Homebox catalogs possessions without warehouse vocabulary
Homebox records what a household owns, where each item lives, what it cost, and when a warranty or maintenance task is due. Items can carry categories, locations, tags, custom fields, images, and documents. Search makes the result easier to use than a folder of receipts or a spreadsheet that nobody updates after the first weekend.
Its scope is domestic rather than corporate. A laptop can keep its serial number and receipt, tools can sit under a garage-shelf location, and an appliance can carry a warranty date. QR labels connect the database to physical boxes and objects. The responsive interface is intended for phones as well as desktop browsers, which matters when data entry happens beside the item.
The repository continues the original HomeBox project by hay-kot. Go powers the backend, the web interface is embedded, and SQLite is the portable default. The README says the whole idle container generally stays below 50 MB, though that is the project's figure rather than one we measured. The simple shape suits a home server: one application and one persistent data directory.
What happened when we ran it
Our sandbox cloned commit 8222a88 into an unprivileged Go 1.24 Debian container with 3 CPUs and 8 GB of RAM. The 21.4 MB checkout contained 989 files and about 157,605 lines of source. Working inside ./backend/, installation succeeded in 124 seconds and installed 533 Go packages.
The backend build succeeded in 166 seconds. Tests then failed with exit code 1 after 100 seconds. Go reported 13 packages passed and 1 failed out of 14. The final output identifies github.com/sysadminsmedia/homebox/backend/internal/sys/validate as the failed package, but the supplied tail contains no assertion or error explaining what failed.
We therefore treat the result as one unresolved failed package, not a broken application and not a clean suite. The scan found 13 CI workflow files, no Dockerfile, and no top-level tests directory. We did not start Homebox, open its interface, scan a QR label, import a CSV file, or restore a backup in this run.
The container needs a pepper and durable /data
The README's quick start generates a 48-byte base64 value for HBOX_AUTH_API_KEY_PEPPER, mounts a host directory at /data, sets a time zone, and publishes host port 3100 to the application's port 7745. The regular image is joined by rootless and hardened variants. For the latter two, the mounted directory must be owned by user 65532.
That is a short route to a trial, but the data becomes important quickly. SQLite records, uploaded images, receipts, and warranty documents live in the persistent store. A backup plan should cover all of it, and a restore test should happen before hundreds of possessions are entered. Remote access also needs HTTPS and an update policy; a container restart alone does not provide either.
The default keeps infrastructure small. A household should resist adding external storage or identity services until a specific need appears. Every added database, object store, or login provider creates another credential and another recovery path. Homebox is most attractive when its portable defaults are allowed to remain simple.
CSV export is not a safe round trip yet
Bulk import is useful for an existing spreadsheet, but its boundaries deserve a small rehearsal. The documentation says attachments and item relationships are not represented, and nested locations are flattened in export. Those omissions mean CSV is a transfer format for selected fields rather than a complete backup of the Homebox data model.
Open issue 793 reports that an exported file leaves HB.import_ref empty. The reporter reproduced it on the public demo and explains that importing the unchanged export can create duplicates rather than update the same records. The issue remained open when checked. Anyone planning spreadsheet edits should export a small set, import it into a disposable instance, and confirm identity behavior before touching the main inventory.
Phone scanning also needs a real-device check. Open issue 1290 describes the rear camera failing to initialize until the user switches between front and rear sensors, sometimes 1 to 4 times. The report concerns one Docker deployment and does not establish universal failure. It does show why printing a house full of QR labels before testing each family phone is premature.
User administration is still household-grade
Homebox supports multiple users, but open issue 439 tracks broader user and account management work. A family sharing an inventory may accept that boundary. A company assigning equipment, recording checkouts, enforcing departmental roles, and proving an audit trail should compare Snipe-IT rather than bend a home inventory into an IT asset system.
The product's plain fields are the reason to choose it. Purchase dates, prices, warranties, maintenance, labels, and custom values cover common household questions without imposing stock-control procedures. Grocy is a better comparison when groceries, chores, recipes, and consumables dominate. Part-DB fits electronic components and quantities more closely.
GitHub recorded the last push on August 22, 2026, with 7,006 stars and 122 open issues and pull requests combined. Release v0.26.2 was published June 14 with a short bug-fix note. Recent push activity and the open queue show ongoing maintenance; the combined count is not a statement that 122 defects exist.
One failed package makes a staged trial the right call
The 166-second successful build is encouraging, while the 13-of-14 package result prevents a clean test claim. Because the log tail does not identify the failed validation case, it would be wrong to connect that result to imports, authentication, or any other feature. A local container trial can answer the user-facing questions our backend run did not.
Homebox is a sensible household inventory for someone already willing to self-host. Start with one room, attach a few documents, scan labels from the phones that matter, export the records, and restore a backup. If those checks pass and the family keeps using it, the simple SQLite-centered deployment is easier to justify than a business asset platform.