# Self-Hosting OpenSEO: Docker vs. Cloudflare Deployment Options Explained

> Explore OpenSEO self-hosting options: Docker for local use and Cloudflare Workers for production. Compare authentication, scalability, and complexity to choose the best fit.

- Repository: [Every App/open-seo](https://github.com/every-app/open-seo)
- Tags: comparison
- Published: 2026-08-09

---

**OpenSEO offers two self-hosting options—Docker for local sandboxing and Cloudflare Workers for production edge deployment—differing in authentication, scalability, database architecture, and operational complexity.**

Both paths let you run the full Next.js/TanStack application on your own infrastructure without relying on managed SaaS. Choosing between them depends on whether you need a private development instance or a globally available, team-ready service with automatic backups.

## Docker Self-Hosting: Local Container Deployment

The **Docker option** packages OpenSEO into a containerized stack that's ideal for personal experimentation, development, or isolated single-user deployments.

### Architecture and Runtime

In [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh), the container initializes with environment-based configuration, including telemetry controls. The full application—Next.js frontend, TanStack server functions, and SQLite database—runs inside a single container on your host machine.

### Authentication Model

Docker deployments use `AUTH_MODE=local_noauth` as documented in [`web/content/docs/self-hosting/docker.md`](https://github.com/every-app/open-seo/blob/main/web/content/docs/self-hosting/docker.md). This creates a built-in admin user (`admin@localhost`) with no authentication checks. You must secure the container yourself using:

- A reverse proxy (nginx, Traefik)
- A private network or VPN
- Cloudflare Tunnel or similar

### Configuration and Secrets

Environment variables live in a standard `.env` file. Required variables include:

- `DATAFORSEO_API_KEY` — for SEO data access
- `OPENSEO_TELEMETRY_DISABLED=1` — to disable telemetry (defaults enabled)

The [`docker-entrypoint.sh`](https://github.com/every-app/open-seo/blob/main/docker-entrypoint.sh) script at line 10 processes these settings during container startup.

### Quick Start with Docker Compose

```yaml

# compose.yaml

services:
  openseo:
    image: ghcr.io/every-app/open-seo:latest
    env_file: .env
    ports:
      - "3000:3000"
    restart: unless-stopped

```

Deploy with:

```bash
docker compose up -d

```

### Database and Scalability

SQLite is bundled with the container—sufficient for low-traffic, single-node workloads. Scaling requires manual orchestration: multiple containers behind a load balancer with shared storage or external database migration.

## Cloudflare Self-Hosting: Edge Worker Deployment

The **Cloudflare option** transforms OpenSEO into a distributed edge application, suitable for production use with team access and global availability.

### Architecture and Runtime

OpenSEO compiles to Cloudflare Workers using Wrangler. Core logic executes at the edge across Cloudflare's global network, with static assets served from the nearest data center. This is implemented in the repository's Wrangler configuration and edge adapter code.

### Authentication Model

**Cloudflare Access** provides authentication automatically—no additional configuration needed. Identity-based access is enforced at the network edge before requests reach your application. This eliminates the security burden that Docker places on operators.

### Configuration and Secrets

Secrets are managed two ways:

- `.env.selfhost` file for local Wrangler development
- Cloudflare Dashboard under **Settings → Variables & Secrets** for production

Both telemetry disable options work:

- `OPENSEO_TELEMETRY_DISABLED=1`
- `DO_NOT_TRACK=1`

### Quick Start with Wrangler

```bash

# .env.selfhost

DATAFORSEO_API_KEY=your_key_here
OPENSEO_TELEMETRY_DISABLED=1

# Deploy to edge

wrangler deploy

```

### Database and Scalability

**Cloudflare D1** (or KV) provides managed, automatically backed-up storage that persists across deployments. This architecture delivers:

- Automatic global distribution without configuration
- High availability through Cloudflare's infrastructure
- Zero-downtime deployments via atomic Worker updates

## Key Differences Between OpenSEO Self-Hosting Options

| Factor | Docker (Local) | Cloudflare (Edge) |
|--------|---------------|-------------------|
| **Best for** | Personal sandbox, development | Production, team access, public services |
| **Setup steps** | `docker compose up` | Wrangler install, account config, `wrangler deploy` |
| **Authentication** | None built-in (`local_noauth`) | Cloudflare Access (automatic) |
| **Database** | Container SQLite | Cloudflare D1/KV (managed, backed up) |
| **Scaling** | Manual container orchestration | Automatic edge distribution |
| **Configuration file** | `.env` | `.env.selfhost` + Cloudflare Dashboard |
| **Telemetry control** | `OPENSEO_TELEMETRY_DISABLED=1` | `OPENSEO_TELEMETRY_DISABLED=1` or `DO_NOT_TRACK=1` |
| **Documentation** | [`docs/SELF_HOSTING_DOCKER.md`](https://github.com/every-app/open-seo/blob/main/docs/SELF_HOSTING_DOCKER.md) | [`docs/SELF_HOSTING_CLOUDFLARE.md`](https://github.com/every-app/open-seo/blob/main/docs/SELF_HOSTING_CLOUDFLARE.md) |

## When to Choose Each OpenSEO Self-Hosting Option

**Choose Docker when:**
- You want a private, offline-capable instance
- You're developing or testing features locally
- You prefer minimal infrastructure and accept responsibility for security
- You need to customize the runtime environment heavily

**Choose Cloudflare when:**
- Your instance must be internet-accessible from multiple locations
- You want automatic backups without operational overhead
- Team members need shared access with managed identity
- You prioritize global performance and automatic scaling

## Summary

- **Docker** runs the complete OpenSEO stack—Next.js, TanStack, and SQLite—in a single container with no built-in authentication, best for local development referenced in [`web/content/docs/self-hosting/docker.md`](https://github.com/every-app/open-seo/blob/main/web/content/docs/self-hosting/docker.md).

- **Cloudflare** deploys OpenSEO as edge Workers with automatic authentication, managed D1 databases, and global distribution, configured via `wrangler deploy` per [`docs/SELF_HOSTING_CLOUDFLARE.md`](https://github.com/every-app/open-seo/blob/main/docs/SELF_HOSTING_CLOUDFLARE.md).

- Both options support telemetry opt-out through `OPENSEO_TELEMETRY_DISABLED=1`, set in `.env` for Docker or `.env.selfhost`/Dashboard for Cloudflare.

- Docker requires manual security hardening; Cloudflare provides identity gating through Cloudflare Access out of the box.

## Frequently Asked Questions

### Can I migrate from Docker to Cloudflare later?

Yes. Both deployments use the same core application code. You'll need to export your SQLite database and import it into Cloudflare D1, then reconfigure environment variables in the Cloudflare Dashboard. The data schema is compatible.

### Is authentication mandatory for the Docker option?

No—Docker uses `AUTH_MODE=local_noauth` by default, creating an automatic admin user. This is convenient for local testing but requires you to implement external protection for any exposed deployment. The Docker documentation explicitly warns about this in [`web/content/docs/self-hosting/docker.md`](https://github.com/every-app/open-seo/blob/main/web/content/docs/self-hosting/docker.md).

### Does Cloudflare self-hosting cost money?

Cloudflare Workers, D1, and Access have generous free tiers. Small-team deployments typically run within free limits. Higher-traffic or multi-user instances may incur charges based on request volume, database operations, and seat licenses for Cloudflare Access.

### Which option has better performance?

Cloudflare delivers lower latency for globally distributed users through edge execution. Docker performs well for single-region access on capable hardware but requires manual scaling and geographic distribution to match Cloudflare's network coverage.