NocoDB
v1.0.0Spreadsheet-style database application for organizing data and building collaborative workflows.
x-arcane:
icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/nocodb.svg
urls:
- https://github.com/nocodb/nocodb#docker-with-pg
services:
nocodb:
image: nocodb/nocodb:latest
restart: unless-stopped
ports:
- "${BIND_ADDRESS:-127.0.0.1}:${APP_PORT:-8086}:8080"
environment:
NC_DB: pg://database:5432?u=nocodb&p=${DB_PASSWORD}&d=nocodb
NC_AUTH_JWT_SECRET: ${JWT_SECRET}
NC_PUBLIC_URL: ${BASE_URL:-http://localhost:8086}
volumes:
- nocodb-data:/usr/app/data
depends_on:
database:
condition: service_healthy
labels:
com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/nocodb.svg
database:
image: postgres:16-alpine
restart: unless-stopped
environment:
POSTGRES_DB: nocodb
POSTGRES_USER: nocodb
POSTGRES_PASSWORD: ${DB_PASSWORD}
volumes:
- nocodb-db:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U $${POSTGRES_USER} -d $${POSTGRES_DB}"]
interval: 5s
timeout: 5s
retries: 10
labels:
com.getarcaneapp.arcane.icon: https://cdn.jsdelivr.net/gh/selfhst/icons@main/svg/postgresql.svg
volumes:
nocodb-data:
nocodb-db:
BIND_ADDRESS=127.0.0.1
APP_PORT=8086
BASE_URL=http://localhost:8086
# Generate each separately with: openssl rand -hex 32
DB_PASSWORD=change-me-before-deploying
JWT_SECRET=change-me-before-deploying
README
The web interface binds to loopback by default. Open it on the Docker host or through an SSH tunnel. For LAN access, set BIND_ADDRESS to a trusted interface after completing account setup; use an authenticated HTTPS reverse proxy for remote access.
Generate separate DB_PASSWORD and JWT_SECRET values with openssl rand -hex 32, and set BASE_URL to your reachable URL. Hexadecimal passwords avoid reserved characters in the database connection string.
Open http://localhost:8086 and create the initial administrator before making the instance available to other users. Configure invitation and signup policies in the administration UI.
PostgreSQL is bundled without a published port. Back up both named volumes and retain JWT_SECRET across restarts.