Self-Hosted Online Store

Ecommerce

A complete online store: a storefront where customers browse products and an admin panel where the merchant lists products and manages orders, customers and settings, with sample products already in the shop. You bring it up on your own machine with Docker Compose, and the admin password is generated at random by a script. Derived from a frozen snapshot of an open-source e-commerce platform under the MIT licence; the delivery adds a single-service orchestration file, a Dockerfile that builds the image from source, a script that generates the key and password, and a quick-start guide in Traditional Chinese.

Subscribe & download See how to start

SubscriptionUS$49 per month

Last run2026-11-02

In practice

Readiness4 / 5

What you need

Few changes needed4 / 5

Who it is for

Individual sellers and small merchants who want to own an online store and hold their own product and customer data.

How to start

$ sh scripts/quickstart/init-env.sh
$ docker compose up -d --build

Browse the files

Files in the product repository at the pinned commit. A few house files are left out of the zip.

File overview2,000+ paths

▸app3

Http/
Providers/

▸bootstrap3

app.php
cache/
providers.php

▸config32

.gitignore
ai.php
app.php
auth.php
bagisto-vite.php
breadcrumbs.php
broadcasting.php
cache.php
concord.php
cors.php
…

▸database11

.gitignore
migrations/
seeders/

▸docker34

local/
production/
quickstart/

▸lang92

ar/
bn/
ca/
de/
en/
es/
fa/
fr/
he/
hi_IN/
…

▸packages1719

Webkul/

▸public23

.htaccess
build/
favicon.ico
fonts/
forge
index.php
llms-full.txt
llms.txt
themes/

▸resources5

css/
js/
themes/
views/

▸routes2

console.php
web.php

▸scripts1

quickstart/

▸storage15

.gitignore
app/
debugbar/
fonts/
framework/
logs/

▸tests15

Datasets/
Pest.php
TestCase.php
Unit/
e2e-pw/

▫AGENTS.md

▫ATTRIBUTION.md

▫CHANGELOG.md

▫CLAUDE.md

▫CODE_OF_CONDUCT.md

▫CONTRIBUTING.md

▫LICENSE

▫LICENSE-99LL.md

▫PRODUCT.md

▫QUICKSTART.md

▫README.md

▫SECURITY.md

▫SECURITY.upstream.md

▫UPGRADE.md

▫artisan

▫composer.json

▫composer.lock

▫delivery-manifest.txt

▫docker-compose.dev-upstream.yml

▫docker-compose.yml

▫package.json

▫phpunit.xml

▫pint.json

▫vite.config.js

▫Config and hidden files 21

Latest passing run

Clone → Checkout → Toolchain → Build images → Storefront and admin login

Pre-purchase Disclosure

What you are buying

A self-hosted online store system: a storefront where customers browse products, and an admin panel where the merchant lists products and manages orders, customers and settings. After running the key generation script you bring it up with Docker Compose, and the shop already holds sample products.

Derived from an open-source e-commerce platform under the MIT licence, and not the original project itself. Our work: a single-service orchestration file (with the web server and the database inside), a Dockerfile that builds the image from source, a script that generates the key and the admin password, and a quick-start guide in Traditional Chinese.

Delivery is a frozen snapshot: one zip, taken from the product repository at revision 0c703e2.

Known limitations

The service serves plain HTTP on port 80 of the local machine; TLS and a reverse proxy are yours to bring
The shop interface is in English by default, and upstream’s language files have no Traditional Chinese
The storefront and admin pages fetch fonts from Google Fonts, and the admin text editor component loads from cdnjs
The bundled database uses fixed credentials, used only inside the container, with no port published
The data lives in Docker named volumes, and docker compose down -v clears the database and the uploads along with them
The first start builds the image from source, fetching from registries, apt, a PHP package repository and Composer during that time
Pinned to the delivered snapshot; it does not follow upstream.

The liability cap, the scope of what is promised and the statutory floor are governed by the Terms of Service.

Vetting record

Everything below was checked against the pinned commit 7e4b38a. Every verdict carries its full reasoning, an evidence link and the checker; failures are published, not hidden — do not take our word for it, verify it yourself.

5 PASS0 WARN0 FAIL

Source ReviewPASS

Execution surface of the delivery reviewed item by item. Our own additions were read line by line: docker-compose.yml (the published port is bound to 127.0.0.1 only; it refuses to start when APP_KEY or the admin password is missing; the database and uploads use named volumes), docker/quickstart/entrypoint.sh and set-admin-password.php (they update the password only while it is still upstream’s default, and change no upstream source), and scripts/quickstart/init-env.sh (openssl generates random values, .env is mode 600, existing values are not overwritten). The orchestration file also points the host name upstream’s installer reports to at the local machine, at build time and at run time. The upstream PHP and front-end sources were not read file by file; the basis is the MIT licence and container isolation.

Script SafetyPASS

The scripts on the buyer’s delivery path were each inspected: init-env.sh and the entry script are ours (read line by line); the build goes through docker/quickstart/Dockerfile (read line by line: packages from apt and a third-party PHP package repository, Composer installing from the lock file, the build-time install flow kept from upstream’s own files, with no download piped straight into a shell). At start-up Supervisor manages the web server, PHP, the database and the queue worker.

RecencyPASS

This product is a frozen snapshot and does not follow upstream: the upstream source is pinned to the main-line revision taken on the day the product repository was created (see the evidence link), and the product repository is that snapshot plus our own commits.

LicensePASS

SPDX:LicenseRef-99LL-Product

Upstream LICENSE was checked word for word (the evidence link points at the file itself at the pinned version and matches the copy inside the product repository): the standard MIT text, copyright holder Webkul Software. It allows commercial use, modification, derivative works, redistribution and sale; the duty is to keep the copyright notice and licence text (LICENSE and ATTRIBUTION.md ship in the zip); upstream has no NOTICE file. The decision does not rest on GitHub’s licence field. For the product as a whole the 99LL product licence template is attached: upstream’s LICENSE is kept as it is and LICENSE-99LL.md is added as the sale and liability terms for the part we built, with spdx recorded as LicenseRef-99LL-Product.

Dependency LicensesPASS

This records the declared side, not a scan result: the PHP dependencies are declared in composer.json and locked by composer.lock, the front end is declared in package.json, and the packages themselves are fetched from their own repositories when the buyer builds; the base image and system packages come from a registry and apt. These dependency trees were not scanned package by package for licences. Upstream has no submodule and no third-party dataset was copied in (see ATTRIBUTION.md).