Filebrowser on GKE Autopilot

File Browser is a lightweight, open-source web file manager written in Go — it serves a directory tree over HTTP for browsing, uploading, editing, and sharing files. This module deploys Filebrowser on GKE Autopilot on top of the App_GKE foundation, which provisions and manages the shared Google Cloud and Kubernetes infrastructure.

This guide focuses on the cloud services Filebrowser uses and how to explore and operate them from the Google Cloud Console and the command line. For the mechanics that are common to every GKE application — Workload Identity, ingress, autoscaling, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC Service Controls, backups, and the deployment lifecycle — refer to the App_GKE foundation guide rather than repeating them here.

---

What Filebrowser costs on RAD, and how that compares

In a Google Cloud project you own, Filebrowser on RAD's GKE Autopilot module costs about US$42 a month, plus US$7.50 once per deployment and no per-user licence. Filebrowser is a lightweight, self-hosted web file manager with an embedded SQLite database. Figures are as at 8 October 2026; sources are listed at the end of this section.

If this runs in a project RAD manages for you, it can be deleted and restored within 30 days for a few credits instead of sitting there running — so an occasional-use deployment costs a few dollars a month, not US$42. See Pause it for free, below.

What you pay on RAD

	In a Google Cloud project you own	In a project RAD manages for you
Module fee, once per deployment	75 credits (US$7.50 at the top-up price)	67.5 credits (10% lower)
Build time	A few credits per build	The same
Google Cloud running cost	Billed by Google to your own billing account, about US$42 a month for the default configuration (table below)	Metered hourly in credits; RAD publishes 67 credits a day, about 2,010 a month (about US$201 at the top-up price)
Who owns what	You own the project and its billing; RAD deploys and updates it	RAD owns the project, with guardrails, quotas and budget alerts; you get console access, and a minimum purchased balance is held in reserve

10 credits cost US$1 on a one-off top-up, and less on a monthly plan. In a project RAD manages, the database, file server and network are shared by every application in the project, so a second application does not add a second database.

Default running cost in your own project (us-central1, Google list prices):

Resource (module default)	Per month
GKE Autopilot pod, 1 vCPU / 1 GiB, running all the time	US$36
Cloud NAT gateway and IP address	US$5
Cloud Storage for backups	US$1
Total	about US$42

GKE's free tier covers the management fee of one Autopilot or zonal cluster per billing account, so the total above assumes this is that cluster; otherwise add about US$73 a month.

How it compares

We could not find a commercial managed/SaaS plan specifically for Filebrowser itself as at 8 October 2026, so the honest comparison is against running it yourself:

Option	Per month	Who runs it
Hetzner CPX22 (2 vCPU/4GB)	~US$24	You: OS, updates, backups, security patches
DigitalOcean 2 vCPU/4GB Droplet	US$24	You: OS, updates, backups, security patches
GCP Compute Engine e2-standard-2 (2 vCPU/8GB)	~US$49	You: OS, updates, backups, security patches
RAD, GKE Autopilot, your own project	US$42, plus US$7.50 once	RAD's automation, in your project

Filebrowser's own footprint here (1 vCPU / 1 GiB) is lighter than that reference box, so a smaller, cheaper tier from the same providers would comfortably run it too.

• RAD is usually not cheaper in cash than a bare VPS — the difference is what is managed for you. A VPS price does not include the admin's own time for backups, security patches and OS upgrades; RAD's managed Cloud SQL (where this app uses a database), Secret Manager and monitoring cover that instead.
• Filebrowser is a lightweight, self-hosted web file manager with an embedded SQLite database. That shapes which column matters: predictable, hands-off operation is worth more to most teams running this kind of tool than shaving a few dollars off the monthly bill.

Pause it for free: delete a RAD-managed project, restore it when you need it

If Filebrowser runs in a project RAD manages for you, you have an option beyond scaling down: delete the whole project, and restore it within 30 days for close to nothing. This suits a deployment you only need occasionally — studying for a certification, a demo, a seasonal need — far better than running it continuously.

• How it works. Deleting a RAD-managed project unlinks its billing first, then asks Google to delete the project. Google does not remove it immediately: it keeps it, recoverable, for 30 days, and because billing is already unlinked, nothing is charged while it waits. Unlike deleting one module, this does not tear down GKE Autopilot one by one — the whole project, and everything in it, simply stops.
• Restoring costs a handful of credits, not a rebuild. Within 30 days, the project's owner can restore it. RAD asks Google to undelete the project and reattaches its billing account, then asks you to run Update on each deployment to confirm everything came back. Because nothing was individually destroyed, that Update finds the same resources already there — it is a check, not a rebuild, and an Update never charges the module fee again. That costs a handful of build-time credits in total (under US$1) for a typical 2–3-deployment chain.
• So a month of occasional use can cost a few dollars, not US$42. Deploy Filebrowser, use it for a session, delete the project. Restore it next time you want it, confirm with Update, and delete it again when you're done. You pay only for the module fee once, the builds, and whatever hours it was actually live.
• What this needs. You must own the project (not a bring-your-own one RAD only manages billing for), and you restore it yourself within the 30 days — after that, Google deletes it for good. Restoring is admitted like creating a new project: your purchased credit balance must still clear the tier's floor (100 credits for the sandbox tier most study/demo use fits). Google says most services are fully working again within 36 hours of a restore.

Pay only while you use it, the other way: delete and redeploy

GKE keeps at least one pod running, so Filebrowser never scales to zero on its own. The option above only applies to a RAD-managed project; in your own project, or once the 30-day window has passed, the way to stop paying is to delete the deployment and deploy it again when you need it.

• What a redeploy costs. The module fee again plus the builds: about 80 credits (US$8). Deleting saves money if Filebrowser would otherwise sit unused for about 6 days or more in your own project (about US$1.40 a day), or about 2 days or more in a RAD-managed one (67 credits a day).
• Note your settings. RAD does not recreate a deleted deployment for you; you enter the settings again when you deploy.

Lab sessions and Managed Environments

• Lab sessions, for training. A trainer runs a session for a class. Each participant gets Filebrowser in their own Google Cloud project for 15 minutes to 24 hours, within an allowance the trainer sets. Either the trainer funds every place, or each participant pays for their own. Everything is deleted when the session ends and unused credits go back to the trainer.
• Managed Environments, for consultancies. A partner runs the app for a client from a ring-fenced wallet it funds, and settles with the client directly. If the wallet runs low, billing pauses and the data is kept, so nobody receives an unexpected charge. At the end the partner hands the project over and the deployments become the client's own.

Credits can be bought in more than 20 currencies, including XAF, XOF, NGN, GHS, KES and ZAR, by card, bank transfer or mobile money.

Sources (8 October 2026): Google Cloud list prices from the Cloud Billing Catalog API; RAD's own fees and daily-credit estimate from radmodules.dev/pricing; Delete and restore projects for the pause/restore mechanism. Prices change; check each source before relying on a figure.

1. Overview

Filebrowser runs as a single Go web workload. It is deliberately minimal — no SQL database, no cache, no queue — so the deployment wires together a small set of Google Cloud services:

Capability	Google Cloud service	Notes
Compute	GKE Autopilot	Single Go pod, 1 vCPU / 1 GiB by default; min = max = 1
Persistent state	Cloud Storage (GCS FUSE) or a block PVC	Mounted at /database; holds the embedded SQLite DB
Database	None (embedded SQLite)	database_type = NONE; no Cloud SQL is provisioned
Cache & queue	None	Filebrowser uses no Redis
Secrets	Secret Manager	No app secrets generated; users live in the SQLite DB
Ingress	Cloud Load Balancing	ClusterIP Service by default; custom domain + managed certificate available

Sensible defaults worth knowing up front:

• State lives in an embedded SQLite file at /database. Filebrowser has no Cloud SQL database. Its users, settings, and share links are stored in /database/filebrowser.db. By default /database is a block PVC on a StatefulSet; only with stateful_pvc_enabled = false is it a Cloud Storage bucket mounted via GCS FUSE (see below).
• GCS FUSE vs. block PVC. With stateful_pvc_enabled = true (the default) the workload becomes a StatefulSet with a persistent block PVC (default 20Gi) mounted at /database, and the GCS FUSE volume is automatically disabled to avoid a double-mount at the same path. A block PVC gives SQLite proper POSIX file locking and is the more robust choice for a stateful file manager.
• Single instance by design. min_instance_count = max_instance_count = 1. SQLite does not tolerate concurrent writers — keep a single replica.
• Default login is admin / admin. Filebrowser seeds this on first boot; change it in the web UI immediately after deploy.
• No Redis, no init job. enable_redis = false and no db-init job runs; the pod is ready as soon as the container starts.
• Container port 80. Filebrowser serves plain HTTP/1.1 on port 80.
• Custom domain is on by default. enable_custom_domain = true and reserve_static_ip = true; supply application_domains to serve a hostname with a Google-managed certificate.

---

2. Google Cloud Services & How to Explore Them

All commands assume you have run gcloud container clusters get-credentials <cluster> --region <region> --project <project> and that PROJECT, REGION, and NAMESPACE are set. The namespace and other identifiers are reported in the deployment Outputs.

A. GKE Autopilot — the Filebrowser workload

Filebrowser runs as a single-replica StatefulSet (stateful_pvc_enabled = true, the default; a Deployment when it is false) scheduled on Autopilot, which bills for the CPU/memory the pod actually requests.

• Console: Kubernetes Engine → Workloads → select the Filebrowser workload to see pods, revisions, and events. Kubernetes Engine → Services & Ingress shows the Service and any external IP.
• CLI:

  kubectl get pods,svc -n "$NAMESPACE"
  kubectl get statefulset,pvc -n "$NAMESPACE"          # when stateful_pvc_enabled = true
  kubectl logs -n "$NAMESPACE" deploy/<service-name> --tail=100

See App_GKE for how Autopilot, scaling, and the workload type (Deployment vs StatefulSet) are managed.

B. Cloud Storage / block PVC — persistent state

Filebrowser has no Cloud SQL database. Its embedded SQLite database (/database/filebrowser.db) is stored on the /database mount:

• Default — StatefulSet (stateful_pvc_enabled = true): a block PersistentVolumeClaim (default 20Gi, StorageClass standard-rwo) mounted at /database; the GCS FUSE volume is disabled to avoid a double-mount. Keep it on: Filebrowser's database is bbolt, which writes at arbitrary offsets that GCS FUSE rejects.

• Deployment (stateful_pvc_enabled = false): a dedicated Cloud Storage bucket mounted via GCS FUSE through the CSI driver.

• Console: Cloud Storage → Buckets; or Kubernetes Engine → Storage → PVCs.

• CLI:

  gcloud storage buckets list --project "$PROJECT" --filter="name~storage"   # GCS FUSE mode
  gcloud storage ls gs://<data-bucket>/filebrowser.db
  kubectl get pvc -n "$NAMESPACE"                                            # PVC mode

See App_GKE for CMEK options, GCS FUSE, and StatefulSet PVCs.

C. Secret Manager

Filebrowser generates no application secrets — there is no encryption key or JWT secret to manage, because all identity state lives in the SQLite database. Secret Manager is still used by the foundation for platform-managed secrets (e.g. CI/CD tokens if configured).

• Console: Security → Secret Manager.
• CLI:

  gcloud secrets list --project "$PROJECT" --filter="name~filebrowser"

See App_GKE for the Secret Store CSI integration and rotation.

D. Networking & ingress

By default the Service is ClusterIP, with enable_custom_domain = true and reserve_static_ip = true so an Ingress with a Google-managed certificate can serve a supplied hostname on a stable IP. Without a custom domain the workload is reachable in-cluster at http://<service>.<namespace>.svc.cluster.local.

• Console: Network services → Load balancing; VPC network → IP addresses.
• CLI:

  kubectl get ingress,svc -n "$NAMESPACE"
  gcloud compute addresses list --project "$PROJECT"

See App_GKE for custom domains, Cloud CDN, and static IP details.

E. Cloud Logging & Monitoring

Pod stdout/stderr flow to Cloud Logging; GKE metrics flow to Cloud Monitoring. Optional uptime checks and alert policies are available.

• Console: Logging → Logs Explorer; Monitoring → Dashboards / Alerting.
• CLI:

  gcloud logging read 'resource.type="k8s_container" AND resource.labels.namespace_name="'"$NAMESPACE"'"' \
    --project "$PROJECT" --limit 50

---

3. Filebrowser Application Behaviour

• No first-deploy database setup. There is no db-init job and no Cloud SQL instance. On first start the Filebrowser binary creates its SQLite database at /database/filebrowser.db if it does not already exist and seeds the default admin/admin user.
• State persistence. Users, settings, and share links live entirely in /database/filebrowser.db on the /database mount (GCS FUSE bucket or block PVC), surviving restarts and redeploys. FB_ROOT = /srv is the file tree the app serves.
• Default credentials must be changed. The seeded admin/admin login is well-known. Log in and change the password (and ideally the username) in the web UI immediately after the first deploy.
• Single-writer constraint. The embedded SQLite database does not support concurrent writers. Keep min_instance_count = max_instance_count = 1; a StatefulSet block PVC gives proper file locking but is still single-replica.
• Health path. Startup and liveness probes target /health — Filebrowser's unauthenticated health endpoint, which returns 200 as soon as the server is listening:

  kubectl exec -n "$NAMESPACE" deploy/<service-name> -- wget -qO- http://localhost:80/health

• No Redis. enable_redis = false; Filebrowser is a self-contained file manager with no queue or cache. The App_GKE default of enable_redis = true is explicitly overridden.
• Custom-built image needs imagePullPolicy = Always. The image is a thin wrapper built and mirrored into Artifact Registry; App_GKE sets imagePullPolicy = Always for custom/mirrored images so a rebuild-redeploy always pulls the fresh layer.

---

4. Configuration Variables

Variables are grouped exactly as they appear on the deployment platform. Only settings specific to or notable for Filebrowser are listed; every other input is inherited from App_GKE with its standard behaviour and defaults.

Group 1 — Project & Identity

Variable	Default	Description
project_id	(required)	Target Google Cloud project.
region	us-central1	Region for the workload and regional resources.

Group 3 — Application Identity

Variable	Default	Description
application_name	filebrowser	Base name for resources. Do not change after first deploy.
application_version	latest	Filebrowser image tag. latest resolves to the pinned v2.32.0 at build time; pin explicitly in production.

Group 4 — Runtime & Scaling

Variable	Default	Description
deploy_application	true	Set false to provision infrastructure only.
cpu_limit	1000m	CPU per pod; Filebrowser is lightweight.
memory_limit	1Gi	Memory per pod; 256Mi is ample for the Go server.
min_instance_count	1	Minimum replicas. Keep at 1 — SQLite is single-writer.
max_instance_count	1	Keep at 1 to prevent concurrent SQLite writers.
container_port	80	Filebrowser's HTTP/1.1 listener.
enable_cloudsql_volume	false	Filebrowser has no Cloud SQL; leave false.
enable_image_mirroring	true	Mirror the Filebrowser image into Artifact Registry.

Group 6 — GKE Backend & Cluster

Variable	Default	Description
service_type	LoadBalancer	How the Kubernetes Service is exposed; front with an Ingress via enable_custom_domain.
workload_type	null	Auto-resolves to StatefulSet when stateful_pvc_enabled = true, else Deployment.
session_affinity	None	Single replica, so sticky routing is unnecessary.

Group 7 — StatefulSet

Variable	Default	Description
stateful_pvc_enabled	true	Set true to store /database on a block PVC instead of GCS FUSE (recommended for SQLite file locking).
stateful_pvc_size	20Gi	Per-pod PVC storage size.
stateful_pvc_mount_path	/database	Mount path — must match FB_DATABASE's directory.
stateful_pvc_storage_class	standard-rwo	StorageClass (standard-rwo Balanced PD; premium-rwo for higher IOPS).

Group 9 — Reliability Policies

Variable	Default	Description
enable_pod_disruption_budget	true	Protect availability during node upgrades.
pdb_min_available	1	Minimum pods available during voluntary disruptions.

Group 10 — Observability & Health

Variable	Default	Description
startup_probe	HTTP /health 15s delay	Startup probe; Filebrowser exposes /health once ready.
liveness_probe	HTTP /health 30s delay	Liveness probe on the unauthenticated /health endpoint.
uptime_check_config	{enabled=false, path="/health"}	Cloud Monitoring uptime check; disabled by default.
alert_policies	[]	Optional metric alert policies.

Group 13 — Filesystem (NFS)

Variable	Default	Description
enable_nfs	false	NFS is off by default; not needed for Filebrowser.
nfs_mount_path	/mnt/nfs	Mount path inside the container.

Group 14 — Cloud Storage & Artifact Registry

Variable	Default	Description
create_cloud_storage	true	Create the Filebrowser /database bucket (and any extra storage_buckets).
storage_buckets	[]	Additional buckets to provision.
gcs_volumes	[]	Extra GCS FUSE mounts. The /database bucket is added automatically (unless a PVC is used).
manage_storage_kms_iam / enable_artifact_registry_cmek	false	CMEK options.

Group 15 — Redis Cache & Queue

Variable	Default	Description
enable_redis	false	Inherited from App_GKE and not overridden by this module. Filebrowser uses no Redis, so set it to false when deploying — leaving it on wires an unused dependency.

Group 16 — Database Backend

Not applicable — Filebrowser has no SQL database. database_password_length and db_name / db_user are forwarded to the foundation only for compatibility; database_type is fixed to NONE by Filebrowser_Common.

Group 19 — Custom Domain, Static IP & Networking

Variable	Default	Description
enable_custom_domain	true	Provision Ingress for custom hostnames + managed certificate.
application_domains	[]	Hostnames to serve.
reserve_static_ip	true	Stable external IP across redeploys.

Group 20 — Identity-Aware Proxy (IAP)

Variable	Default	Description
enable_iap	false	Require Google sign-in in front of Filebrowser.
iap_authorized_users / iap_authorized_groups	[]	Who may access.
iap_oauth_client_id / iap_oauth_client_secret	""	Required when IAP is enabled (sensitive).

Group 22 — VPC Service Controls & Audit Logging

Variable	Default	Description
enable_vpc_sc	false	Enforce a VPC-SC perimeter (requires organization_id).
vpc_cidr_ranges / vpc_sc_dry_run	(set)	Access level CIDRs / dry-run mode.
enable_audit_logging	false	Detailed Cloud Audit Logs.

All other inputs follow standard App_GKE behaviour.

---

5. Outputs

These values are returned on a successful deployment and are the quickest way to locate and explore the running resources.

Output	Description
service_name	Kubernetes Service name.
namespace	Namespace the workload runs in.
service_cluster_ip	In-cluster ClusterIP.
stage_service_cluster_ips	Map of ClusterIPs for stage-specific services.
service_external_ip	External LoadBalancer IP (when a static IP is reserved).
service_url	URL to reach Filebrowser.
storage_buckets	Created Cloud Storage buckets (includes the /database bucket in GCS FUSE mode).
network_name / network_exists / regions	VPC network, presence, available regions.
container_image / container_registry	Deployed image and Artifact Registry repo.
monitoring_enabled / monitoring_notification_channels	Monitoring status and channels.
initialization_jobs	Names of any init jobs (empty by default).
statefulset_name	Name of the StatefulSet (when stateful_pvc_enabled = true).
deployment_id / tenant_id / resource_prefix	Naming identifiers.
project_id / project_number	Project identifiers.
cicd_enabled / cicd_configuration	CI/CD status and details (repo, trigger, registry).
github_repository_url / github_repository_owner / github_repository_name	CI/CD GitHub details.
artifact_registry_repository / cloudbuild_trigger_name / cloudbuild_trigger_id	Registry and build trigger.
kubernetes_ready	Whether the cluster/workload is ready.
vpc_sc_enabled / vpc_sc_perimeter_name / vpc_sc_dry_run_mode	VPC-SC status.
audit_logging_enabled / artifact_registry_cmek_enabled	Audit logging and CMEK status.

---

6. Configuration Pitfalls & Sensible Defaults

Risk: Critical (data loss / outage / security) — High (service degraded) — Medium (cost or partial degradation) — Low (minor).

Inherited plan-time validation. This module passes its configuration through the App_GKE foundation engine, which validates values and combinations at plan time — IAP with no OAuth credentials, min_instance_count > max_instance_count, workload_type = Deployment alongside stateful_pvc_enabled = true, ResourceQuota memory values without binary unit suffixes. Invalid configuration fails the plan with a clear, named error before any resource is created, so most mistakes below are caught up front rather than at apply or runtime.

Setting	Sensible value	Risk	Consequence if wrong
/database volume (bucket or PVC)	Never delete	Critical	The embedded SQLite DB lives here; deleting it destroys all users, settings, and share links.
admin / admin (seeded login)	Change on first login	Critical	Leaving the default credential lets anyone who can reach the service take full control.
max_instance_count	1	High	>1 puts concurrent writers on the single SQLite database, corrupting it.
stateful_pvc_mount_path	/database	High	Must match FB_DATABASE's directory; a mismatch stores the DB on ephemeral disk and loses state on restart.
stateful_pvc_enabled + enable_gcs_storage_volume	Let Common disable GCS FUSE	High	Both at /database double-mount; Common auto-sets enable_gcs_storage_volume = false when the PVC is on — do not force both.
container_port	80	High	Filebrowser listens on 80; a different port makes the startup probe fail and the pod never becomes Ready.
startup_probe / liveness_probe path	/health	High	Pointing probes at an authenticated path returns 401/403 and the pod never goes Ready.
enable_cloudsql_volume	false	Medium	Filebrowser has no Cloud SQL; enabling adds a useless Auth Proxy sidecar.
enable_redis	true	Medium	Filebrowser has no Redis, but the App_GKE default of true is inherited unchanged — set it to false explicitly, or an unused dependency is wired in.
enable_iap	credentials required	High	Enabling IAP without iap_oauth_client_id/secret silently exposes the service unauthenticated (blocked by a plan-time guard).
application_version	pin in production	Medium	latest resolves to a pinned v2.32.0 at build time; pin explicitly to control upgrades.

---

For the foundation behaviour referenced throughout — IAM and Workload Identity, autoscaling, ingress and certificates, CI/CD, Cloud Armor, IAP, Binary Authorization, VPC-SC, backups, and image mirroring — see App_GKE. Filebrowser-specific application configuration shared with the Cloud Run variant is described in Filebrowser_Common.

Related guides

• Hands-on lab: Filebrowser on GKE Autopilot — deploy it step by step, with the console screens and commands at each stage.
• Filebrowser Common — Shared Application Configuration — the configuration shared by both deployment targets.
• Deployed alongside Kopia on GKE Autopilot, UrBackup on GKE Autopilot in the Backup & Disaster Recovery solution.