BookStack vs October CMS

What BookStack is

BookStack is an MIT-licensed, self-hosted documentation application built around shelves, books, optional chapters and pages. It provides role and content-level permissions, multiple enterprise authentication options and a permission-aware REST API, but the operator remains responsible for the PHP and database stack, upgrades, filesystem permissions, security configuration and complete database-plus-file backups.

What October CMS is

October CMS is a self-hosted PHP CMS and application platform built on Laravel. Its source is public, but the platform is licensed under October's EULA rather than a standard permissive open-source license: each production website needs a project license, with development and staging environments for that same website covered. New accounts receive one complimentary license with one year of updates; an expired perpetual license keeps running but loses Update Gateway access. Hosting, database, deployment, backups and plugin governance remain the operator's responsibility.

What BookStack is built to do

Book hierarchy

Organizes page content within optional chapters, books and reusable bookshelves.

Roles and permissions

Combines system roles with content-level overrides and inherited controls.

Federated authentication

Documents OIDC, SAML 2.0 and LDAP configuration for self-hosted instances.

REST API

Provides token-authenticated JSON endpoints governed by the API user's permissions.

What October CMS is built to do

Laravel foundation

Uses Laravel 12, Composer dependencies and Artisan commands for development and operations.

Themes and plugins

Separates presentation and extensible application behavior into project-controlled packages.

Roles and permissions

Controls backend access with users, custom roles, permission inheritance and super-user boundaries.

Multisite management

Manages domain, locale, theme and content variations from one installation.

Choose BookStack if

• Internal handbooks, runbooks and technical knowledge bases with a clear hierarchy
• Organizations needing self-hosting, role controls and supported identity integrations
• Teams that can automate upgrades, database and file backups, and restore drills

Skip BookStack if

• You need a vendor-operated SaaS with no infrastructure responsibility
• Your information model cannot fit shelves, books, chapters and pages
• You cannot preserve the database, uploads, configuration and original APP_KEY together

Choose October CMS if

• Custom content sites where Laravel-native development is an advantage
• Agencies that can standardize deployment, updates and plugin review across projects
• Multisite or multilingual builds after validating shared-installation and license boundaries

Skip October CMS if

• A fully managed SaaS CMS with vendor-operated backups and upgrades is required
• The organization requires an OSI-style permissive license without per-site production terms
• The team cannot maintain PHP, Composer dependencies, plugins, database migrations and recovery

BookStack: pros & cons

• Predictable structure: Shelves, books, chapters and pages give teams a constrained documentation hierarchy.
• Granular access: Roles can be combined and overridden at shelf, book, chapter or page level.
• Authentication choices: Official administration docs cover OpenID Connect, SAML 2.0 and LDAP.
• Automation surface: The REST API covers content and administrative resources while enforcing the API user's roles and permissions.
• Self-hosting burden: PHP, MySQL or MariaDB, web-server configuration, updates and monitoring are operator responsibilities.
• Manual recovery design: There is no built-in full backup and restore; both database records and instance files must be protected.
• Key dependency: Restores need the original APP_KEY for encrypted features such as multi-factor credentials.
• Hierarchy trade-off: The book metaphor is approachable but may constrain teams needing free-form graphs or complex publishing workflows.

October CMS: pros & cons

• Developer-oriented stack: Laravel, Composer, Artisan, Twig themes and plugins support code-first customization.
• Self-hosted ownership: Application code, configuration, content database and deployment environment stay under the operator's control.
• Editorial controls: Backend users, roles, permissions and multisite content support governed authoring workflows.
• Flexible deployment: Composer/SSH and an official no-shell Deploy plugin cover different hosting environments.
• Production licensing: Public source does not remove the per-website license and EULA requirements.
• Updates depend on renewal: The site keeps running after expiry, but gateway updates and Marketplace access require an active license.
• Self-hosted operations: PHP, database, web server, secrets, patches, backups and recovery are the customer's responsibility.
• Extension risk: Marketplace or custom plugins add separate maintenance, compatibility, security and license surfaces.