1. Walking skeleton
2. Running the tests
3. Finish implementation of entries
4. Mini hackathon

A Flask application integrating the GOV.UK Design System with a realistic, containerised stack.

GOV.UK Frontend Flask App Template is a community tool of the GOV.UK Design System. The Design System team is not responsible for it and cannot support you with using it. Contact the maintainers directly if you need help or you want to request a feature.

• GOV.UK components built in – Accessible Jinja templates and WTForms helpers for compliant UI and forms.
• Secure Flask foundation – HTTPS, CSRF, CSP, rate limits, SQLAlchemy and migrations ready to go.
• Containerised by default – Nginx , PostgreSQL, Redis and Node pipeline managed via Docker Compose.
• Fast, lean builds – Multi-stage Dockerfiles, wheel caching, non-root runtime, and CI via GitHub Actions.
• Compliance-ready pages – 404/500 errors, cookie banner, accessibility statement included.
• Developer-first setup – Example blueprints, templates, macros, and GOV.UK-style flash messages for instant feedback.

Secure by default with hardened containers, strong HTTP headers and built-in rate limiting.

• Applies strict CSP, HSTS, and other security headers.
• CSRF protection via Flask-WTF, with safe error handling.
• Rate limiting backed by Redis using Flask-Limiter.
• Non-root containers with read-only filesystem for runtime services.
• Secrets and credentials injected via environment variables (no in-repo secrets).
• Dependency scanning and Python version pinning via CI workflows.

Optimised for speed and reliability through caching, minimal layers and lean builds.

• Multi-stage Docker builds minimise image size and attack surface.
• Static assets compiled once and cached efficiently.
• Connection pooling for SQLAlchemy database access.
• Redis caching support for transient or computed data.
• Nginx configured for compression and cache control.
• CI validates image build times and wheel caching efficiency.

Built to feel frictionless for rapid iteration, testing and deployment.

• Works identically across local and production environments.
• Uses docker compose watch for hot reloads of Python and static assets.
• Includes blueprints, forms, templates and example routes to extend quickly.
• Built-in error pages, logging and debug toolbar (development mode).
• Extensive comments and .env.example for easy onboarding.
• CI workflows for linting, tests, builds and security scans.

• Docker (Engine & Compose)

This project uses Docker Compose to provision containers:

flowchart TB
    compose(compose.yml)
    nginx(nginx:stable-alpine)
    node(node:kyrpton-alpine)
    postgres(postgres:18-alpine)
    python(python:3.14-slim)
    redis(redis:7-alpine)

    compose -- Creates --> App & Cache & Web & Database
    App -- Depends on --> Cache & Database
    Web -- Depends on --> App

    subgraph Web
        direction TB
        node -- COPY /dist /static --> nginx
    end

    subgraph App
        python
    end

    subgraph Database
        postgres
    end

    subgraph Cache
        redis
    end

flowchart TB
    browser([Browser])
    db@{ shape: cyl, label: "PostgreSQL" }
    flask(Gunicorn/Flask)
    nginx(NGINX)
    redis(Redis)
    static@{ shape: lin-cyl, label: "Static files" }

    browser -- https:443 --> nginx -- http:5000 --> flask -- postgres:5432 --> db
    flask -- redis:6379 --> redis

    subgraph Web
        nginx -- Read --> static
    end

    subgraph App
        flask
    end

    subgraph Database
        db
    end

    subgraph Cache
        redis
    end

• Matt Shaw - Principal Software Developer at HM Land Registry

This software is provided "as-is" without warranty. Support is provided on a "best endeavours" basis by the maintainers and open source community.

For questions or suggestions, reach out to the maintainers listed above and the community of people using this project in the #govuk-design-system Slack channel.

Otherwise, please see the contribution guidelines for how to raise a bug report or feature request.