Docker image
Metabase in Docker. BI your team will use.
Metabase is the business intelligence tool your team will actually use: point it at a database, ask questions in a visual editor or SQL, and pin the answers to dashboards.
# Metabase in Docker, base pinned by digest docker pull ghcr.io/remarkablecloud/metabase:0.63.17.2-r1 docker compose up -d
- Current build
0.63.17.2-r1, updated Sep 12, 2026- Base
- Metabase OSS, digest-pinned
- What's inside
- Postgres app database, persisted encryption key, generated admin
- Upstream license
- Metabase: AGPL-3.0 (the open source edition; the separately licensed Enterprise edition is not used in this image).
The image
What our image adds.
What changes from upstream Metabase, and why it matters in production.
PostgreSQL application database from day one
H2 is for demos; this stack keeps Metabase's own state in Postgres 16, which is the difference between a toy and a system of record.
Persisted encryption key
Data source credentials are encrypted at rest, and the key lives on a volume, so recreating the container never locks you out of your connections.
Generated admin on first boot
The administrator exists with a generated password before the port opens; the setup wizard is never claimable by a stranger.
Digest-pinned base, non-root runtime
Rebuilt and scanned on our schedule, not upstream's surprises.
Proxy-aware
MB_SITE_URL drives links, embeds and email; TLS terminates at your proxy.
The guide
Run it in production.
Compose file, environment reference, hardening, backups and upgrades, written by the people who build the image.
On this page
Architecture at a glance
Two containers: metabase (JVM app, port 3000 internal) and db (Postgres 16, Metabase’s own state). The databases you analyze are external connections you add in the UI; this stack stores the questions, dashboards and credentials, not your data warehouse.
Docker Compose walkthrough
Set DB_PASSWORD and SITE_URL, bring it up, read the generated admin credentials from the container log, log in, and connect your first data source. Give the JVM room: 2 GB RAM is a sane floor, more if many people run heavy questions concurrently.
Environment variable reference
| Variable | Purpose |
|---|---|
| MB_DB_TYPE / MB_DB_HOST / MB_DB_PORT / MB_DB_DBNAME / MB_DB_USER / MB_DB_PASS | Metabase’s own application database |
| MB_SITE_URL | Public https URL; drives links, embedding and email |
| Encryption key (persisted on volume) | Encrypts stored data source credentials at rest |
Hardening notes
Metabase holds credentials to every database you connect, which makes it the most sensitive app on the server. Keep it behind TLS, scope the database users you connect with to read-only wherever analysis doesn’t need writes, and leave the app database unreachable from outside the internal network.
Backups
Back up the Postgres application database and the key volume together; the dashboards are worthless without the key that decrypts the connections, and vice versa.
Upgrades
Pull the new tag, recreate, migrations run on boot. Metabase releases often; ride our promoted tags rather than chasing every upstream point release.
Changelog
Each build is pinned by digest and recorded here, so you can see what changed before you pull a new tag.
-
0.63.17.2-r1Current Sep 12, 2026
Metabase and other product names are trademarks of their respective owners. RemarkableCloud is not affiliated with or endorsed by them.
FAQ
Metabase in Docker, answered.
Short answers from the people who build and run this image.
Is this the paid Metabase?
No. It is the AGPL open source edition; the separately licensed Enterprise edition is not used in this image.
Can it query MySQL, Postgres, and the databases my apps already use?
Yes, you add them as data sources in the UI. On the App Platform, that includes the databases of your other apps on the same server.
Why Postgres for the app database?
Because H2, the embedded default, corrupts under real use and blocks clean upgrades. Every serious Metabase runs an external app database.
Where are the admin credentials?
Printed once to the container log on first boot; store them and rotate the password after login.
Pull it, or let us run it.
The same images our managed apps use, free on GHCR.