One Python service speaks HTTP, WebDAV, SFTP, FTP, and TFTP
The 482-file checkout turns folders already on a machine into a browser-accessible file server. Users can upload, download, search, preview media, create temporary shares, edit text, and stream a file while it is still arriving. The same service can expose WebDAV, SFTP, FTP, FTPS, or TFTP when their dependencies and ports are enabled. That range is the main reason to choose it: one configurable process can bridge modern browsers, command-line clients, phones, and machines old enough to have limited software choices.
The checked-out repository was modest beside that feature list: 482 files, about 101,598 lines of source, and 5.3 MB on disk before installation. Copyparty also keeps existing filesystem paths intact. You map a local directory to a URL volume and assign permissions for named accounts, groups, or anonymous visitors. This avoids importing files into an application-owned store, which is useful when other programs must keep reading the same directory tree.
A bare launch grants anonymous read and write access
After our 39-second install, launching Copyparty without arguments shared the current directory with read and write access for everyone who could reach it. A self-extracting Python file, a PyPI install, a zipapp, and Windows executables are offered, along with packages for several operating systems. That default suits an emergency transfer on a trusted LAN. It is a bad choice for a public host, so the accounts-and-volumes section should be read before opening a firewall or tunnel.
Our install added 54 Python packages in 39 seconds and occupied 83 MB. Basic file serving needs only Python, while thumbnails, media metadata, audio transcoding, SFTP, FTPS, password hashing, and SMB draw on optional tools. Pillow and FFmpeg cover common media work. Paramiko enables SFTP, and Argon2 support enables hashed passwords. The base installation stays lean because those choices remain separate, but enabling the full menu means tracking native programs and their security updates.
What happened when we ran it
Our measurement setup used a fresh Debian container with 3 CPUs and 8 GB of RAM. We cloned commit 4e318d5 and installed it in 39 seconds. The build finished successfully in 23 seconds. That clean result supports the project's claim that the code is portable and does not demand an elaborate build chain. The repository contained a tests directory, though our scan found 0 GitHub Actions workflow files and no Dockerfile at the root. Its Docker material lives under scripts/docker, as the README explains.
Pytest passed 31 of 31 tests in 28 seconds, with 0 failures. Pip-audit also reported 0 known vulnerabilities in the installed Python packages. Those are clean results for commit 4e318d5 in our fresh Debian container. They do not test every optional protocol, browser, proxy rule, or media decoder. A production trial should exercise the exact volume permissions, upload path, reverse proxy, and optional binaries the service will use.
Anonymous uploads require HTML and media isolation
The 482-file checkout includes safety presets for untrusted content. Uploaded Markdown can contain HTML and scripts, and the document viewer's defenses are described as less than absolute. The nohtml volume flag serves HTML and SVG as plain text and disables Markdown rendering. Other controls can turn off thumbnails, media tag extraction through FFmpeg, delete and move operations, WebDAV, and directory prose. These settings matter because a file server may process material chosen by somebody else.
A 5.3 MB checkout does not remove that operating burden. The README recommends placing FFmpeg inside a bubblewrap sandbox and notes that this is usually unavailable inside Docker or Podman. It also tells proxy users to preserve Content Security Policy nonces and configure the real client address correctly. Built-in TLS is discouraged in favor of a reverse proxy, so an internet-facing setup still needs certificate handling, header checks, logging, and careful bind rules outside Copyparty itself.
SMB is discouraged, and suffix byte ranges have an open defect
Copyparty v1.20.21 labels its SMB implementation unsafe, slow, and unsuitable for WAN use. Its documentation says the backend is not fully integrated with the virtual filesystem and may have path-traversal problems, then recommends running it with a chroot or bubblewrap wrapper. TFTP has no accounts and uses volume permissions instead. These modes widen device compatibility, but they should be treated as specialized adapters. SFTPGo is the saner comparison when managed transfer protocols are the main requirement.
Our 31-test run passed, yet it did not erase an open protocol report. Issue 1628, filed on August 30, 2026, says a suffix request such as Range: bytes=-10 returns bytes from the beginning of a file. That can affect software reading metadata stored at the end of ZIP or media files. The report includes a reproduction against v1.20.21 and says explicit ranges work. Buyers depending on suffix ranges should reproduce that case before deployment.
September pushes and issue replies show active maintenance
GitHub recorded the last push on September 1, 2026, and listed 46,515 stars plus 255 combined issues and pull requests when fetched. Open issues were still being created and updated in early September, including a NixOS module report with a maintainer response. The combined count is not a count of defects. It does show that a large user base is still testing many operating systems, protocols, and packaging paths.
Release v1.20.21 was published on August 17, 2026, with new thumbnail extraction and WOPI work, along with upload and browser fixes. Its notes also point back to two July security fixes, a useful sign that operators should follow advisories rather than install once and forget. The 23-second build and clean 31-test result make Copyparty easy to trial. Keeping it safe in public depends on a narrow feature set, explicit volume rules, and prompt upgrades.