All templates

NocoDB

v1.0.0

Spreadsheet-style database application for organizing data and building collaborative workflows.

x-arcane:
  icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/nocodb.svg
  urls:
    - https://github.com/nocodb/nocodb#docker-with-pg

services:
  nocodb:
    image: nocodb/nocodb:latest
    restart: unless-stopped
    ports:
      - "${BIND_ADDRESS:-127.0.0.1}:${APP_PORT:-8086}:8080"
    environment:
      NC_DB: pg://database:5432?u=nocodb&p=${DB_PASSWORD}&d=nocodb
      NC_AUTH_JWT_SECRET: ${JWT_SECRET}
      NC_PUBLIC_URL: ${BASE_URL:-http://localhost:8086}
    volumes:
      - nocodb-data:/usr/app/data
    depends_on:
      database:
        condition: service_healthy
    labels:
      com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/nocodb.svg

  database:
    image: postgres:16-alpine
    restart: unless-stopped
    environment:
      POSTGRES_DB: nocodb
      POSTGRES_USER: nocodb
      POSTGRES_PASSWORD: ${DB_PASSWORD}
    volumes:
      - nocodb-db:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
      interval: 5s
      timeout: 5s
      retries: 10
    labels:
      com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/postgresql.svg

volumes:
  nocodb-data:
  nocodb-db:

README

The web interface binds to loopback by default. Open it on the Docker host or through an SSH tunnel. For LAN access, set BIND_ADDRESS to a trusted interface after completing account setup; use an authenticated HTTPS reverse proxy for remote access.

Generate separate DB_PASSWORD and JWT_SECRET values with openssl rand -hex 32, and set BASE_URL to your reachable URL. Hexadecimal passwords avoid reserved characters in the database connection string.

Open http://localhost:8086 and create the initial administrator before making the instance available to other users. Configure invitation and signup policies in the administration UI.

PostgreSQL is bundled without a published port. Back up both named volumes and retain JWT_SECRET across restarts.

Upstream deployment documentation.