RAGFlow bundles parsing, retrieval, and four Go services
RAGFlow parses an uploaded document and carries it through to an answer with citations. It handles office files, images, scanned copies, web pages, and structured data. You can inspect its chunks, choose chunking templates, combine retrieval methods with reranking, and connect language, embedding, and reranker models. That breadth is the reason to try it. It is also why adopting it feels closer to operating a data product than adding a Python package.
The v1.0.0-rc1 line moves the main services into Go. API, Admin, Ingestor, and Syncer now come from one Go service, while DeepDoc runs inside that process for layout work, OCR, and table recognition. Kvrocks stores cache and checkpoints, and NATS JetStream carries queued work. MySQL, object storage, and either Elasticsearch or Infinity still sit around it. RAGFlow removes assembly work from the product team by handing it to the operator as one opinionated stack.
Chunk inspection and cited answers are built in
The interface lets a developer see how a source was split and trace an answer back to its references. That is more useful than a chat box that hides retrieval mistakes. A bad answer can often be followed to a bad chunk, missing source, unsuitable embedding model, or reranking choice. Template-based chunking also gives teams a place to encode the structure of recurring documents instead of treating every upload as plain text.
RAGFlow now goes beyond one retrieval pass. Its agentic modes can break a question into smaller searches, collect more context, and check evidence before answering. Knowledge Compilation can produce artifacts such as wikis, graphs, page indexes, and timelines from a document or dataset. Those features widen the jobs it can handle, but they also increase the number of models and processing rules you must evaluate. A polished artifact is still downstream of parsing and retrieval quality.
What happened when we ran it
Our fresh Debian sandbox installed commit 0a715d1 in 58 seconds. It added 34 packages and occupied 37 MB, then completed the build in 11 seconds. The checkout itself held 5,167 files, about 1,228,814 lines of source, and used 56.7 MB. Pip-audit reported 0 known vulnerabilities. These figures describe the package and build path we ran, not a live RAG workload or the much larger Docker deployment.
The test command failed with exit 4 after 10 seconds, before the suite could proceed. test/testcases/configs.py checked for ZHIPU_AI_API_KEY while pytest loaded its shared configuration, then called pytest.exit because the variable was absent. The log shows that missing environment variable and nothing more. It does not establish whether the tests would pass with a valid key, and we will not turn it into a claim about network access or test quality.
The repository has 3 CI workflow files, a Dockerfile, and a tests directory. That is useful project structure, but it does not change the result on a no-secret machine: the default command we ran could not reach test execution. A team using a different model provider should decide whether Zhipu-backed cases belong in its release gate, then supply the credential securely or select a documented narrower test target.
The 4-core starting point understates the operating checklist
The README recommends 4 CPU cores, 16 GB RAM, and 50 GB of free disk, before local models and optional services add their own needs. Docker must be at least 24.0.0 and Compose at least 2.26.1. Elasticsearch users also set vm.max_map_count to 262144. RAGFlow has no Compose healthcheck of its own, so the documented readiness check is an HTTP request to /api/v1/system/healthz after checking the containers.
Source development is considerably sharper. The current instructions name Go 1.27, Clang 20, LLD 20, CMake 4.0 or newer, PCRE2 headers, native CGO libraries, model resources, and tokenizer assets. Local dependencies include MySQL, MinIO, NATS, Kvrocks, ClickHouse, and a document engine. The services must be migrated and started in order, with Admin before Ingestor, Syncer, and API. Use the prebuilt Compose route unless you need to modify the backend.
The v1.0 release candidate needs a production hold point
Release v1.0.0-rc1 landed on September 29, 2026, one day before this review. Its data upgrade accepts deployments already on v0.27.2 and cannot be rolled back after migration. The release also drops deprecated API aliases, limits DeepDoc to CPU, removes local sandbox support, and says the Team/Me permission model is not yet supported. Copy production data, verify the restore, and rehearse the move before allowing the container entrypoint to migrate anything valuable.
There is another reason for restraint around shared deployments. Open issue 20404 reports that two Go endpoints can read document data without checking dataset access, while issue 20396 reports a provider-instance response returning an unmasked API key. These are issue reports, not findings from our sandbox, but both were open on September 30. Keep the service behind trusted access and review the fixes before treating the release candidate as a multi-tenant boundary.
The September 30 push came with 1,560 open items
GitHub search showed 1,172 open issues plus 388 open pull requests on September 30, 2026. That is a large queue, yet same-day issue updates and the September 29 release show that maintainers are working in it. With 91,555 stars, the project has attention far beyond a small experimental repository. Stars do not reduce the work of validating an irreversible migration or provider-specific tests.
RAGFlow earns a trial when the alternative is building document ingestion, chunk inspection, retrieval, citations, and workflow tools yourself. Start with a representative set of ugly PDFs and spreadsheets, not a clean demo file. If the chunks and references hold up, the stack may save months of product work. If your need is only a retrieval pipeline in code, choose Haystack and avoid inheriting a 50 GB starting recommendation and an RC migration at the same time.