> ## Documentation Index
> Fetch the complete documentation index at: https://help.plannotator.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Self-Host Plannotator Workspaces

> Compare the supported container and Cloudflare deployment options for self-hosted Workspaces.

A self-hosted Workspaces instance has one organization and runs on systems you
control. Choose the container if you manage Docker and local block storage.
Choose Cloudflare if you want Cloudflare to run the Workers and data services.

|                    | Container                           | Cloudflare                                        |
| ------------------ | ----------------------------------- | ------------------------------------------------- |
| Runtime            | One Node container                  | Two required Workers                              |
| Human sign-in      | Your OIDC provider                  | Cloudflare Access                                 |
| Durable data       | One local block-storage volume      | D1, Durable Objects, R2, and Artifacts            |
| Raw files          | Served by the container             | Served by a separate usercontent Worker           |
| Backup             | Back up the full data volume        | Export D1, clone Git history, and copy R2 objects |
| Runtime management | You run one process per data volume | Cloudflare runs the Workers                       |

Both options include the browser app, API, MCP, read-only Git, live editing,
comments, versions, artifacts, and Workspaces API keys.

## What one organization means

Every person who signs in joins the instance organization as a member. Manage
who can sign in through your OIDC provider or Cloudflare Access policy.
Self-hosted Workspaces does not provide the hosted **New team**, invite, role,
or billing controls.

Removing a person's sign-in access does not revoke their Workspaces API keys.
Ask each key owner to revoke their keys under **Settings** > **API keys** first.

## Choose the container

Use the container when you can provide:

* a Docker host;
* one writable local block-storage volume;
* an HTTPS app origin; and
* an OpenID Connect provider.

The container is single-node. Do not place its data directory on NFS, SMB,
EFS, or another shared network filesystem.

<CardGroup cols={2}>
  <Card title="Install the container" icon="box" href="/workspaces/self-hosting/container/install" arrow="true">
    Pull the release image, attach durable storage, and verify the first boot.
  </Card>

  <Card title="Configure the container" icon="gear" href="/workspaces/self-hosting/container/configure" arrow="true">
    Set OIDC, origins, secrets, storage, and the first API key.
  </Card>
</CardGroup>

## Choose Cloudflare

Use the Cloudflare option when your account has Workers, D1, KV, R2,
Artifacts, Durable Objects, and Zero Trust. One app Worker serves an
Access-protected browser origin and a public API-key origin. A public,
cookieless usercontent Worker serves raw links.

Do not put the usercontent origin behind Access. A raw link is the file access
credential. Requiring Access on that origin breaks **Copy raw link**.

<CardGroup cols={2}>
  <Card title="Deploy on Cloudflare" icon="cloud" href="/workspaces/self-hosting/cloudflare/deploy" arrow="true">
    Create the shared resources and deploy both Workers.
  </Card>

  <Card title="Configure Cloudflare Access" icon="shield" href="/workspaces/self-hosting/cloudflare/configure-access" arrow="true">
    Protect the app origin and verify human sign-in.
  </Card>
</CardGroup>

## Billing, telemetry, and error reporting

Hosted plans, trials, seats, and Stripe billing do not run in a self-hosted
instance. The container sends no product telemetry. Cloudflare self-host records
no product telemetry unless you add a `TELEMETRY` dataset binding in your own
account. Neither option reports product telemetry to Plannotator.

The container sends no browser error reports unless you configure your own
Sentry project.

*Reviewed July 22, 2026. Maintained by the Plannotator documentation team.*