One address can front more than 30 storage services
AList gives local folders and remote storage accounts a shared browser, preview layer, and WebDAV endpoint. Its README lists more than 30 services and protocols, including Google Drive, OneDrive, S3, SFTP, SMB, Dropbox, Proton Drive, Aliyun Drive, and several China-focused cloud disks. You mount each source into AList's directory tree, then decide whether visitors can browse, preview, download, upload, rename, move, or copy files.
The design is especially handy for media. The web interface previews images, audio, video, subtitles, PDFs, code, and office documents. WebDAV lets compatible players and file managers reach the same mounted tree. Our checkout was only 3.8 MB before dependencies, despite containing 844 files and roughly 132,196 lines of source. AList does a great deal from one Go service, though every enabled provider widens the surface you must verify.
Provider breadth brings provider breakage with it
Release v3.64.0 fixed behavior in 189 Cloud, Azure Blob, Lanzou, SMB, Terabox, and WebDAV. That is useful maintenance, and it also describes the operating model: AList sits between users and services whose interfaces can change independently. A working mount today can fail after a provider changes authentication, paths, rate limits, or response formats. Pinning AList cannot freeze the other end of the connection.
Current reports make the point concrete. Issue 9644 says Baidu Netdisk token refresh and 360 AI YunPan requests fail in v3.64.0. Issue 9652 reports that directory trees do not expand for custom roles even when the permission bits match the built-in administrator. These are reporter claims, not results from our sandbox. They are good acceptance-test material if either provider support or delegated administration is central to your installation.
What happened when we ran it
Our sandbox installed 644 Go packages in 110 seconds at commit fb0731a. The build then succeeded in 146 seconds. The repository included 20 CI workflow files, a Dockerfile, and a Compose file, so the source tree exposes more automation and deployment machinery than a typical small self-hosted utility.
The test command failed with exit code 1 after 59 seconds. Its accounting showed 58 passes and 31 failures out of 89. The final lines showed successful results for packages including pkg/task, server/handles, server/middlewares, and server/webdav, followed by FAIL github.com/alist-org/alist/v3/server/s3 [build failed] and an overall failure. The supplied tail does not contain the compiler message, so it does not support a diagnosis of the S3 failure.
Our scan found no dedicated tests directory, which is normal for Go projects that keep _test.go files beside source. The important result is the red suite, not the folder layout. A successful 146-second build proves that the main build command completed in our Debian container. It does not cancel 31 failed test results or establish that a real provider login works, since the container had no secrets.
Docker gets port 5244 open, then configuration begins
The official Docker command publishes port 5244 and mounts /etc/alist to /opt/alist/data. AList defaults to SQLite, while MySQL and PostgreSQL are available. The same configuration can enable separate S3, FTP, or SFTP listeners. A simple home setup can stay with SQLite and one container, but backups must include the persistent data directory because that is where configuration and the database live.
Remote storage is the next step. OneDrive, Google Drive, S3, and the other drivers each require their own account details or tokens. A reverse proxy must pass the host and range headers, and the docs recommend setting site_url. They also warn that Nginx caching can make large-file playback fail by trying to cache the remote object locally. Those details matter more than the 110-second source install once other people depend on the service.
WebDAV operations vary by backing storage
The WebDAV path is /dav/ and uses the same username and password as the web interface. Since v3.42.0, read access needs the WebDAV read permission. Writes also need WebDAV manage plus the matching file permissions, such as upload, delete, rename, move, or copy. This split lets an administrator make a media library read-only without giving the client a path to alter it.
Behavior still depends on the driver. The official compatibility table marks listing, downloading, directory creation, renaming, moving, and uploading across the named backends, but copy is unavailable for Google Drive, 123pan, FTP, and SFTP. The user guide also advises against sending very large files or hundreds to thousands of uploads through AList. For that workload, it tells users to work through the provider's own site.
September activity is strong, while the queue is large
GitHub recorded the last push on September 19, 2026. The latest release, v3.64.0, arrived on September 3, and the repository had 50,193 stars. GitHub also listed 563 combined issues and pull requests. That count is not a defect total, but it signals how much integration and user activity surrounds the project.
AList has the deployment choices, documentation, license, and active maintenance expected from an established self-hosted project. It is released under AGPL-3.0, so organizations modifying and serving it should review that license. The failed 59-second suite keeps this review from calling the measured commit clean. Adopt AList for its gateway breadth, then test every storage driver and WebDAV operation your users will rely on.