root: move media storage from /media to /data/media

Dockerfile

@@ -163,10 +163,11 @@ RUN apt-get update && \
     apt-get clean && \
     rm -rf /tmp/* /var/lib/apt/lists/* /var/tmp/ && \
     adduser --system --no-create-home --uid 1000 --group --home /authentik authentik && \
-    mkdir -p /certs /media /blueprints && \
+    mkdir -p /certs /data /media /blueprints && \
+    ln -s /media /data/media && \
     mkdir -p /authentik/.ssh && \
     mkdir -p /ak-root && \
-    chown authentik:authentik /certs /media /authentik/.ssh /ak-root
+    chown authentik:authentik /certs /data /data/media /media /authentik/.ssh /ak-root
 
 COPY ./authentik/ /authentik
 COPY ./pyproject.toml /

authentik/lib/default.yml

@@ -154,7 +154,7 @@ storage:
   media:
     backend: file # or s3
     file:
-      path: ./media
+      path: ./data/media
     s3:
       # How to talk to s3
       # region: "us-east-1"

docker-compose.yml

@@ -37,7 +37,7 @@ services:
     - ${COMPOSE_PORT_HTTPS:-9443}:9443
     restart: unless-stopped
     volumes:
-    - ./media:/media
+    - ./media:/data/media
     - ./custom-templates:/templates
   worker:
     command: worker
@@ -57,7 +57,7 @@ services:
     user: root
     volumes:
     - /var/run/docker.sock:/var/run/docker.sock
-    - ./media:/media
+    - ./media:/data/media
     - ./certs:/certs
     - ./custom-templates:/templates
 volumes:

scripts/generate_docker_compose.py

@@ -42,7 +42,7 @@
             "image": authentik_image,
             "ports": ["${COMPOSE_PORT_HTTP:-9000}:9000", "${COMPOSE_PORT_HTTPS:-9443}:9443"],
             "restart": "unless-stopped",
-            "volumes": ["./media:/media", "./custom-templates:/templates"],
+            "volumes": ["./media:/data/media", "./custom-templates:/templates"],
         },
         "worker": {
             "command": "worker",
@@ -62,7 +62,7 @@
             "user": "root",
             "volumes": [
                 "/var/run/docker.sock:/var/run/docker.sock",
-                "./media:/media",
+                "./media:/data/media",
                 "./certs:/certs",
                 "./custom-templates:/templates",
             ],

website/docs/releases/2025/v2025.12.md

@@ -0,0 +1,56 @@
+---
+title: Release 2025.12
+slug: "/releases/2025.12"
+---
+
+:::info
+2025.12 has not been released yet! We're publishing these release notes as a preview of what's to come, and for our awesome beta testers trying out release candidates.
+
+To try out the release candidate, replace your Docker image tag with the latest release candidate number, such as xxxx.x.0-rc1. You can find the latest one in [the latest releases on GitHub](https://github.com/goauthentik/authentik/releases). If you don't find any, it means we haven't released one yet.
+:::
+
+## Highlights
+
+## Breaking changes
+
+### /media mount moved to /data/media
+
+The `/media` mount has been moved to `/data/media`. Our provided docker-compose file has been updated to reflect this change. For other platforms, we have added a compatibility symlink to allow for backwards compatibility.
+
+## New features and improvements
+
+## Upgrading
+
+This release does not introduce any new requirements. You can follow the upgrade instructions below; for more detailed information about upgrading authentik, refer to our [Upgrade documentation](../install-config/upgrade.mdx).
+
+:::warning
+When you upgrade, be aware that the version of the authentik instance and of any outposts must be the same. We recommended that you always upgrade any outposts at the same time you upgrade your authentik instance.
+:::
+
+### Docker Compose
+
+To upgrade, download the new docker-compose file and update the Docker stack with the new version, using these commands:
+
+```shell
+wget -O docker-compose.yml https://goauthentik.io/version/xxxx.x/docker-compose.yml
+docker compose up -d
+```
+
+The `-O` flag retains the downloaded file's name, overwriting any existing local file with the same name.
+
+### Kubernetes
+
+Upgrade the Helm Chart to the new version, using the following commands:
+
+```shell
+helm repo update
+helm upgrade authentik authentik/authentik -f values.yaml --version ^xxxx.x
+```
+
+## Minor changes/fixes
+
+<!-- _Insert the output of `make gen-changelog` here_ -->
+
+## API Changes
+
+<!-- _Insert output of `make gen-diff` here_ -->