Nextcloud has an update button. The Document Server does not — its Docker container is updated by replacing it, and doing that carelessly is how healthy integrations break on a quiet afternoon. Followed in the right order, the update is a calm fifteen minutes.
A common misunderstanding: updating Nextcloud or its connector app does not update the Document Server. The server lives in its own Docker container, on its own release cycle, and you update it by stopping the old container and starting the new image — with your existing data volumes and the exact same settings attached. This page follows the update procedure OnlyOffice itself documents, with the two details that decide whether Nextcloud notices anything happened at all.
Before touching anything, ask Docker how the running container was started. The official update guide begins exactly here, because the new container must mount the same folders:
sudo docker inspect --format='{{range $p,$conf:=.HostConfig.Binds}}{{$conf}};{{end}}' CONTAINER_ID
Note the volume paths it prints — typically the logs, data and library folders such as /var/log/onlyoffice, /var/www/onlyoffice/Data and /var/lib/onlyoffice on the host. Note your JWT_SECRET too. If the paths or the secret change during the update, the new container starts empty and secret-mismatched — and you will meet the Download failed and token errors from our other guides.
An update restarts the editing service. Anyone with a document open will lose their live session, and unsent changes can be lost with it. Schedule the update outside working hours or announce it, and ask users to close their documents first. Two minutes of politeness beats a morning of recovering a half-edited spreadsheet.
Stop the current container, then download the latest image:
sudo docker stop CONTAINER_ID
sudo docker pull onlyoffice/documentserver:latest
Nothing is deleted yet. The old container still exists, stopped, as your way back if the new one misbehaves.
Now run the new image using the same port, same volume paths and same JWT_SECRET you recorded in step 1:
sudo docker run -i -t -d -p 80:80 --restart=always -e JWT_SECRET=your-own-secret-here -v /app/onlyoffice/logs:/var/log/onlyoffice -v /app/onlyoffice/data:/var/www/onlyoffice/Data -v /app/onlyoffice/lib:/var/lib/onlyoffice onlyoffice/documentserver
(Your actual host paths come from your inspect output — the ones above are the common example.) This sameness is the entire secret of a boring update: to Nextcloud, the server simply blinked.
Wait for the container to come up, open a document from Nextcloud, make an edit, close it, and confirm the change saved. Also confirm the welcome page loads at the Document Server address. Only after real documents work should you remove the old stopped container and image to reclaim space. If something fails, the old container is still there — start it again and investigate with a working system behind you, not a broken one.
The full OnlyOffice Document Server install and Nextcloud integration, shown live step by step.
▶️ Watch Full VideoNo. The Document Server is a separate service in its own Docker container with its own release cycle. Nextcloud and connector updates happen in the Nextcloud admin; Document Server updates happen with Docker on the server.
Nextcloud signs its requests with the secret stored in the connector settings. If the new container starts with a different secret, every request is rejected with a token error until you change one side to match. Keeping the same secret makes the update invisible to the integration.
If you only stopped the old container instead of deleting it, you can start it again and be back on the previous version while you investigate. This is why the safe order is stop, test the new container properly, and only then remove the old one.