store decision to the stack. Ask a partner to price backups for each database and the storage tier you expect to need.

Staff skills for PHP and Docker

BookStack is a PHP application built on Laravel, so patching and troubleshooting fall to staff who can manage PHP 8.2 or later and a MySQL-family database. Docmost is a Node-based stack that the team usually runs in Docker, with WebSocket handling at the reverse proxy for the real-time editor. Compare the people you already employ against these skill sets, and price training or retainer support for the gap.

Seat-based cost of paid tiers

Docmost's Community edition is free to self-host, but its paid features, including SSO with SAML 2.0 or OIDC, LDAP, SCIM provisioning and MFA, sit behind a Business plan priced at $6 per seat per month billed annually with a 10-seat minimum. That cost recurs and grows with headcount. BookStack's listed sign-in options and role-based MFA are part of its open-source release. Model the seat count for three years and ask whether SSO integration work is quoted once or each year.

Paid editions and enterprise tiers

Docmost's documentation places Bases, templates, page verification, REST API personal keys, PDF and DOCX search, and the Confluence importer in paid editions, and its Enterprise tier is custom priced. The code under its ee folders is under the Docmost Enterprise license, not AGPL-3.0. Ask any partner which features you need, which edition provides them, and whether the license terms allow your planned use before budgeting.

Upgrade cadence and release effort

BookStack published v26.09.1 on September 29, 2026, after v26.09 on September 24, 2026, so the project ships frequent point releases. Docmost tagged v0.96.0 on September 8, 2026, after v0.95.0 and v0.90.1. Each upgrade needs a tested backup, a staging run and a rollback plan, which is recurring labor whichever you choose. Ask a partner to quote upgrades and testing as a retainer or per release, and state who owns the database migrations.

Support and the quote itself

BookStack offers paid support plans and sponsorship through its creators, while Docmost sells paid editions and enterprise terms through its own pricing page. Neither route covers hosting, hardening or backups for you unless a partner scopes it. Request a fixed-scope written quote that lists one-time setup, recurring subscriptions, retainer hours, testing and the exit cost if you switch later.

Moving between BookStack and Docmost

This sequence moves a knowledge base between BookStack and Docmost with a clear inventory, a documented permission map and a verified copy of content, so the team knows what arrived intact and what still needs manual work before the old instance is retired.

Inventory shelves, books and spaces
Record every shelf, book, chapter and page in BookStack, or every space and page tree in Docmost, with its owner, last-edited date and whether it is still in use. Note attachments, embedded diagrams and pages that other pages link to. Retire stale content now so it is not migrated by default. The output is a written inventory that the migration team signs off, with a count of items per container that can be checked after import.
Map roles and groups to each permission model
BookStack grants rights through roles and shelf, book and page permissions, while Docmost uses spaces, groups and page-level permissions, with some of these controls in paid editions. Build a table that maps each BookStack role to a Docmost group and space role, and flag any page-level restriction that will not carry over one for one. Confirm which features your Docmost edition includes before you commit to the mapping. The output is an approved access matrix that the security owner reviews.
Export content from the source instance
Export pages or whole spaces from Docmost as Markdown or HTML. From BookStack, use its own export options and confirm that the export includes page content, images and attachments. Store exports in a controlled location with a checksum, since they often contain sensitive internal documentation. The output is a complete export set that matches the inventory, with any gaps logged as open items for the migration owner.
Import content and verify attachments
Import Markdown, HTML, DOCX or ZIP archives into Docmost, keeping the hierarchy as close to the original as the importer allows. Open a sample of pages from each book or space and compare text, tables, code blocks and images with the source. Check that every attachment opens and that file sizes match. Confirm which items did not transfer, such as diagram source or custom formatting. The output is a verification log showing passed and failed items per container.
Repair internal links and rebuild diagrams
Internal links often point to BookStack URLs or page IDs that no longer resolve after import, so search the migrated content for old addresses and rewrite them to Docmost paths. Rebuild diagrams that do not render from exported images, using Docmost's supported diagram tools where needed. Keep a record of the link map so editors can trace old references. The output is a link check with zero unresolved internal references in the sampled content, plus a list of diagrams rebuilt by hand.
Rebuild SSO, MFA and group mappings
Configure the identity provider connection in Docmost, using the SAML 2.0, OIDC or LDAP method your team already runs, and map directory groups to the spaces and roles from the access matrix. Ask each user to enroll in multi-factor authentication again, because enrollment does not move between systems. Test sign-in with an admin account and a standard user before anyone else is switched over. The output is a tested login path with group mappings confirmed by the identity owner.
Cut over and retire the old instance
Announce a freeze date for edits in BookStack, run a final delta export for pages changed since the first import, and point users and bookmarks to Docmost. Keep the BookStack instance read-only for a period agreed with the business owner, and archive its database and file store before shutdown. Note that page history and comment threads may not carry over in full, so confirm that retained history meets your records needs. The output is a signed cut-over record and an archived backup of the retired instance.

Where a BookStack or Docmost project usually runs long

The longest part of either project is rarely the install. For BookStack, the work is hardening the PHP and MySQL 8.0 or MariaDB 10.6 stack, choosing between the official Ubuntu installation scripts and a community Docker setup (BookStack does not publish official Docker images), and then wiring up OIDC, SAML2 or LDAP sign-in. For Docmost, the work is a PostgreSQL 18 and Redis 8 stack from its compose template, an APP_SECRET of at least 32 characters, and a decision on whether files stay on local storage or move to S3-compatible or Azure Blob storage. Plan a separate test pass for each identity method, and confirm with your own security team how sessions, MFA enforcement and secret storage will be reviewed before anyone is onboarded.

Identity mapping is where projects most often slip. Both platforms need group or claim names agreed before go-live, because role assignments, shelf and space permissions and the LDAP or SCIM group logic all depend on them. Docmost's SAML 2.0, OIDC, LDAP and SCIM options sit in the paid tiers, so the choice of identity method and whether you need automated provisioning should be settled before the build starts, not after pilot users have already been created by hand. For Docmost, the real-time editor also depends on the reverse proxy: WebSockets must be enabled, and a proxy that drops them will look like a working wiki that silently fails to sync edits. Test editing through the exact proxy you will run in production.

Content migration is the step most likely to expand. Docmost imports Markdown, HTML, DOCX, Notion and Confluence exports, but the Confluence, DOCX and PDF importers are listed as paid-edition features, so confirm your license before you plan the import. BookStack's book and chapter model means old page trees need to be mapped by hand, and both platforms need broken internal links and image references repaired after import. Budget time for cleanup of stale pages and duplicate content, and ask any services partner for a written scope that names the source systems, the page count to be reviewed and who signs off on the cutover. Backups should cover the database and file storage together, and their restore should be tested before users rely on the platform.

Questions buyers ask before choosing or hiring help

Is BookStack really free with SSO and MFA?

Yes, the BookStack software is MIT licensed, and the supplied facts list OIDC, SAML2 and LDAP sign-in plus built-in multi-factor authentication that can be enforced per role as part of the platform. Nothing in those facts describes a paid tier gating these features, so the license cost is zero. Your real costs are the server, the database, the PHP and MySQL or MariaDB operating effort, and any outside help you buy. Confirm directly with the BookStack project whether any feature you need now or later is provided only by a third party or add-on, and check your identity provider's own licensing for SAML or OIDC features.

What does Docmost cost for SSO and LDAP?

The Docmost documentation lists LDAP, SAML or OIDC single sign-on and TOTP multi-factor authentication as authentication methods, but its paid-edition feature list places SSO with SAML 2.0 or OIDC, LDAP and MFA in the paid editions. Its pricing page lists a free self-hosted Community edition, a Business plan at $6 per seat per month billed annually with a 10-seat minimum, and an Enterprise plan at custom pricing. For a 10-seat team, the Business plan minimum works out to $60 per month at list price, but confirm with Docmost whether that plan includes the SSO and LDAP features you need, and whether self-hosted Business licensing is billed the same way as the hosted version.

Can a small team run either one without outside help?

A small team with one or two people who can manage a Linux server, a database and a reverse proxy can run either platform. BookStack publishes official installation scripts for Ubuntu 26.04, 24.04 and 22.04 and points to community Docker setups, so the install path is conventional. Docmost recommends Docker with a compose template that runs PostgreSQL 18 and Redis 8, and it needs WebSockets enabled on your reverse proxy for real-time editing. The harder questions are backups, upgrades and access control, which recur. If nobody on staff owns those tasks, budget for outside help on a fixed scope.

What does the work need from our staff?

The work needs someone to own four areas: the server and container or script installation, the database, the identity integration and the content governance rules. For BookStack, that means PHP 8.2 or later and MySQL 8.0 or MariaDB 10.6 or later, plus your OIDC, SAML2 or LDAP settings. For Docmost, that means an APP_SECRET of at least 32 characters, a PostgreSQL and Redis stack, a reverse proxy with WebSockets, and a decision on local or S3-compatible or Azure Blob file storage. Ask your team which of these skills they already have before choosing.

How hard is it to move content from one to the other?

Moving from Docmost into BookStack is the harder direction, because the supplied facts describe Docmost exports as Markdown or HTML for pages or whole spaces, while BookStack's structure of books, chapters and pages on shelves must be mapped by hand or by a script. Moving into Docmost is easier on paper, since its import dialog accepts Markdown and HTML, including in a ZIP archive, Word DOCX, a Notion export ZIP and a Confluence export. Check page history, attachments, permissions and internal links during a trial import, because the supplied facts do not confirm how each tool carries them across.

Does Docmost require Redis and PostgreSQL?

Yes, for the recommended Docker installation. The Docmost installation documentation describes a compose template that runs Docmost with PostgreSQL 18 and Redis 8 images, so you should plan for both services. Docmost also needs a secret of at least 32 characters for APP_SECRET and WebSockets enabled on any reverse proxy for the real-time editor. Confirm with Docmost whether a non-Docker install changes these dependencies, and what version of each database it supports, before you commit to a host layout.

Does BookStack need a database and how is it updated?

Yes, BookStack stores its content in MySQL or MariaDB, and it requires PHP 8.2 or later along with MySQL 8.0 or MariaDB 10.6 or later. The latest supplied release is v26.09.1, published on September 29, 2026, after v26.09 on September 24, 2026. Updates are your responsibility, so schedule a test restore and a staged upgrade on a copy before you touch production. Ask your own staff, or any outside provider, to confirm the upgrade and backup steps for your environment.

When should we bring in an implementation partner?

Bring in a partner when the scope includes identity integration, a compliance evidence trail, or a migration with many spaces and permissions. DeployOpen plans, implements, integrates, hardens, backs up and documents self-hosted platforms inside your own infrastructure. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts. DeployOpen does not publish a price list, so ask for a written scope and quote, and confirm which parts of the Docmost paid features or BookStack configuration are covered.

How DeployOpen helps choose and implement a knowledge base

DeployOpen helps teams decide between BookStack and Docmost by first confirming which features, authentication methods and editions the organization actually needs, then implementing the chosen platform inside the client's own infrastructure. The work covers planning, configuration, hardening, backup and documentation, with ongoing support available as a retainer.

How we scope

Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.
The written scope lists which authentication methods, such as OIDC, SAML, LDAP or TOTP, the wiki must support on day one.
Scope also records which paid Docmost features are in or out, so licensing decisions are documented before build.

How we build

Deployment runs in the client's cloud account, data center or air-gapped network, on the chosen database and storage stack.
For Docmost, the build includes WebSocket support on the reverse proxy and the required application secret and storage settings.
Content migration, permission mapping and sign-in testing are scoped and tested against the agreed content structure.

How we hand over

Handover includes installation, configuration and permission documentation written for the client's own administrators.
Backup and restore procedures are documented and tested so recovery steps are known before go-live.
The client receives a record of editions, licenses and feature decisions to reuse in future procurement reviews.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Upgrade planning covers platform version changes and checks that authentication and permissions still behave as documented.
Ask any provider to confirm response expectations, upgrade responsibilities and what is included before signing.

BookStack vs Docmost