[IxDay]

Merge with the Lago release that ships getlago/lago#852, not before. Until then, getlago/lago:latest is still the old image, and the chown and PDF instructions do not apply to it.

Why

getlago/lago#852 rebuilds the all-in-one image (getlago/lago) on hardened Wolfi bases. For people who run it:

• It runs as a nonroot user (uid 65532).
• PostgreSQL 18 and Valkey replace PostgreSQL 17 and Redis.
• The database, the job queue and uploaded files now live in /data. Before, they stayed in the container and a recreate lost them.
• The image no longer starts lago-pdf through a mounted /var/run/docker.sock.
• A /data volume from an earlier image is root-owned, and the new image stops until it is chowned once.

The "one-click Docker command" on guide/lago-self-hosted/docker.mdx is the only page that documents this image.

What

In "Run the app with a one-click Docker command":

• -v lago_data:/data in the command.
• One paragraph on what the image runs, and that it is for testing and staging (same wording as docker/README.md in getlago/lago).
• "Generate PDFs": run ghcr.io/getlago/lago-gotenberg:8.39 (the image of the compose pdf service) next to it, with --add-host=host.docker.internal:host-gateway.
• "Upgrade from an earlier image": the one-time chown in a <Warning>.

Verification

• The chown command, and the start on an old root-owned volume, were tested on the new image (details in feat(docker): build the all-in-one image on the Wolfi/apko hardened bases lago#852).
• The PDF networking was tested locally: from a container started with --add-host=host.docker.internal:host-gateway, http://host.docker.internal:3001/health on lago-gotenberg:8.39 returns 200.
• Not checked: the Mintlify preview rendering.

🤖 Generated with Claude Code

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
lago-docs	🟢 Ready	View Preview	Nov 5, 2026, 1:35 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[michaelponrajah]

Changelog triage — changelog-worthy

This documents changed product behaviour for self-hosted users: a new hardened all-in-one image (Wolfi base, nonroot user), PostgreSQL 18 + Valkey replacing PostgreSQL 17 + Redis, persistent /data (previously lost on recreate), a changed PDF-generation path (no more mounted /var/run/docker.sock), and a required one-time chown migration for existing /data volumes. That's new/changed availability and behaviour, not a quality sweep — a changelog entry is in scope.

A writing run would use:

• This PR (docs(self-hosted): document the hardened all-in-one image #778) and its description.
• getlago/lago#852, the PR that rebuilds the all-in-one image — needed to verify the shipped specifics (exact tags, defaults) since the shipped code outranks this PR's prose.
• docker/README.md in getlago/lago, referenced here as the source of the "testing and staging" wording.

Flagging as thin: this PR's own note says "merge with the Lago release that ships getlago/lago#852, not before." That release isn't confirmed shipped yet — the changelog entry should not be written/published until it is (announcing unreleased work is out of scope for this skill). A writing run should also pull the actual merged PR for getlago/lago#852 plus its tag/version once available, not just this doc description.

Reply here or invoke the lago-changelog-writer skill once the image has shipped to get a draft entry.

---

Generated by Claude Code