Penpot local install for teams

Confirm the host prerequisites

Use a Linux x86_64 host with Docker Engine and Docker Compose v2. The server archive includes application images, but Docker itself, a firewall, DNS, and an HTTPS reverse proxy remain administrator responsibilities.

docker compose version

Download, verify, and unpack

Download the server archive and checksum list, compare the SHA-256 value, then extract the archive.

curl -fLO https://easypenpot.com/downloads/easy-penpot-team-server-0.2.0-linux-amd64-offline.tar.gz
curl -fLO https://easypenpot.com/downloads/SHA256SUMS
shasum -a 256 easy-penpot-team-server-0.2.0-linux-amd64-offline.tar.gz
grep easy-penpot-team-server-0.2.0-linux-amd64-offline.tar.gz SHA256SUMS
tar -xzf easy-penpot-team-server-0.2.0-linux-amd64-offline.tar.gz
cd easy-penpot-team-server-0.2.0-linux-amd64-offline

Install and load the bundled images

The installer writes to /opt/easy-penpot-team and adds the easy-penpot-team command. The image import is local and does not pull from a container registry.

sudo ./install.sh
cd /opt/easy-penpot-team
easy-penpot-team config
easy-penpot-team import-images
easy-penpot-team verify-offline

Load secrets and start

Generate unique values once and store them in a secrets manager. The same values are needed on later restarts and are never written into the package.

export PENPOT_SECRET_KEY="$(openssl rand -hex 32)"
export POSTGRES_PASSWORD="$(openssl rand -base64 32)"
export VALKEY_PASSWORD="$(openssl rand -base64 32)"
easy-penpot-team up
easy-penpot-team health

Publish the team address

Set the public HTTPS workspace address after DNS, TLS, and firewall rules are ready. Desktop clients enter this address on their first launch.

export PENPOT_BIND_ADDRESS=0.0.0.0
export PENPOT_PUBLIC_URI=https://penpot.example.com/
easy-penpot-team up

Unpack the native app

Download the ZIP in Finder or Safari, then double-click it to reveal Easy Penpot Team.app. The package includes the Electron and Chromium runtime for M2, M3, and M4 Macs.

Move it to Applications

Move Easy Penpot Team.app to Applications and open it. The app is unsigned, so Control-click and choose Open if macOS blocks the first launch.

Enter the team workspace

On first launch, enter the HTTPS address supplied by the Team Server administrator. Use the Workspace settings menu item later to change the saved address.

Extract the ZIP

Right-click the downloaded ZIP, choose Extract All, and open the extracted Windows 10/11 x64 package.

Run the per-user installer

Double-click install.cmd. It copies the native client into LocalAppData and creates Desktop and Start Menu commands without installing Docker or a database.

Enter the team workspace

Open Easy Penpot Team and enter the administrator-provided HTTPS address. This package uses the current Electron runtime and is unsigned.

Use only for the legacy Windows versions

This client exists for Windows 7, 8, and 8.1. Electron 22 is the final Electron major supporting those operating systems and no longer receives security fixes for them. Use the Windows 10/11 package whenever the device supports it.

Extract and run the per-user installer

Right-click the downloaded ZIP, choose Extract All, then double-click install.cmd. It copies the native client into LocalAppData and creates Desktop and Start Menu commands without installing Docker or a database.

Enter the team workspace

Open Easy Penpot Team and enter the administrator-provided HTTPS address. Keep this legacy device on a restricted private network and apply the normal Windows hardening controls.

Install desktop libraries

Most desktop installations already have the needed libraries. Install them if the native app does not start.

sudo apt-get update
sudo apt-get install -y libgtk-3-0 libnss3 libasound2

Extract and install

Run the included installer as your normal user. It installs a native Electron application and a desktop entry.

tar -xzf easy-penpot-team-client-0.2.0-linux-ubuntu-x64.tar.gz
cd easy-penpot-team-client-0.2.0-linux-ubuntu-x64
./install.sh
$HOME/.local/bin/easy-penpot-team

Enter the team workspace

Enter the HTTPS team address at first launch. The setting stays in the desktop client's user profile.

Install desktop libraries

Install GTK, NSS, and ALSA libraries before opening the native client when they are not already available.

sudo dnf install -y gtk3 nss alsa-lib

Extract and install

Run the installer as your normal user. It adds an Electron application and a desktop entry.

tar -xzf easy-penpot-team-client-0.2.0-linux-centos-x64.tar.gz
cd easy-penpot-team-client-0.2.0-linux-centos-x64
./install.sh
$HOME/.local/bin/easy-penpot-team

Enter the team workspace

Enter the administrator-provided HTTPS address at first launch.

Install desktop libraries

Ask the system administrator to install the normal GTK, NSS, and ALSA desktop dependencies when required.

sudo dnf install -y gtk3 nss alsa-lib

Extract and install

Run the installer as your normal user. No Docker Engine, database, or browser shortcut is involved.

tar -xzf easy-penpot-team-client-0.2.0-linux-rhel-x64.tar.gz
cd easy-penpot-team-client-0.2.0-linux-rhel-x64
./install.sh
$HOME/.local/bin/easy-penpot-team

Enter the team workspace

Enter the HTTPS team address at first launch.

Download the profile in Safari

Open the Mobileconfig link on the iPhone or iPad and allow the profile download. It creates a removable Easy Penpot Team Web Clip.

Install from Settings

Open Settings, choose Profile Downloaded, select Easy Penpot Team Client, then choose Install and enter the device passcode. On older iOS versions, use Settings > General > VPN & Device Management.

Enter the team workspace

Open the new Home Screen icon and enter the HTTPS address supplied by the administrator. This is an installable Web Clip, not a signed native IPA; a native iOS app requires an Apple Developer signing identity.