Docker

DBO Studio publishes a single-container image that serves the web UI and API together.

Quick start

bash
docker run -d \
  -p 9000:9000 \
  -v "$(pwd)/data:/backend/data" \
  ghcr.io/dbo-studio/dbo/dbo:latest

Open http://localhost:9000.

The image defaults to APP_PORT=9000 and APP_ENV=docker. App metadata and secrets live in /backend/data inside the container — always mount a volume there.

Docker Compose

From a directory that contains the production Compose file:

bash
mkdir -p docker/dbo
docker compose up -d
SettingValue
Imageghcr.io/dbo-studio/dbo/dbo:latest
Port9000:9000
Volume./docker/dbo:/backend/data
EnvironmentAPP_PORT=9000, APP_ENV=docker

For a host on the internet, also set APP_PUBLIC_URL, APP_ADMIN_EMAIL, APP_ADMIN_PASSWORD, and APP_ALLOWED_ORIGINS. See Configuration and Security.

Build the image yourself

bash
docker build -t dbo-local .
docker run -p 9000:9000 -v dbo-data:/backend/data dbo-local

The official tags are:

text
ghcr.io/dbo-studio/dbo/dbo:<VERSION>
ghcr.io/dbo-studio/dbo/dbo:latest

Development Compose

Hot-reload API + Vite UI plus optional sample databases. Not for production.

bash
docker compose -f docker-compose.dev.yml up -d

Frontend: http://localhost:3000. API: http://localhost:8080/api.

ServiceHost portCredentials
sample Postgres5432default / secret, database default
sample MySQL3307default / secret, database default
sample Postgres (TLS)5433same as Postgres, plus TLS

Override host ports with DB_TEST_PORT, MYSQL_TEST_PORT, and PGSQL_SSL_TEST_PORT — see Configuration.

Reverse proxy and TLS

Terminate TLS at nginx, Caddy, or a load balancer. Then set:

bash
APP_PUBLIC_URL=https://dbo.example.com
[email protected]
APP_ADMIN_PASSWORD=<8-40-chars-letter-and-number>
APP_ALLOWED_ORIGINS=https://dbo.example.com

Proxy /api and static assets to the container port. AI streaming uses WebSockets — allow those paths and give the proxy enough read/write timeout.

MCP

MCP clients need a public MCP URL. Either:

  • APP_PUBLIC_URL=https://dbo.example.com (MCP defaults to <url>/api/mcp), or
  • APP_MCP_PUBLIC_URL=https://dbo.example.com/api/mcp

Enable MCP in Settings → AI after the app is reachable at that URL.

Upgrades

  1. Back up the mounted volume (dbo.db, logs, app_secret.key).
  2. Pull the new tag: docker pull ghcr.io/dbo-studio/dbo/dbo:latest
  3. Recreate the container with the same volume.
  4. Schema migrations run on startup.

Data directory

text
/backend/data/
├── dbo.db              # connections, jobs, AI config, users
├── app_secret.key      # encrypts stored credentials
├── exports/            # web export output
└── logs/

Warning: If you skip the volume, the next container start is a new empty instance. Connection secrets encrypted with the old key cannot be read without app_secret.key.

Previous

Configuration

Next

Security