Mealie

Overview

Mealie is a self-hosted recipe manager for households and small groups. Save recipes by importing a URL or writing them yourself, organize them into cookbooks, plan meals, and build a shared shopping list. This recipe runs Mealie’s official container with SQLite and keeps its database, images, and uploaded files together in one persistent volume. It suits a home kitchen; the recipe does not include PostgreSQL, email, or AI providers.

Security assessment

The recipe keeps the web port on 127.0.0.1, disables open signup, and runs without privileged mode, host networking, or Docker socket access. The only container volume holds both the SQLite database and uploaded data; include it in off-server backups and protect those archives.

Mealie documents the initial login (changeme@example.com / MyPassword). It must be changed over loopback before the service becomes reachable to other users. URL imports fetch pages from the server and can expose internal services to trusted users who can trigger imports, so keep access limited and isolate the container where practical. When using a reverse proxy, Mealie’s default HOST_IP=* trusts forwarded headers from any connecting source; restrict it to the proxy address or network and block direct untrusted access.

The configuration has not yet had an image vulnerability scan; the stored scan status remains unknown.

Step-by-step guide

Requirements

Use a 64-bit Ubuntu 22.04+ or Debian 12+ server with Docker Engine and Compose v2.24+. The official image supports amd64 and arm64; 32-bit ARM is unsupported. Plan for at least 1 CPU core, 1 GB RAM, and 5 GB free disk for the app and recipe images. More storage is needed as you upload photographs.

Prepare the recipe

mkdir -p ~/services/mealie
cd ~/services/mealie
# Copy compose.yaml, .env.example, backup.sh, restore.sh, and proxy/ here.
cp .env.example .env
chmod 600 .env

Edit .env before the first start:

• MEALIE_VERSION is the pinned upstream release; review release notes before changing it.
• MEALIE_PORT is the host port, default 9925. Compose binds it to 127.0.0.1.
• MEALIE_BASE_URL is the address used in links and callbacks. Set the public HTTPS URL when using a domain.
• PUID and PGID set the ownership IDs used for files in the data volume.
• TZ sets the server time zone.
• MEALIE_DEFAULT_LOCALE sets the initial interface language to en or ru.
• MEALIE_DATA_VOLUME names the volume containing the SQLite database, recipe images, and other app data.

Start and sign in

docker compose config --quiet
docker compose pull
docker compose up -d --wait --wait-timeout 300
docker compose ps
curl --fail http://127.0.0.1:9925/api/app/about

Open http://127.0.0.1:9925 on the server and sign in with the initial account (changeme@example.com / MyPassword). Change this published default password immediately in account settings before making the service reachable to anyone else. Signup is disabled in this recipe. Invite household members from Mealie rather than enabling open signup.

VPS

Keep the host port on loopback. Point a domain to the server, configure one of the HTTPS proxy examples below on the host, allow SSH/HTTP/HTTPS through the firewall, and keep port 9925 private. First sign in over loopback and replace the published initial password; only then make the domain reachable. Set MEALIE_BASE_URL to the public HTTPS URL before first start so generated links and authentication callbacks use the right address. Recipe imports require outbound internet access.

Trusted local network

For one-off access, use an SSH tunnel:

ssh -L 9925:127.0.0.1:9925 user@server

Then open http://localhost:9925. To share it on a LAN, place Mealie behind a trusted HTTPS proxy or change the published bind to one specific private IP and restrict access with a firewall. Do not expose the application directly to the public internet over plain HTTP.

Domain and HTTPS

Set MEALIE_BASE_URL=https://recipes.example.com, point DNS at the proxy, and use the matching Caddy, Nginx, or Traefik example in proxy/. Keep the upstream connection on loopback. For Nginx, the sample permits uploads up to 20 MB; increase that deliberately if you need larger recipe photos.

Backup

The persistent volume contains the database and uploaded files. Stop Mealie while archiving it so SQLite and files form a consistent snapshot:

./backup.sh

The archive is written to backups/ beside the recipe. It may contain private recipes and household information. Protect it like personal data and copy it off the server. Also preserve .env separately in a secure location; the initial admin credentials and public URL are needed to operate the restored installation.

Restore

Restore replaces the current data volume. The script first makes a safety backup of the current state:

./restore.sh ./backups/mealie-YYYYMMDDTHHMMSSZ.tar.gz

Then check the service and sign in:

docker compose up -d --wait --wait-timeout 300
curl --fail http://127.0.0.1:9925/api/app/about
docker compose logs --tail=100 mealie

The smoke test exercises this backup and restore path on amd64. Keep the image version and .env compatible with the archive.

Update

Read Mealie’s release notes and create an off-server backup before an upgrade. Change MEALIE_VERSION to the exact reviewed tag in .env, then:

./backup.sh
docker compose pull
docker compose up -d --wait --wait-timeout 300
docker compose logs --tail=100 mealie

Do not use latest. Database migrations happen on startup; allow the healthcheck to pass before using the app.

Rollback

Do not start an older version against data migrated by a newer release. Set MEALIE_VERSION back to the previous tag and restore the archive made before the upgrade:

docker compose down
./restore.sh ./backups/mealie-BEFORE-UPDATE.tar.gz
docker compose up -d --wait --wait-timeout 300

Stop and remove

Stop the service while retaining its data:

docker compose down

To remove the app and its data permanently, first verify an off-server backup, then:

docker compose down --volumes
rm -rf ~/services/mealie

This deletes recipes, accounts, meal plans, shopping lists, and uploaded images.

Security notes

Mealie’s URL import feature makes outbound requests from the server. Give access only to trusted users, and keep the app isolated from sensitive internal services where practical. The initial account has a password published in upstream documentation; change it before allowing access beyond loopback. Disabling signup does not make shared accounts safe: invite household members and use unique passwords. The official default HOST_IP=* trusts forwarded headers from every connecting source. Restrict it to the proxy address or network when a proxy is used; only that proxy should be able to reach the app.

Sources: SQLite installation, security considerations, backups and restore, and release v3.29.0.

Report a recipe problem

Tell us how it went on your server

Opens a prefilled GitHub issue. A GitHub account is required; submitting the issue makes it public.

Troubleshooting

The page does not open

Check that the container is healthy and that the host port is free:

docker compose ps
docker compose logs --tail=100 mealie
curl --fail http://127.0.0.1:9925/api/app/about

The default port is bound to loopback. For a remote server, use the HTTPS reverse proxy or an SSH tunnel instead of opening the port publicly.

Login does not work

The .env values MEALIE_ADMIN_EMAIL and MEALIE_ADMIN_PASSWORD seed the initial account only. Editing them after the database has been initialized does not change the account password. Reset it from Mealie’s administration UI or follow the official recovery instructions.

Images or changes disappear after an update

Confirm that the mealie-data volume is mounted at /app/data and that .env names the expected volume. Do not run docker compose down --volumes; that deletes the database and uploads.

Imports fail

Recipe imports make outbound HTTP requests from the Mealie container. Check DNS and outbound HTTPS access. Imports can fail when a website blocks automated requests; the page can still be entered manually. Limit instance access because user-triggered URL imports cause Mealie’s server to fetch external pages.

An upgrade fails

Read the release notes before changing MEALIE_VERSION. Restore the pre-upgrade archive with the matching previous image tag, and inspect:

docker compose logs --tail=200 mealie