NocoDB

NocoDB puts a spreadsheet-like interface and a REST API over a database: tables, views, forms. One container with its own SQLite store by default.

Last run on a host 8 Nov 2026

Pinned at 2026.10.1 (released 29 Oct 2026) · the newest upstream release

To try it: Docker, nothing else. See Try it locally.

To deploy it behind the proxy: Traefik running and a domain.

Try it locally

On your own machine, with no proxy, domain or certificate. From apps/nocodb/:

cp .env.local.example .env.local

# The secrets ship empty; generate the ones this stack needs
echo "NC_AUTH_JWT_SECRET=$(openssl rand -hex 64)" >> .env.local

mkdir -p volumes/local/data
sudo chown 0:0 volumes/local/data

docker compose -f docker-compose.local.yml --env-file .env.local up -d

Then open http://localhost:8080. Stop it again with the same command and down.

Installation

From apps/nocodb/:

1. Copy the environment file and set APP_TRAEFIK_HOST, TZ and NC_ADMIN_EMAIL, then give the super-admin a password. NocoDB refuses to start while NC_ADMIN_EMAIL is set and the password is empty, and wants at least 8 characters with an uppercase letter, a number and a special character:

   cp .env.example .env
   NC_PW='Nc1!'"$(openssl rand -hex 12)"; echo "$NC_PW"   # store it now
   sed -i "s|^NC_ADMIN_PASSWORD=.*|NC_ADMIN_PASSWORD=${NC_PW}|" .env
   unset NC_PW

2. Generate the secret that signs every API token NocoDB issues:

   mkdir -p .secrets
   openssl rand -hex 64 > .secrets/nc_jwt_secret.txt

   Copy it off the host now.

3. Create the data directory and hand it to root. NocoDB runs as root without capabilities, so it cannot write into a directory another user owns:

   mkdir -p volumes/data
   sudo chown 0:0 volumes/data

4. Start it and wait for the first-boot initialisation, around thirty seconds:

   docker compose up -d
   docker compose logs nocodb-app --follow

   Wait for the dashboard line.

5. Over the VPN, open https://<APP_TRAEFIK_HOST> and log in with NC_ADMIN_EMAIL and the password from step 1 — the super-admin is created on the first start. Signup by anyone else is closed, because NC_INVITE_ONLY_SIGNUP is true in the shipped configuration.

Verify

docker compose ps   # one service, healthy

Then create a table, add a row, and create an API token under Details → API Tokens. Calling the API with that token is what confirms the signing secret is in place.

Going further

Pairing it with n8n

A table plus an API token is a data source for automation. In n8n, point an HTTP request at the internal Docker hostname if the two share a network, or at the Traefik hostname otherwise.

Using an external database

NocoDB can sit on top of a database you already run rather than its own SQLite store. If you point it there, that database holds the data and volumes/data becomes configuration only — which changes what the backup has to cover.

Backup

Database	SQLite inside volumes/data by default — no server, no dump hook
State	volumes/data — bases, views, uploaded attachments
Also needed	.secrets/nc_jwt_secret.txt
Quiescing	Required. Stop the container or snapshot the filesystem rather than copying a live SQLite file.

For borgmatic the default configuration is source_directories only, with quiescing.

The signing secret is what makes issued tokens valid. Restoring without it signs everyone out — recoverable, but it looks like a failed restore.

If this instance points at an external database, back that database up with the matching hook. volumes/data then holds configuration rather than the data.

Updates

1. Read the release notes. The version scheme moved from 0.x to calendar versions, so the numbers no longer compare the way they used to.

2. Back up volumes/data with the container stopped, and the secret with it.

3. Raise APP_TAG in .env, then:

   docker compose pull && docker compose up -d
   docker compose logs nocodb-app --follow

4. Open a base and call the API with an existing token. A migration that touched the token tables shows up on the second, not the first.

Troubleshooting

Everyone is signed out after a restore. The signing secret does not match. Put the original back.

Someone else is super-admin. The first signup claimed it before you did.

API tokens stop working after an update. Check the release notes for the versions crossed — the token format has changed across major steps.

Repository files

• apps/nocodb/README.md — setup, the n8n pattern, known issues
• apps/nocodb/UPSTREAM.md — source and upgrade checklist

Official sources

• NocoDB documentation