n8n in Docker. Workflow automation, pinned.

docker-compose walkthrough

The image ships a standalone docker-compose.yml:

name: n8n

services:
  n8n:
    image: ${N8N_IMAGE:-ghcr.io/remarkablecloud/n8n:2.38.6-r1}
    restart: unless-stopped
    ports: ["${HTTP_PORT:-5678}:5678"]
    environment:
      N8N_PORT: "5678"
      GENERIC_TIMEZONE: ${TZ:-UTC}
      N8N_SECURE_COOKIE: ${N8N_SECURE_COOKIE:-false}
    volumes:
      - n8n-data:/home/node/.n8n

volumes:
  n8n-data:

Line by line:

• image pins the RemarkableCloud n8n tag, overridable with the N8N_IMAGE variable.
• restart: unless-stopped brings n8n back after a crash or host reboot.
• ports publishes container port 5678 on the host (default 5678). This is for standalone runs only. Behind Traefik on the App Platform, no port is published; the proxy routes to the container on the internal network.
• environment sets the listen port, timezone, and cookie policy (see the reference below).
• volumes mounts the named n8n-data volume at /home/node/.n8n, which holds the SQLite database and the credential encryption key.

Start it with docker compose up -d, then open http://localhost:5678 and create the owner account on first visit.

Environment variable reference

The App Platform wires these automatically from the app hostname; the standalone column shows the defaults baked into docker-compose.yml. Behind Traefik, TLS terminates at the proxy and the container speaks plain HTTP.

Variable	App Platform value	Standalone default	Notes
N8N_PORT	5678	5678	Port n8n listens on inside the container.
N8N_PROTOCOL	https	not set	Tells n8n it is served over HTTPS (TLS terminates at Traefik).
N8N_HOST	your hostname	not set	Public hostname n8n serves; the platform fills this from the app hostname.
N8N_EDITOR_BASE_URL	https://your-hostname/	not set	Base URL of the editor. Note the trailing slash.
WEBHOOK_URL	https://your-hostname/	not set	Public base for generated webhook URLs. It must match the real domain or inbound webhooks break. Note the trailing slash.
N8N_PROXY_HOPS	1	not set	Number of trusted proxy hops in front of n8n (Traefik is one), so client IP and cookie handling are correct.
N8N_SECURE_COOKIE	true	false	Marks the session cookie secure. On over HTTPS in production; off for plain-HTTP local runs.
GENERIC_TIMEZONE	UTC	UTC	Timezone used by schedule and cron nodes.
TZ	not applicable	UTC	Standalone compose variable that feeds GENERIC_TIMEZONE.
HTTP_PORT	not applicable	5678	Host port published in standalone compose only (not published behind Traefik).
N8N_IMAGE	not applicable	ghcr.io/remarkablecloud/n8n:2.38.6-r1	Image reference override for standalone compose.

Hardening notes

• Non-root by default. The container runs as the node user, not root.
• TLS at the proxy. In production the container serves plain HTTP and Traefik terminates TLS. Keep the container off any public port and let the proxy reach it on the internal network.
• Secure cookies on. Set N8N_SECURE_COOKIE=true whenever n8n is served over HTTPS so session cookies are not sent over plain HTTP.
• Trust exactly one proxy. N8N_PROXY_HOPS=1 matches a single Traefik hop. Raise it only if you add another trusted proxy in front.
• Protect the instance. Create the owner account immediately on first visit so the editor is not left open. Store secrets in n8n credentials rather than hard-coding them in nodes.
• Healthcheck gating. The /healthz healthcheck keeps a not-ready container out of rotation.

Backup and upgrade

Backup. All state lives in the n8n-data volume at /home/node/.n8n: the SQLite database (workflows, executions, settings) and the credential encryption key. Back up the whole volume on a schedule. The encryption key is critical: if you lose it, every stored credential becomes unreadable even if you still have the database. For a consistent copy, snapshot the volume or stop the container briefly before copying.

Upgrade. Pull the newer RemarkableCloud tag (for example a later -rN or a new upstream version), then recreate the container. The named volume persists across the upgrade, so workflows and credentials carry over. Read the CHANGELOG for the target tag before upgrading, and back up the volume first. Because n8n uses SQLite here, an upgrade is a container swap with no separate database migration step to run.