install.lock: where to put it, and how to upgrade with it

The install.lock file closes Dolibarr's installation pages. The right folder, the htdocs trap, and upgrade.unlock to upgrade without deleting it.

Versions concerned
Same logic in the installer of versions 19, 22 and 24 · tested on 24.0.1
What was checked
Tested on 12 October 2026 on a Dolibarr 24.0.1 test instance installed with the web installer: no install.lock created, warning recorded on the home page; file placed in the documents folder, then in htdocs; installation and upgrade pages opened with and without upgrade.unlock; messages recorded in French, English and German. Code read: install/inc.php (19.0.4, 22, 24.0.1), install/step5.php and index.php (24.0.1), start-up script of the official 24.0.1 Docker image.

After an installation, Dolibarr’s home page shows administrators:

Warning, once setup is finished, you must disable the installation/migration tools by adding a file install.lock into directory /var/www/documents. Omitting the creation of this file is a grave security risk.

The path shown is your documents folder. That is exactly where the file goes.

Why the installer does not create it

Without this file, anyone can open /install/ on your server and run the installer again. Yet the web installer does not create it: on the test instance, there was no install.lock after the last step.

This is intentional, and the code says why: a file created by the installer would belong to the web server, which could therefore delete it too. Dolibarr prefers to ask you to create it yourself, with another account.

Creating it

The documents folder is the one on the $dolibarr_main_data_root line of your conf.php. On a Linux server:

sudo touch /path/to/documents/install.lock
sudo chmod 444 /path/to/documents/install.lock

The file can stay empty. Created with sudo, it belongs to root: the web server can read it, not delete it. Reload the home page: the warning is gone.

With the official dolibarr/dolibarr Docker image, the start-up script creates it itself in /var/www/documents/ at the end of the automatic installation, which is on by default with a MariaDB or MySQL database.

What the installation pages show next

Every page under /install/ now displays:

The install/upgrade pages have been disabled for security (by the existence of a lock file install.lock in the dolibarr documents directory).

That is the expected behaviour.

The htdocs trap

Dolibarr also accepts an install.lock at the root of htdocs/: the installation pages are then closed as well. But the home page warning only looks in the documents folder. On the test instance, with the file only in htdocs/, installation was blocked and the warning was still shown. Put it in the documents folder.

Upgrading without deleting it

For an upgrade, there is no need to remove install.lock. Add an upgrade.unlock file next to it:

sudo touch /path/to/documents/upgrade.unlock

The upgrade pages open again, while the fresh-install pages stay closed: on the test instance, the check page was displayed, the initial configuration page was not. Once the upgrade is done, delete upgrade.unlock.

The full method, before, during and after, is in Dolibarr upgrade: checklist and upgrade path.

Delete install.lock or create upgrade.unlock?

The message on the closed pages offers both: “you must remove the file install.lock (or create a file upgrade.unlock for upgrade)”. For an upgrade, always choose upgrade.unlock: it only reopens the upgrade, whereas deleting install.lock also reopens a fresh installation.

See also

Dolibarrinstall.lockupgrade.unlockinstallationupgradesecuritydocuments