ArchiveBox

Self-hosted web archiving platform. ArchiveBox captures websites in multiple formats simultaneously — HTML, PDF, screenshot, WARC, media extraction, git clone — using a built-in Chromium headless browser. All archived content is stored on a persistent volume, with SQLite by default or optional external PostgreSQL for metadata.

Key Features

• Multi-format archiving — HTML, PDF, screenshot, WARC, media, git clone in one pass
• Chromium headless — full JavaScript rendering with /dev/shm tmpfs for stability
• SQLite or PostgreSQL — embedded SQLite or an existing PostgreSQL service
• Access control — public index/add controls and upstream UI snapshot permissions
• Upstream privilege drop — starts as root, detects collection ownership, then drops privileges
• S3 backup — /data archives with Secret credentials or workload identity
• Persistent storage — one PVC for archived content and SQLite when selected

Architecture and boundaries

One Recreate Deployment owns the complete /data dataset: SQLite, indexes, configuration, and captured artifacts. The optional backup CronJob reads that same claim and uploads a volume archive to S3-compatible storage. Never run two writers against the claim, even when the StorageClass supports ReadWriteMany.

The chart owns Kubernetes workload, storage, routing, credentials, and optional backup resources. TLS policy, capture-egress controls, malicious-content isolation, storage lifecycle, off-cluster retention, and monitoring remain platform responsibilities. Review the complete design for the Mermaid topology, security and observability boundaries, gaps, and explicit non-goals.

Installation

HTTPS repository:

helm repo add helmforge https://repo.helmforge.dev
helm repo update
helm install archivebox helmforge/archivebox -f values.yaml

OCI registry:

helm install archivebox oci://ghcr.io/helmforgedev/helm/archivebox -f values.yaml

Deployment Examples

# values.yaml — Basic ArchiveBox with Traefik ingress
archivebox:
  adminUsername: admin
  adminPassword: 'my-secure-password'

persistence:
  enabled: true
  size: 100Gi

ingress:
  enabled: true
  ingressClassName: traefik
  annotations:
    cert-manager.io/cluster-issuer: letsencrypt-prod
  hosts:
    - host: archive.example.com
      paths:
        - path: /
          pathType: Prefix
  tls:
    - secretName: archivebox-tls
      hosts:
        - archive.example.com

# values.yaml — Private instance (no public access)
# Recommended for internet-facing deployments
archivebox:
  adminUsername: admin
  adminPassword: 'my-secure-password'
  allowedHosts: 'archive.example.com'
  publicIndex: 'False'
  publicAddLinks: 'False'
  serverSecurityMode: safe-onedomain-nojsreplay

persistence:
  enabled: true
  size: 100Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: archive.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Production setup with explicit resource limits
# Chromium requires at least 2Gi RAM to archive pages reliably
archivebox:
  adminUsername: admin
  adminPassword: 'my-secure-password'
  timeout: '120'
  mediaMaxSize: '1g'

resources:
  requests:
    cpu: 500m
    memory: 2Gi
  limits:
    cpu: 2000m
    memory: 4Gi

persistence:
  enabled: true
  size: 200Gi

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: archive.example.com
      paths:
        - path: /
          pathType: Prefix

# values.yaml — Daily S3 backup of the full /data directory
# Backup includes both the SQLite database and all archived files.
archivebox:
  adminUsername: admin
  adminPassword: 'my-secure-password'

persistence:
  enabled: true
  size: 100Gi

backup:
  enabled: true
  schedule: '0 3 * * *'
  s3:
    endpoint: https://s3.amazonaws.com
    bucket: my-archivebox-backups
    prefix: daily
    existingSecret: archivebox-s3

ingress:
  enabled: true
  ingressClassName: traefik
  hosts:
    - host: archive.example.com
      paths:
        - path: /
          pathType: Prefix

Configuration Reference

Security Scan

Kubescape scan for the chart standards backfill:

Production hardening should include explicit CPU and memory limits, restricted namespace network policy where required, and existing Secrets for admin and S3 credentials.

Core

Image

ArchiveBox Configuration

When the chart manages the admin Secret, it retains that Secret on Helm uninstall and reuses its generated password on upgrade. Set archivebox.existingSecret when credential lifecycle must remain entirely outside Helm.

External PostgreSQL

The chart waits for an authenticated PostgreSQL SELECT 1 before starting ArchiveBox. /data still stores captures and configuration. Migrate existing SQLite data before enabling this option.

Persistence

The PVC stores the entire /data directory: SQLite database, all archived files (HTML, PDFs, screenshots, WARCs, media), and ArchiveBox configuration. Size it generously — archived pages with media can consume gigabytes quickly. Chart-created claims carry helm.sh/resource-policy: keep, so helm uninstall retains the dataset. Namespace deletion and storage-provider retention policy can still remove it; use an existing claim when lifecycle must remain fully outside Helm.

Backup

The S3 backup archives /data. With SQLite, that includes the database and archived files. With external PostgreSQL, the CronJob does not dump the database; retain a matching pg_dump and quiesced /data archive.

backup.enabled requires persistence.enabled: true; the chart rejects an ephemeral backup configuration because the CronJob must mount the durable data claim.

The scheduled CronJob reads live /data and does not stop ArchiveBox. Use a quiesced maintenance window for application-consistent recovery points. With workload identity enabled, the chart does not render static S3 credentials.

Service

Ingress

Probes

Probes use the /health/ endpoint.

Resources and Security

ArchiveBox uses Chromium internally to render pages. The Chromium process requires at least 2 GB RAM to function reliably. Without memory limits, the container may be OOMKilled during archiving of JavaScript-heavy pages.

The application container starts as root so the upstream entrypoint can detect the collection owner and drop privileges. The default workload therefore needs an explicit exception in namespaces enforcing Pod Security restricted.

Service Account

The chart creates no RBAC permissions. Kubernetes ServiceAccount token automount policy still applies to the selected ServiceAccount and namespace.

Scheduling

Extra

Common Issues

More Information

• ArchiveBox Official Website
• ArchiveBox Documentation
• ArchiveBox GitHub Repository
• HelmForge ArchiveBox Chart Source