LibreChat in Docker. Every AI model, one chat.

Architecture at a glance

• LibreChat serves the UI and API on port 3080. TLS is terminated upstream by a reverse proxy (Traefik on the RemarkableCloud App Platform).
• MongoDB is a separate database container and holds users, conversations, and messages.
• Data volumes hold the generated secrets (/app/rc-data), uploaded files (/app/uploads), and images (/app/client/public/images).
• LLM providers are external: each user adds their own provider API key in the UI (encrypted at rest).

Docker Compose walkthrough

The standalone stack (LibreChat and MongoDB) is defined in the image’s docker-compose.yml:

name: librechat
services:
  mongo:
    image: mongo:7
    restart: unless-stopped
    environment:
      MONGO_INITDB_ROOT_USERNAME: librechat
      MONGO_INITDB_ROOT_PASSWORD: ${DB_PASSWORD:-change-me-db}
    volumes: [mongo-data:/data/db]
  librechat:
    image: ${LIBRECHAT_IMAGE:-ghcr.io/remarkablecloud/librechat:0.8.7-r1}
    restart: unless-stopped
    depends_on: [mongo]
    ports: ["${HTTP_PORT:-3080}:3080"]
    environment:
      MONGO_URI: mongodb://librechat:${DB_PASSWORD:-change-me-db}@mongo:27017/LibreChat?authSource=admin
      RC_USER_EMAIL: ${RC_USER_EMAIL:-}
      RC_USER_PASSWORD: ${RC_USER_PASSWORD:-}
    volumes:
      - librechat-data:/app/rc-data
      - librechat-uploads:/app/uploads
      - librechat-images:/app/client/public/images
volumes:
  mongo-data:
  librechat-data:
  librechat-uploads:
  librechat-images:

Step by step:

1. MongoDB holds all chat state. The authSource=admin in the URI matches Mongo’s root user.
2. The initial account is created for you. On first run the image creates an account (or uses RC_USER_EMAIL/RC_USER_PASSWORD) and logs the login once; open registration stays off.
3. Only the app port is exposed. ${HTTP_PORT:-3080}:3080 is for local use; in production the proxy connects to port 3080 on the internal network.
4. State lives in volumes. The three LibreChat volumes plus mongo-data persist across restarts and upgrades.

To start it locally:

DB_PASSWORD=$(openssl rand -hex 16) docker compose up -d

Then read the login from docker compose logs librechat, open http://localhost:3080, sign in, and add your LLM provider API key in the UI.

Environment variable reference

These are wired automatically by the App Platform backend from the managed MongoDB; they are listed here for standalone and self-hosted runs.

Variable	Required	Value / default	Purpose
MONGO_URI	yes	mongodb://<user>:<pass>@<host>:27017/<db>?authSource=admin	MongoDB connection.
RC_USER_EMAIL	no	admin@example.com	Initial account email.
RC_USER_PASSWORD	no	(generated)	Initial account password. Leave empty to auto-generate on first run (printed once).
CREDS_KEY / CREDS_IV	no	(generated)	Encrypt stored provider keys. Auto-generated and persisted; keep stable.
JWT_SECRET / JWT_REFRESH_SECRET	no	(generated)	Sign auth tokens. Auto-generated and persisted.

ALLOW_REGISTRATION=false and SEARCH=false are baked into the image.

Hardening notes

• No self-registration. Only the created account can sign in; enable registration later in the config if you want more users.
• Stable encryption keys. The keys that encrypt stored provider credentials are generated once and persisted, so a restart never orphans them.
• No baked credentials. All secrets are generated at runtime or supplied by you, never stored in an image layer.
• Digest-pinned base. Each build is auditable and reproducible.
• Keep MongoDB private. Do not publish its port to the host or the internet.

Backups

Capture the database and the data volumes together:

1. The MongoDB database:

   docker compose exec mongo mongodump --username librechat --password "$DB_PASSWORD" \
     --authenticationDatabase admin --db LibreChat --archive > librechat-db.archive

2. The data volumes (secrets, uploads, images):

   for v in data uploads images; do
     docker run --rm -v librechat_librechat-$v:/data -v "$PWD":/backup alpine \
       tar czf /backup/librechat-$v.tgz -C /data .
   done

Keep the secrets volume (/app/rc-data) with the database backup: without the matching CREDS_KEY, stored provider keys cannot be decrypted. On the RemarkableCloud App Platform, database and volume backups follow the platform’s backup schedule.

Upgrades

• New builds ship as new -r tags. Pull the new tag and recreate the container; LibreChat applies any database changes it needs on start:

  docker compose pull librechat && docker compose up -d librechat

• Back up first, and keep the database archive and the /app/rc-data archive from just before the upgrade.
• Read the changelog. Every build is listed in CHANGELOG.md with the base image digest and any behavior changes.