---
type: reference
description: "Calibre is the e-book library manager that backs Calibre-Web."
tags:
  - dankserver
  - calibre
timestamp: 2026-09-21
---

# Calibre

Calibre is the e-book library manager that backs Calibre-Web. It manages metadata, formats, and conversions for the library that Calibre-Web serves.

**Host:** Dankserver (library directory on host) — **Docs:** https://calibre-ebook.com

## Role in this Stack

Calibre itself is a desktop/GUI application, not a container service. This stack runs **Calibre-Web** in a container and points it at an existing Calibre library directory on the Dankserver host.

Calibre is used to:
- Import books into the library (drag-and-drop or CLI `calibredb`)
- Edit metadata (author, title, series, tags, cover art)
- Convert between formats (EPUB → MOBI, MOBI → EPUB, etc.)
- Manage collections and reading lists

The actual library files (`.epub`, `.mobi`, `.pdf`) and the Calibre database (`.db` file) live on the host filesystem. Calibre-Web reads and writes them through the mounted volume.

## Current Version

Calibre 9.15.0 is the version on the live host (the upstream latest as of 2026-09-22). Major features include:
- Bookshelf view
- Opt-in AI features
- Content-server path-traversal fix: a bug since v6.16.0 allowed any user with server access to read non-Calibre files on the host. (The CVE-2025-7404 advisory is tracked against Calibre-Web, see [[Calibre-Web]].) Upgrade to 9.15.0+ if serving content to untrusted users.

## Library Directory

The live Calibre-Web container bind-mounts the library at `/books`:

| Purpose | Host path (live) |
|---------|------------------|
| Calibre library | `/home/dank/Containers/calibre-web/books` → `/books` in the Calibre-Web container |

(The older `/opt/calibre-web/books` path was the compose-era location and is
gone; the quadlet unit mounts the Containers data root.)

## What the Container Needs

- Read/write access to the library directory. Calibre-Web edits metadata through the database file.
- Ownership matching `PUID=1000` / `PGID=1000` (the `dank` user on Dankserver).

## Calibre Content Server (running)

Calibre includes a built-in HTTP content server (`calibre-server`) that serves
the library via OPDS feeds and a web interface:
- OPDS feeds for mobile reading apps (FBReader, Moon+ Reader, KyBook)
- Web UI for browsing, metadata editing, and uploads
- Direct device push (from the GUI, not the content server)

**Live shape (deployed 2026-09-21):** a rootless Quadlet unit
(`dankserver/calibre-server/quadlet/calibre-server.container`), boot-persistent
and self-healing, on `lscr.io/linuxserver/calibre:9.15.0`.

The image is the current **desktop** build (Selkies web-streamed GUI), not the
headless image the old compose snippet assumed — the dedicated headless images
(ta264/docker-calibre, agentgreen/calibre-server) are dormant (calibre 6.10 /
2017, both below the 9.9.0 content-server fix). The unit therefore runs
`calibre-server` as the image's s6-overlay main service via `Exec=`.

| Surface | Host port | Auth |
|---------|-----------|------|
| Content server (OPDS + web UI) | **8084** (internal 8090) | HTTP Basic, single admin `calibre` in the SQLite userdb |
| Desktop GUI (internal only) | none (8080/8181/8082 inside the container) | HTTP Basic ready (`CUSTOM_USER`/`CUSTOM_PASSWORD` in the env file) |

Port notes: `Network=pasta` on this host is port-FORWARD mode — the container
keeps its own netns and only `PublishPort`'d ports reach the host (verified
2026-09-21). The desktop GUI runs but is unreachable: exposing the browser
GUI is one `PublishPort` line away. 8080 *inside* the container is the
image's own nginx (the desktop), so the content server runs on internal 8090.

**Auth model (calibre 9.x):** users live in a SQLite userdb whose `pw` column
is **plaintext** — the file is mode 600. The single admin account is
bootstrapped once by the deploy handler
(`deploy_calibre_server` in `scripts/deploy-remote.sh`)
`calibre-server --manage-users -- add`, the password piped on stdin with
`printf` (a trailing newline from `echo` lands in the stored password and
breaks every login). The desktop's basic auth (`CUSTOM_USER`/`CUSTOM_PASSWORD`)
reuses the same pair. Both live in the machine-local env file
`/home/dank/Containers/calibre-server/env` (mode 600); the repo holds no
secrets. `--auth-mode=basic` is pinned: on a non-SSL port the server defaults
to Digest auth, which rejects plain Basic clients with
`400 Unsupported authentication method`.

LAN-only (no vhost, no public DNS). The library is mounted read-write — the
content server writes metadata, the same library Calibre-Web uses.

## See Also

- [[Calibre-Web]] — the containerized frontend
- [[Dankserver Stack]]
- [[ARR-Stack]] — Readarr for automatic ebook downloads