Penpot

License	FOSS problems	Maintenance	SSO	Users	Tested
MPL-2.0Copyleft license. Only the covered files must stay open — surrounding proprietary code in separate files is permitted.	—	Active	❌	Unlimited	✅

Description

Penpot is a browser-based vector design tool — the FOSS alternative to Figma and Canva. Collaborative, real-time, and fully open source. No feature limits and no cloud dependency.

Features

• Real-time collaborative editing — works out of the box, not a bolted-on add-on.
• Design fundamentals — layouts, components, and prototyping covering most practical design needs.
• Browser-based — nothing to install; runs entirely in the browser.

Usage patterns

• Self-hosted Figma/Canva replacement — a credible replacement for teams that want to keep design work self-hosted rather than dependent on a SaaS design tool.
• No role management — there's no admin panel in the self-hosted version; all users are equal, with no way to distinguish an admin from anyone else.
• Registration must be disabled manually — new user registration stays open by default and has to be turned off via feature flags after initial setup, which is easy to miss.

License and governance

MPL-2.0 — weak copyleft, fully open source, no feature limits gated behind a paid tier.

Conclusion

Why you would — a credible, fully self-hosted alternative to Figma or Canva, with real-time collaboration and no cloud dependency, covering most practical design needs out of the box.

Why you wouldn't — no admin panel or role management in the self-hosted version, and closing off new registrations is a manual, easy-to-miss step rather than a default. Needs hands-on testing before recommending to a broader team — the workflow differences from Figma or Canva take some adjustment.

Setup

1. Add DNS records pointing design.<domain> to the server:

   • A record: design → <ipv4>
   • AAAA record: design → <ipv6>

2. In Coolify, go to New Resource → Service, search for Penpot. Configure SMTP on the Penpot Backend container before deploying:

   Variable	Value
   PENPOT_SMTP_DEFAULT_FROM	{{team.DEFAULT_SMTP_FROM}}
   PENPOT_SMTP_DEFAULT_REPLY_TO	{{team.DEFAULT_SMTP_FROM}}
   PENPOT_SMTP_HOST	{{team.DEFAULT_SMTP_HOST}}
   PENPOT_SMTP_PORT	{{team.DEFAULT_SMTP_PORT}}
   PENPOT_SMTP_TLS	true
   PENPOT_SMTP_SSL	false
   PENPOT_SMTP_USERNAME	{{team.DEFAULT_SMTP_USERNAME}}
   PENPOT_SMTP_PASSWORD	{{team.DEFAULT_SMTP_PASSWORD}}

   Also set on the Penpot Backend container:

   Variable	Value
   PENPOT_PUBLIC_URI	https://design.<domain> — override the default $SERVICE_URL_FRONTEND_8080 or email links will contain the internal port

3. Set the domain on the Frontend container.

4. Deploy.

5. Register the first account. Note: there is no admin role in self-hosted Penpot — all users are equal.

6. After registering, disable new signups by adding disable-registration to PENPOT_FLAGS on both the Frontend and Backend containers, then redeploy.