Apps / Docker Images
Metabase in Docker.
BI your team will use.
Metabase is the business intelligence tool your team will actually use: point it at a database, ask questions in a visual editor or SQL, and pin the answers to dashboards.
docker pull ghcr.io/remarkablecloud/metabase Current build
0.63.17.2-r1
Updated Sep 12, 2026
Base
Metabase OSS, digest-pinned
What's inside
Postgres app database, persisted encryption key, generated admin
Upstream license
Metabase: AGPL-3.0 (the open source edition; the separately licensed Enterprise edition is not used in this image).
Free to pull and run anywhere. Digest-pinned, updated deliberately; each build is recorded in the changelog.
The image
What our image adds.
Metabase is the business intelligence tool your team will actually use: point it at a database, ask questions in a visual editor or SQL, and pin the answers to dashboards.
PostgreSQL application database from day one
H2 is for demos; this stack keeps Metabase's own state in Postgres 16, which is the difference between a toy and a system of record.
Persisted encryption key
Data source credentials are encrypted at rest, and the key lives on a volume, so recreating the container never locks you out of your connections.
Generated admin on first boot
The administrator exists with a generated password before the port opens; the setup wizard is never claimable by a stranger.
Digest-pinned base, non-root runtime
Rebuilt and scanned on our schedule, not upstream's surprises.
Proxy-aware
MB_SITE_URL drives links, embeds and email; TLS terminates at your proxy.
The guide
Run it in production.
Architecture at a glance
Two containers: metabase (JVM app, port 3000 internal) and db (Postgres 16, Metabase’s own state). The databases you analyze are external connections you add in the UI; this stack stores the questions, dashboards and credentials, not your data warehouse.
Docker Compose walkthrough
Set DB_PASSWORD and SITE_URL, bring it up, read the generated admin credentials from the container log, log in, and connect your first data source. Give the JVM room: 2 GB RAM is a sane floor, more if many people run heavy questions concurrently.
Environment variable reference
| Variable | Purpose |
|---|---|
| MB_DB_TYPE / MB_DB_HOST / MB_DB_PORT / MB_DB_DBNAME / MB_DB_USER / MB_DB_PASS | Metabase’s own application database |
| MB_SITE_URL | Public https URL; drives links, embedding and email |
| Encryption key (persisted on volume) | Encrypts stored data source credentials at rest |
Hardening notes
Metabase holds credentials to every database you connect, which makes it the most sensitive app on the server. Keep it behind TLS, scope the database users you connect with to read-only wherever analysis doesn’t need writes, and leave the app database unreachable from outside the internal network.
Backups
Back up the Postgres application database and the key volume together; the dashboards are worthless without the key that decrypts the connections, and vice versa.
Upgrades
Pull the new tag, recreate, migrations run on boot. Metabase releases often; ride our promoted tags rather than chasing every upstream point release.
FAQ
Questions we get.
Is this the paid Metabase?
No. It is the AGPL open source edition; the separately licensed Enterprise edition is not used in this image.
Can it query MySQL, Postgres, and the databases my apps already use?
Yes, you add them as data sources in the UI. On the App Platform, that includes the databases of your other apps on the same server.
Why Postgres for the app database?
Because H2, the embedded default, corrupts under real use and blocks clean upgrades. Every serious Metabase runs an external app database.
Where are the admin credentials?
Printed once to the container log on first boot; store them and rotate the password after login.
Your server runs. You sleep.
Fully managed hosting from people who have been doing this since 2001.