Use Figma or Self-Host Penpot on Linux

Figma runs in any modern browser on Linux without the native app that exists on macOS and Windows. Penpot is the open-source alternative you can self-host on your own machine or server using Docker Compose. This guide covers both paths: using Figma reliably in Chromium-family browsers and standing up a full Penpot instance locally.

Figma in the Browser on Linux

Figma dropped its Electron-based Linux desktop app in 2021 and has not replaced it. The browser version is fully featured and performs well in Chromium or Chrome. Firefox works for viewing and light editing but lacks WebGL2 reliability for complex files — use Chromium-based browsers for serious work.

Install Chromium or Google Chrome

Debian/Ubuntu:

sudo apt update && sudo apt install -y chromium-browser

Fedora:

sudo dnf install -y chromium

Arch:

sudo pacman -S chromium

For Google Chrome specifically (needed for some Figma font features), download the .deb or .rpm from google.com/chrome and install it:

# Debian/Ubuntu
sudo dpkg -i google-chrome-stable_current_amd64.deb
sudo apt -f install

# Fedora/RHEL
sudo dnf install ./google-chrome-stable_current_x86_64.rpm

Font Rendering in Figma

Figma uses fonts installed on your system via the Figma Font Helper — a small background daemon. Download it from figma.com/downloads (Linux .zip). Extract and run the helper before opening Figma:

unzip figma-linux-font-helper.zip -d ~/figma-font-helper
cd ~/figma-font-helper
chmod +x install.sh
./install.sh

The installer places a systemd user service. Enable and start it:

systemctl --user enable --now figma-fonthelper.service

Verify it is running:

systemctl --user status figma-fonthelper.service

After this, refresh Figma in the browser and local fonts appear in the font picker.

Wayland Notes

Chromium on Wayland (GNOME or KDE Plasma 6) renders natively with Ozone. Launch it with the flag to avoid XWayland blurriness on HiDPI screens:

chromium --ozone-platform=wayland --enable-features=WaylandWindowDecorations

To make this permanent, add the flags to ~/.config/chromium-flags.conf:

echo '--ozone-platform=wayland
--enable-features=WaylandWindowDecorations' > ~/.config/chromium-flags.conf

Self-Hosting Penpot with Docker Compose

Penpot is a Figma-compatible open-source design tool. Self-hosting gives you full data control, offline access, and no seat limits. The official distribution uses Docker Compose with four services: frontend (nginx), backend, exporter (headless Chromium for PDF/PNG export), and PostgreSQL + Redis.

Install Docker and Docker Compose

Debian/Ubuntu — use Docker's official repo, not the older docker.io package:

sudo apt install -y ca-certificates curl gnupg
sudo install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo $VERSION_CODENAME) stable" \
  | sudo tee /etc/apt/sources.list.d/docker.list
sudo apt update && sudo apt install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Fedora:

sudo dnf -y install dnf-plugins-core
sudo dnf config-manager --add-repo https://download.docker.com/linux/fedora/docker-ce.repo
sudo dnf install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin

Arch:

sudo pacman -S docker docker-compose

Enable and start the Docker daemon, then add your user to the docker group so you can run containers without sudo:

sudo systemctl enable --now docker
sudo usermod -aG docker $USER
newgrp docker

Download the Penpot Docker Compose File

Penpot publishes an official docker-compose.yaml. Pull the latest version directly:

mkdir -p ~/penpot && cd ~/penpot
curl -o docker-compose.yaml https://raw.githubusercontent.com/penpot/penpot/main/docker/images/docker-compose.yaml

Configure the Environment

The compose file references a config.env file. Create a minimal one for local use. For a production-facing instance you must configure SMTP and set a strong secret key.

cat > config.env << 'EOF'
PENPOT_FLAGS=enable-registration enable-login-with-password
PENPOT_SECRET_KEY=$(openssl rand -hex 32)
PENPOT_POSTGRESQL_DATABASE=penpot
PENPOT_POSTGRESQL_USERNAME=penpot
PENPOT_POSTGRESQL_PASSWORD=penpot
PENPOT_REDIS_URI=redis://penpot-redis/0
EOF

Important: The $(openssl rand -hex 32) in a heredoc runs at write time, so your key is embedded immediately. Double-check with grep SECRET config.env to confirm it is not a literal string.

Start Penpot

cd ~/penpot
docker compose up -d

First run pulls several images (totaling ~2 GB). Watch progress:

docker compose logs -f

Wait until you see the backend log line indicating the HTTP server is listening (typically on port 6060 internally). The frontend is exposed on port 9001 by default.

Create the First Admin User

With registration enabled (set in config.env above), open http://localhost:9001 in your browser and register an account. The first registered user becomes the owner. If you want to disable open registration afterwards, remove enable-registration from PENPOT_FLAGS and restart:

docker compose restart penpot-backend penpot-frontend

Persist Data and Upgrade

Penpot stores files in named Docker volumes (penpot_postgres_v15 and penpot_assets) defined in the compose file. They survive docker compose down. To upgrade Penpot, pull new images and recreate the containers:

docker compose pull
docker compose up -d

Verification

For Figma: open https://www.figma.com in Chromium, create or open a file, and confirm local fonts appear in the font picker after the Font Helper service is running.

For Penpot: check that all four containers are healthy:

docker compose ps

Expected output shows penpot-frontend, penpot-backend, penpot-exporter, penpot-postgres, and penpot-redis all in a running or Up state. Then log in at http://localhost:9001, create a new project, draw a shape, and export it as PNG to confirm the exporter service works end-to-end.

Troubleshooting

Figma fonts not showing

Confirm the user service is running with systemctl --user status figma-fonthelper.service. If it failed, check journalctl --user -u figma-fonthelper.service for missing library errors — on minimal installs you may need libappindicator3-1 or equivalent.

Penpot backend keeps restarting

Usually a config.env issue. Run docker compose logs penpot-backend and look for database connection errors. Confirm the PostgreSQL container is healthy first: docker compose exec penpot-postgres pg_isready. Also verify the PENPOT_SECRET_KEY is not empty.

Port 9001 already in use

Edit docker-compose.yaml and change the host-side port mapping (left side of the colon) for the frontend service to a free port, for example "9002:80", then run docker compose up -d again.

Penpot exporter fails on Fedora with SELinux

The exporter runs headless Chromium inside the container and may be blocked by SELinux in enforcing mode. Add :z volume labels in the compose file or temporarily check with sudo setenforce 0 to confirm SELinux is the cause, then write a proper policy or file a bug report with Penpot upstream.