6. Post-installation tasks

Creating your first administrator account

Open OVERLEAF_SITE_URL followed by /launchpad, for example http://192.0.2.10:30080/launchpad, and register the administrator account as in the Toolkit’s post-installation tasks. Then create an example project and compile it.

You can also create users from the command line:

kubectl -n overleaf exec deploy/overleaf -- bash -c \
  'cd /overleaf/services/web && node modules/server-ce-scripts/scripts/create-user.mjs --admin --email=[e-mail]'

It prints a link that sets the password.

Checking that compiles are sandboxed

Compile a project, then look at the node that runs the pod:

kubectl -n overleaf get pod -l app=overleaf -o wide   # NODE column
# on that node:
sudo docker ps -a --filter ancestor=ghcr.io/ayaka-notes/texlive-full:2026.1
ls -ln /srv/overleaf/compiles                          # owned by uid 33 (www-data)

Each compile shows up as a short-lived container named project-<project id>-<user id>-....

Logs and a shell

Toolkit	Kubernetes
bin/logs web	kubectl -n overleaf exec deploy/overleaf -- tail -f /var/log/overleaf/web.log
bin/shell	kubectl -n overleaf exec -it deploy/overleaf -- bash
bin/up	kubectl apply -f . then kubectl -n overleaf rollout restart deployment/overleaf

The container writes one log file per service in /var/log/overleaf/ (web.log, clsi.log, real-time.log, document-updater.log, …); kubectl logs shows the startup output.

Q&A

The compile fails or never finishes.

Answer: Check, on the node running the pod, that Docker is running and has the image named in TEX_LIVE_DOCKER_IMAGE, and that SANDBOXED_COMPILES_HOST_DIR_* match the hostPath paths. /var/log/overleaf/clsi.log in the pod names the failing step.

Users are logged out after every restart of the pod.

Answer: OVERLEAF_SESSION_SECRET is missing from the Secret overleaf-secrets, see step 2.