How to Install Karakeep in an LXC Container on Proxmox VE (Self-Hosted Bookmark Manager With AI Tagging)

Introduction

You know the drill. You find a great article at midnight, hit save, and promise yourself you'll read it later. Six months on, the link is dead, the site redesigned, or you just can't remember why you saved it in the first place. Browser bookmarks weren't built to fix this, and most "read it later" apps just move the same pile of clutter into a different app.

Karakeep takes a different approach. It's an open-source, self-hosted app that saves the actual content of a page, not just the URL, and then uses AI to tag it automatically so you can find it again by searching for what it's about rather than remembering what you titled it. Run it on your own Proxmox VE server and your bookmark library lives on hardware you control, with no monthly fee and no company deciding to shut the service down.

This guide walks through installing Karakeep inside a Linux container (LXC) on Proxmox VE, using the community-maintained installer script. If you've never created an LXC container before, don't worry — that's exactly what this is for.

What You Will Learn

• What Karakeep actually is and why it's different from a normal bookmarking app
• What LXC is, and why it's a good fit for a lightweight app like this one
• How to deploy Karakeep on Proxmox VE using the community-scripts installer
• What each part of the install script sets up, in plain language
• How to log in, save your first bookmark, and get search working
• Common errors people hit during install, and how to fix them
• A few settings worth changing before you rely on this for anything important

What Is This Feature?

Karakeep (it used to be called Hoarder, before a rename in 2025) is a self-hosted bookmark and note manager. You give it a URL, and it doesn't just store the link — it takes a full-page screenshot, archives a readable copy of the article text, and, if you've connected an AI provider, generates tags for it automatically. Save an article about sourdough starters and Karakeep might tag it "baking," "recipe," "fermentation" without you typing a single word.

Under the hood it's a small stack of services rather than one single program:

• The web app — the interface you actually use, built on Next.js.
• A worker process — handles the background jobs, like fetching a page, generating a screenshot, and running AI tagging.
• A headless Chromium browser — loads pages in the background so Karakeep can capture them the way a real browser would, including sites that need JavaScript to render.
• Meilisearch — a fast, open-source search engine that powers Karakeep's full-text search, so you can find a bookmark by searching for a phrase you remember from the page.

By default it stores its data in SQLite, a simple file-based database. No separate database server to install or maintain — the whole thing is self-contained.

Why Would You Use It?

If you're already happy with your browser's bookmark bar, you probably don't need this. Karakeep earns its keep once you've got more links than you can mentally organize, or once you've been burned by a saved article that vanished when the site got taken down.

A few reasons people actually reach for it:

• Pages you save stay saved, even if the original goes offline. Karakeep archives the content, not just a pointer to it.
• You can search by meaning, not just by title. If you remember an article was "about switching from Ansible to Terraform," you can search that phrase and find it, even if the tab title was something generic.
• It's private. Your reading list isn't training data for someone else's product, and it isn't tied to an account that can be suspended.
• It has a browser extension and a mobile app, so saving something is a two-tap action, not a chore.

Honestly, if all you do is save the occasional recipe, this is overkill. Karakeep makes the most sense for people who read a lot online and are tired of losing track of it.

Prerequisites

Before you start, make sure you have:

• A working Proxmox VE host — this guide was tested on Proxmox VE 8.x, and it also works on the 9.x series.
• At least 15 GB of free storage on the storage location you plan to use for the container, plus 4 GB of RAM you can spare. Karakeep's headless Chromium instance is the main reason it needs more RAM than a typical lightweight LXC app.
• Root or an admin account on the Proxmox VE web interface.
• A network connection for the container — either DHCP or a static IP you've already planned out.
• Roughly 10–15 minutes. Most of that is the script downloading and building Node.js dependencies, not anything you have to do by hand.

You don't need Docker knowledge for this method. The install script sets everything up as native systemd services inside a Debian container, so if you're more comfortable with plain Linux than with container orchestration tools, this is actually the easier path.

Step-by-Step Tutorial

Step 1: Open the Proxmox VE Shell

Log in to the Proxmox VE web interface. In the left-hand tree, click your node (the server itself, not a specific VM or container), then click >_ Shell near the top right. This opens a terminal running directly on the Proxmox host — not inside any container.

Step 2: Run the Installer Script

Paste this command into the shell and press Enter:

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/karakeep.sh)"

This pulls the Karakeep install script from the community-scripts project — a well-known, actively maintained collection of Proxmox VE app installers — and runs it. You'll see a text-based setup screen (it uses the whiptail dialog tool) asking whether you want Default Settings or Advanced Settings.

For a first install, pick Default Settings. It creates the container with sensible values: 2 CPU cores, 4096 MB of RAM, a 15 GB disk, and Debian 13 as the base OS, with DHCP networking. If you already know you want a static IP or a specific container ID, choose Advanced Settings instead and fill those in.

Step 3: Let the Script Build the Container

Once you confirm your settings, the script does the rest on its own:

1. Creates a new unprivileged LXC container on Debian 13.
2. Installs Node.js 22 LTS and pnpm (the package manager Karakeep's build process needs).
3. Installs Chromium along with GraphicsMagick, Ghostscript, and FFmpeg — the tools Karakeep uses to render pages and generate previews for PDFs, images, and video links.
4. Installs Meilisearch for search indexing.
5. Downloads and builds the latest Karakeep release from source.
6. Generates a random NEXTAUTH_SECRET and a Meilisearch master key, and writes them into a config file.
7. Creates and starts three systemd services: karakeep-web, karakeep-workers, and karakeep-browser.

This step is the one that takes the longest, mostly because of the Node.js build process. On a modest homelab server, expect somewhere around 8–12 minutes. When it's done, the script prints the container's IP address and the port to use.

Step 4: Open Karakeep in Your Browser

Go to http://<container-ip>:3000 in your browser, using the IP address the script gave you at the end. You'll land on Karakeep's sign-up screen. Since this is a fresh instance with no accounts yet, the first account you create is automatically an admin.

Fill in an email address (it doesn't need to be a real, deliverable one for a purely local instance, but use a real one if you plan to enable email-based password resets later) and a password, and you're in.

Step 5: Save Your First Bookmark

Click the + button, paste a URL, and hit save. Karakeep queues a background job to fetch the page, generate a screenshot, and pull the readable text. Give it a few seconds — refresh the page and you should see a thumbnail and an extracted title appear. That confirms the worker and headless browser services are both talking to each other correctly.

Step 6 (Optional): Connect an AI Provider for Auto-Tagging

Automatic tagging is the feature that sets Karakeep apart, but it doesn't work out of the box — it needs an AI provider to generate the tags. You have two realistic options: OpenAI's API (paid, and the tagging quality is generally the best), or a locally-run model through Ollama if you already have one set up elsewhere on your network and want to keep everything local.

To wire either one up, edit the environment file on the container itself:

nano /etc/karakeep/karakeep.env

Add your provider's API key or endpoint (the exact variable names are documented in Karakeep's own configuration docs, since they occasionally add new provider options), save the file, then restart the services so the change takes effect:

systemctl restart karakeep-web karakeep-workers

Skip this step if you're happy tagging things manually — plenty of people do.

Commands Explained

Common Errors

A few things trip up almost everyone the first time through:

• The container shows "No Network" right after creation. This is usually a timing issue rather than a real misconfiguration — the container came up before the bridge finished initializing. Give it another minute, then check ip a inside the container. If it's still missing an address, verify the container's bridge (usually vmbr0) matches what your other VMs and containers use.
• The web page loads but bookmarks never get a screenshot or extracted text. This almost always means the karakeep-browser service isn't running. Check it with systemctl status karakeep-browser — a crashed headless Chromium is the most common cause, and a restart usually clears it.
• Search returns nothing, even for bookmarks you know exist. Meilisearch and the web app authenticate to each other with a shared master key. If that key doesn't match — which can happen if you edited the env file by hand and made a typo — search silently fails instead of throwing an obvious error.
• The install script exits partway through with a build error. This is almost always low disk space or a low-memory container that got killed mid-build. Double-check you gave the container at least the default 15 GB disk and 4096 MB RAM before you start troubleshooting anything else.

Troubleshooting

If the web interface won't load at all, start at the bottom of the stack and work up. First, confirm the container itself is running from the Proxmox host:

pct status <CTID>

If it's running, enter the container and check the three services:

pct enter <CTID>
systemctl status karakeep-web karakeep-workers karakeep-browser

Any service listed as failed is your starting point. Pull its recent logs with journalctl -u <service-name> -n 50 and read from the bottom up — the actual error is usually in the last few lines, not buried at the top.

If everything shows as active but the page still won't load in your browser, it's worth ruling out a network problem before touching Karakeep itself. Try curl http://localhost:3000 from inside the container. If that returns HTML, the app is fine and the problem is between your browser and the container — check firewall rules on the Proxmox host and confirm you're using the container's actual IP, not the Proxmox host's IP.

One more thing worth knowing: if you ever change the MEILI_MASTER_KEY after the first run, Meilisearch won't just pick up the new key. You have to stop the service, delete its existing data directory, and let it rebuild — otherwise the old key stays baked into the index and nothing authenticates correctly again.

Best Practices

A few habits that'll save you trouble down the road:

• Back up /opt/karakeep_data regularly. That's where your SQLite database and archived assets live. If you're already running Proxmox Backup Server for your VMs, just make sure this container is included in a backup job — it's not automatic just because the host has PBS configured.
• Don't expose port 3000 directly to the internet. Put it behind a reverse proxy with a real TLS certificate if you want remote access — Nginx Proxy Manager or Traefik both work fine for this and are common choices in homelab setups.
• Set NEXTAUTH_URL correctly if you do put it behind a domain. It needs to exactly match the URL people actually type in, protocol included. A mismatch here is a classic cause of login redirect loops.
• Keep an eye on container RAM usage for the first week or so, especially if you're saving a lot of pages at once. The headless browser is the biggest memory consumer, and if you're hoarding (no pun intended) hundreds of links a day, 4 GB might end up tight.

Frequently Asked Questions

Does Karakeep require Docker?

No, not with this install method. The community-scripts installer runs everything as native systemd services inside a Debian LXC container. Docker-based installs exist too, if you'd rather manage it that way.

Can I use Karakeep without connecting an AI provider?

Yes. You can save, organize into lists, and manually tag bookmarks without ever configuring OpenAI or Ollama. You just lose the automatic tagging and AI-generated summaries.

Is my data private if I self-host Karakeep?

Your bookmarks and archived pages stay on your own storage. If you connect an AI provider like OpenAI for tagging, the page content you save does get sent to that provider for processing — that part isn't local unless you use a self-hosted model through Ollama instead.

What happens if I lose the container?

You lose your bookmark library unless you've backed up /opt/karakeep_data. There's no cloud copy by default — that's the tradeoff of self-hosting, and exactly why regular backups matter here more than with a hosted service.

Can I migrate from Pocket or another bookmarking app?

Karakeep supports importing bookmarks from a standard browser bookmarks HTML export, which most bookmarking services can generate. Check Karakeep's own documentation for the current list of supported import formats before you commit to migrating everything over.

Conclusion

Fifteen minutes and one terminal command gets you a bookmark manager that actually holds on to what you save, searchable by content instead of by memory. That's a decent trade for a spare 4 GB of RAM on a Proxmox box that's probably already running half a dozen other things.

Start simple: get the container running, save a handful of links, and see if the workflow sticks before you bother wiring up an AI provider or a reverse proxy. If it does stick, the backup and remote-access steps above are there whenever you're ready for them.