What draften needs on your own server, what it has been tried on and where it connects. The installation procedure itself is in Installing, step by step.
Server
| Requirement | |
|---|---|
| Processor | x86-64. We do not build images for ARM (arm64) today; we will build them once a customer needs them. |
| Memory | 4 GB. The web runs in two copies so that updates cause no outage. |
| Disk | 20 GB — images, two bundles side by side during an update, the database and backups. Large mailboxes need more. |
| Machine | virtual or physical, it does not matter. |
Operating system and Docker
- Linux, any distribution with Docker Engine 24 or newer and the compose v2 plugin (the
docker composecommand). The old standalonedocker-compose(v1) is not enough. - Tried on Ubuntu Server, with Docker 28 and compose 2.40 and 5.
- Docker Desktop (Windows, macOS) works, but only for trying draften out. For real use we recommend a Linux server.
- Podman is not supported — the updater needs a Docker-compatible socket and
docker compose. - Synology and other NAS devices with Docker: the installation script is written to work there, but it has not yet run on a real NAS.
- The tools
tar,base64andsha256sum(orshasum), which nearly every system has. - Commands are run by root or a user in the
dockergroup. With HTTPS right in draften, the installation directory is closed to other users, so usesudo.
Network: what must be reachable from outside
It depends on where HTTPS ends:
- HTTPS ends in draften — draften listens on ports 443 and 80 (80 only redirects to HTTPS).
- HTTPS ends in front of draften (a reverse proxy, a tunnel) — draften listens only on
127.0.0.1:8085and cannot be seen from outside at all. When the proxy runs on another machine, open port 8085 for the proxy only.
The database has no port.
Network: where draften connects
The installation itself needs no internet — the bundle carries all the images and nothing is downloaded from Docker Hub or anywhere else. While running, draften connects only where you send it:
| What for | Addresses (port 443; IMAP and SMTP as your server has them) |
|---|---|
| Microsoft 365 | login.microsoftonline.com, graph.microsoft.com |
| Google Workspace | accounts.google.com, oauth2.googleapis.com, openidconnect.googleapis.com, www.googleapis.com, gmail.googleapis.com |
| other mailboxes | your IMAP server |
| language models | api.anthropic.com, api.openai.com, or the address of your OpenAI-compatible server — depending on the keys you enter |
| outgoing mail (invitations, password links) | your SMTP server, or api.brevo.com |
| CRM connections | api.hubapi.com (HubSpot), app.raynet.cz (Raynet), api.flowii.com (FLOWii) |
| updater: new releases | download.draften.ai — the list of releases once a day, the bundle download during an update (about 500 MB); only with an uploaded licence |
No telemetry and no error reports reach us from your own installation.
Whoever publishes draften through a Cloudflare Tunnel also needs a connection to Cloudflare as its documentation describes, and the cloudflared image, which Docker downloads from Docker Hub — it is not in the bundle.
Mail and models
- Mail systems: Microsoft 365 (Exchange Online), Google Workspace and other mailboxes over IMAP. See Microsoft 365, Google Workspace and Mail access.
- Language models: Anthropic, OpenAI and an OpenAI-compatible server, such as a local model. See Model API keys.
HTTPS
The interface must be reachable over HTTPS. The three options — a certificate right in draften, your reverse proxy, or a Cloudflare Tunnel — are described in the HTTPS step of Installing, step by step. You obtain the certificate yourself (from a certificate authority or with an ACME client).