Free tools Windows power users keep installed
One-click scans. No signup required.
The practical answer: run n8n in Docker with a persistent /home/node/.n8n volume, then put it behind an HTTPS reverse proxy before exposing it publicly. SQLite is adequate for a private trial or light personal use; PostgreSQL is the sensible baseline for a business installation. Back up both the database and n8n’s encryption key, and add Redis and workers only when measured workload requires queue mode.
Antihost offers VPS plans with one-click n8n, NVMe storage and a 14-day free trial.
n8n describes Docker as the preferred self-hosting option for many deployments. You remain responsible for the server, Docker and operating-system updates, DNS, TLS certificates, authentication, backups, monitoring, and recovery. The official Docker guidance is at n8n’s Docker installation documentation.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What self-hosting n8n with Docker actually means
Self-hosting means your n8n process and its data run on infrastructure that you operate instead of on n8n’s managed Cloud service. Docker packages n8n and its runtime into a container, while volumes and external services hold data that must survive container replacement.
| Deployment | What runs where | Best fit | What you operate |
|---|---|---|---|
| Laptop or desktop | n8n in Docker on your computer | Learning, development, private experiments | Docker, local storage, and the computer’s availability |
| Home server or NAS | n8n permanently on equipment in your network | Private-network automations and low-cost personal use | Power, connectivity, dynamic DNS or tunneling, updates, backups, and firewalling |
| Public VPS | Docker, a database, and a reverse proxy in a datacenter VM | Webhooks and always-on small-business workflows | Server hardening, DNS, TLS, updates, monitoring, and disaster recovery |
| Private cloud | Containers on infrastructure controlled by your organization | Internal systems, residency requirements, and custom networking | The complete platform, including access control and operational response |
| Managed database with self-hosted n8n | n8n in your Docker host; PostgreSQL operated by a database provider | Reducing database maintenance while retaining application control | n8n’s volume, encryption key, network access, backups, and provider configuration |
| n8n Cloud | n8n operates the infrastructure | Readers who do not want to maintain servers, TLS, backups, or uptime | Workflow configuration and account security rather than the platform |
Docker is isolation and packaging, not a complete security boundary. A production deployment still needs a host firewall, strong secrets, controlled access, patching, off-server backups, and a tested restore procedure.
#1 Best Overall
Choose an architecture before you install
Single container with SQLite
Use one n8n container and a named volume for testing, local development, or low-volume personal automation. It has the fewest moving parts and SQLite is n8n’s default database. It is not the right assumption for every business deployment or for a distributed worker setup.
n8n with PostgreSQL
Choose PostgreSQL when workflows are business-critical, execution volume is growing, operational database tooling matters, or you expect to use queue mode later. PostgreSQL adds credentials, health checks, backups, and another service, so do not add it merely because a tutorial does.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQueue mode with Redis and workers
Queue mode adds Redis, a main n8n process, and one or more workers. It can distribute executions and keep the main process responsive, but throughput still depends on CPU, memory, database contention, API limits, workflow design, external latency, concurrency, binary-data storage, and idempotent retries.
The official n8n hosting repository includes examples for PostgreSQL, PostgreSQL with Redis and a worker, reverse proxies, Caddy, and Kubernetes.
Prerequisites and planning
- A Linux server, desktop, NAS, or cloud VM with reliable storage.
- Docker Engine and Docker Compose. Docker Desktop bundles both on macOS, Windows, and Linux; Linux users may install Engine and Compose separately.
- SSH access for a remote host.
- A domain and DNS access if webhooks or editor access will be public.
- Firewall control. Public HTTPS normally requires ports 80 and 443; keep n8n’s internal port private behind the proxy.
- A strong, private encryption key that will remain unchanged for the life of the instance.
- An off-server backup destination and a plan to test restoration.
There is no universal hardware minimum that fits every n8n deployment. Size the host from active workflow count, trigger frequency, concurrent executions, binary-file volume, Code nodes or task runners, worker count, database size, and other services sharing the machine. Observe CPU, memory, disk, and execution duration rather than relying on a single advertised specification.
Fast local installation: one Docker container
This path is appropriate for a private local instance or a temporary evaluation. It intentionally exposes port 5678 only so you can reach the editor; do not treat a directly exposed public :5678 endpoint as a finished production configuration.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →docker volume create n8n_data
docker run -it --rm
--name n8n
-p 5678:5678
-e GENERIC_TIMEZONE='America/New_York'
-e TZ='America/New_York'
-e N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true
-e N8N_RUNNERS_ENABLED=true
-v n8n_data:/home/node/.n8n
docker.n8n.io/n8nio/n8nOpen http://localhost:5678. On a remote host, you can temporarily use http://SERVER_IP:5678 while testing through a restricted firewall or SSH tunnel.
Rank #2
What each option does
docker volume create n8n_datacreates Docker-managed storage that survives removal of the container.--rmremoves the stopped container, not the named volume.--name n8ngives the container a predictable name.-p 5678:5678maps the host port to n8n’s internal port.GENERIC_TIMEZONEcontrols workflow scheduling;TZcontrols the container’s timezone behavior.N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=trueenables stricter settings-file permissions.N8N_RUNNERS_ENABLED=trueenables the task-runner setting used in the current official Docker example.-v n8n_data:/home/node/.n8npreserves workflows, credentials database content, the encryption key, logs, and other instance assets.
If the container exits
docker ps -a
docker logs n8n
docker inspect n8nRestart an existing stopped container with docker start n8n. If it was created with --rm and has already exited, recreate it with the same n8n_data volume. If data disappears after recreation, inspect the volume and mount path rather than creating a new empty volume.
Durable production baseline with Docker Compose
Compose makes the application, database, volumes, network, health checks, and environment variables reproducible. The following is a writer-created baseline assembled from n8n’s documented PostgreSQL variables; it is not an official n8n Compose file. Use the official PostgreSQL example when you need a provider- or proxy-specific configuration.
1. Create a protected working directory
sudo mkdir -p /opt/n8n
sudo chown $USER:$USER /opt/n8n
cd /opt/n8n
touch compose.yml .env
chmod 600 .env2. Create the environment file
N8N_HOST=n8n.example.com
N8N_PROTOCOL=https
N8N_PORT=5678
WEBHOOK_URL=https://n8n.example.com/
N8N_PROXY_HOPS=1
GENERIC_TIMEZONE=America/New_York
TZ=America/New_York
POSTGRES_USER=n8n
POSTGRES_PASSWORD=replace-with-a-long-random-password
POSTGRES_DB=n8n
N8N_ENCRYPTION_KEY=replace-with-a-long-random-secretGenerate unique random values, protect .env, and never paste real credentials into screenshots, issue trackers, or shell history. Environment-variable behavior can change between n8n releases and topologies; verify names against the current Docker documentation before upgrading.
3. Add compose.yml
services:
postgres:
image: postgres:16
restart: unless-stopped
environment:
POSTGRES_USER: ${POSTGRES_USER}
POSTGRES_PASSWORD: ${POSTGRES_PASSWORD}
POSTGRES_DB: ${POSTGRES_DB}
volumes:
- postgres_data:/var/lib/postgresql/data
healthcheck:
test: ['CMD-SHELL', 'pg_isready -U ${POSTGRES_USER} -d ${POSTGRES_DB}']
interval: 10s
timeout: 5s
retries: 10
n8n:
image: docker.n8n.io/n8nio/n8n
restart: unless-stopped
ports:
- '127.0.0.1:5678:5678'
environment:
DB_TYPE: postgresdb
DB_POSTGRESDB_HOST: postgres
DB_POSTGRESDB_PORT: 5432
DB_POSTGRESDB_DATABASE: ${POSTGRES_DB}
DB_POSTGRESDB_USER: ${POSTGRES_USER}
DB_POSTGRESDB_PASSWORD: ${POSTGRES_PASSWORD}
N8N_HOST: ${N8N_HOST}
N8N_PROTOCOL: ${N8N_PROTOCOL}
N8N_PORT: ${N8N_PORT}
WEBHOOK_URL: ${WEBHOOK_URL}
N8N_PROXY_HOPS: ${N8N_PROXY_HOPS}
N8N_ENCRYPTION_KEY: ${N8N_ENCRYPTION_KEY}
GENERIC_TIMEZONE: ${GENERIC_TIMEZONE}
TZ: ${TZ}
N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS: 'true'
N8N_RUNNERS_ENABLED: 'true'
volumes:
- n8n_data:/home/node/.n8n
depends_on:
postgres:
condition: service_healthy
volumes:
n8n_data:
postgres_data:The loopback binding keeps n8n off the public interface; a reverse proxy on the same host can reach it at 127.0.0.1:5678. Persist both volumes. PostgreSQL does not replace the n8n volume: /home/node/.n8n still contains the encryption key and other instance data.
4. Validate and start
docker compose config
docker compose pull
docker compose up -d
docker compose ps
docker compose logs -f n8nCheck PostgreSQL readiness with:
docker compose exec postgres pg_isready -U $POSTGRES_USER -d $POSTGRES_DBOpen the editor only after the logs show a successful database connection. If startup fails, inspect n8n logs first, then PostgreSQL logs and the rendered configuration from docker compose config.
Expose n8n safely with DNS, a reverse proxy, and HTTPS
A public instance normally needs a DNS A or AAAA record pointing to the host, a reverse proxy such as Traefik, Caddy, or NGINX, a valid TLS certificate, and correct forwarded headers. n8n’s Docker Compose tutorial demonstrates n8n with Traefik for routing and certificate management. n8n’s security guidance places TLS and encryption-at-rest responsibilities on self-hosters.
Understand the public URL settings
N8N_HOSTis the public hostname, such asn8n.example.com.N8N_PROTOCOL=httpstells n8n that users and webhook callers reach it over HTTPS.WEBHOOK_URLis the externally reachable base URL n8n uses when generating webhook addresses.N8N_PROXY_HOPStells n8n how many trusted proxies sit in front of it. Set it to match your topology, not a copied example.
A dedicated subdomain is usually easier to troubleshoot than a subpath such as example.com/n8n. The proxy must forward the Host, X-Forwarded-For, and protocol headers, support WebSockets for editor updates, and renew certificates. Permit ports 80 and 443 at the firewall as required by your certificate method; keep port 5678 private.
Rank #3
If the editor loads but generated webhooks contain localhost, an internal container name, or http, check DNS, WEBHOOK_URL, forwarded headers, TLS termination mode, and proxy-hop count. OAuth callback failures usually have the same public-URL cause. A tunnel can help when inbound ports cannot be opened, but verify that the tunnel supports the webhook traffic and provider allowlists you need.
SQLite or PostgreSQL?
| Choice | Use it for | Trade-off |
|---|---|---|
| SQLite | Testing, personal automation, low-volume single-process use | Simpler, but less suitable for larger or distributed deployments |
| PostgreSQL | Business-critical workflows, growing volume, conventional production operations, and future queue mode | Requires a service, credentials, health checks, backups, and maintenance |
n8n uses SQLite by default and supports PostgreSQL through environment variables. The database guidance does not make PostgreSQL mandatory for every installation. Even with PostgreSQL, persist /home/node/.n8n.
Plan migrations instead of flipping one variable
Changing DB_TYPE is not a migration plan. Before moving from SQLite, export workflows where appropriate, back up the original database and n8n volume, preserve the encryption key, account for credentials and binary data, import or restore into a controlled target, and verify webhook URLs. Test the procedure on a disposable stack before touching the live instance.
Security hardening that belongs in the initial deployment
- Put a reverse proxy and valid TLS in front of any internet-reachable instance; do not publish a bare port 5678 as the production endpoint.
- Keep
N8N_ENCRYPTION_KEYlong, private, backed up separately, and stable. Do not casually change it on an existing instance. - Protect
.env, Compose files containing secrets, database dumps, and volume archives. - Restrict SSH with keys, a host firewall, and least-privilege accounts.
- Keep Docker, the operating system, PostgreSQL, the proxy, and n8n updated.
- Use separate credentials for PostgreSQL and connected services. Enable n8n user management and two-factor authentication where appropriate.
- Review community nodes and Code nodes. They can introduce third-party code or access to sensitive data; task runners are not automatically a complete sandbox.
- Use a VPN, identity-aware proxy, or private network for editor access when public webhooks are unnecessary.
- Run n8n’s security audit periodically:
docker compose exec n8n n8n auditThe exact CLI invocation can vary with the image entrypoint and release; use the equivalent command or API path in n8n’s security-audit documentation if this form fails.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Backups and a restore drill
A Docker volume is persistent storage, not a tested backup. Back up the PostgreSQL database, the n8n volume, the encryption key, any custom-node or binary-data mounts, reverse-proxy configuration, the Compose file, and a sanitized environment template. Store copies off the server.
Logical PostgreSQL backup
docker compose exec -T postgres
pg_dump -U $POSTGRES_USER -d $POSTGRES_DB
> n8n-$(date +%F).sqlThe shell variables must exist in the shell running the command; otherwise load .env or pass explicit values. Do not archive a live PostgreSQL data directory and assume it is a valid database backup.
Restore concept
cat n8n-YYYY-MM-DD.sql | docker compose exec -T postgres
psql -U n8n -d n8nRun a restore only against a stopped, disposable, or intentionally reset target according to your documented plan; it can overwrite current data.
Recommended Free Tools
Perform a real restore test
- Deploy a clean test stack with the same n8n version.
- Restore the PostgreSQL dump and the
/home/node/.n8ndata. - Restore the original encryption key exactly.
- Start n8n and log in.
- Open a workflow and confirm credentials decrypt correctly.
- Run a harmless test workflow and one representative webhook.
- Record the elapsed time and any missing files, then improve the backup procedure.
Restoring only PostgreSQL while losing the encryption key can leave encrypted credentials unusable.
Update n8n without turning upgrades into outages
The Docker documentation supports pulling the latest stable image or a specific n8n version. For a business-critical deployment, pin a tested image rather than following a moving latest tag:
image: docker.n8n.io/n8nio/n8n:<tested-version>- Read the n8n release notes and check configuration changes.
- Back up PostgreSQL, the n8n volume, and the encryption key.
- Test the candidate image in staging.
- Pull and recreate the production container:
docker compose pull
docker compose up -d
docker compose logs -f n8n- Check migrations and logs.
- Test the editor, credential access, scheduled workflows, and representative webhooks.
- Keep the previous image available while recognizing that database migrations can make a simple image rollback insufficient.
Before an update, a database dump can be created with:
docker compose exec -T postgres pg_dump
-U n8n -d n8n > pre-update-$(date +%F).sqlWhen Redis and workers are justified
Queue mode is a later stage, not a beginner requirement. Add it when executions need distribution, the main process must remain responsive, or multiple workers are justified by measured workload. The official PostgreSQL-and-worker example shows the broader architecture.
- Redis becomes a dependency and another service to secure and monitor.
- Main and worker containers must use compatible n8n versions and queue settings.
- Database connections, CPU, memory, external API limits, and binary storage can become bottlenecks before worker count does.
- Retries and parallel execution require idempotent workflow design to avoid duplicate side effects.
Scale one bottleneck at a time. Measure queue depth, execution duration, memory pressure, database contention, and provider rate-limit responses before adding workers.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Task runners, Code nodes, and binary data
Task runners
Current official Docker examples enable runners with N8N_RUNNERS_ENABLED=true. n8n also documents external task runners and additional variables; verify the runner architecture and names against the version-specific Docker documentation before using an isolated production design. Code nodes and community nodes deserve separate review because they can read sensitive workflow data or execute third-party logic.
Binary-data storage
Large files can rapidly consume the n8n volume when binary data uses the local filesystem. n8n documents external S3 storage as a self-hosted Enterprise feature. The documented variables include:
Best Value
- Docker, Docker Swarm, Docker Compose, Programmer, Developer, Coding, Programming, Software Engineer, Code, DevOps, Deploy, Deployment, Kubernetes, Salt, Puppet, Chef, Terraform, Container, AWS, Azure, Cloud, Geek, Funny, Computer, Software, Tech, IT
- Integration, Scrum, Compile, Compilation, Science, Bug, Debug, Python, Linux, Java, Javascript, Scala, Dotnet, Kotlin
- Lightweight, Classic fit, Double-needle sleeve and bottom hem
N8N_EXTERNAL_STORAGE_S3_HOST=
N8N_EXTERNAL_STORAGE_S3_BUCKET_NAME=
N8N_EXTERNAL_STORAGE_S3_BUCKET_REGION=
N8N_EXTERNAL_STORAGE_S3_ACCESS_KEY=
N8N_EXTERNAL_STORAGE_S3_ACCESS_SECRET=
N8N_AVAILABLE_BINARY_DATA_MODES=filesystem,s3
N8N_DEFAULT_BINARY_DATA_MODE=s3The documentation distinguishes AWS S3 from S3-compatible services: compatible endpoints may work, but they are not officially supported for this feature. It also records version-specific validation for bucket-region names beginning with n8n 2.6.4; verify that requirement against the version you deploy rather than applying it universally.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesMonitoring and routine checks
docker compose ps
docker compose logs --tail=100 n8n
docker compose logs --tail=100 postgres
docker stats
df -h
free -hMonitor container restarts, disk usage, PostgreSQL health, memory pressure, failed executions, webhook failures, certificate expiry, backup success, n8n version age, and queue depth when workers are enabled. Alerts should tell you whether the problem is application, database, storage, network, or certificate related.
Troubleshooting matrix
| Symptom | Likely cause | First checks |
|---|---|---|
| Container exits immediately | Invalid variable, permissions, database connection, or migration error | docker compose logs n8n |
| Editor works but webhooks fail | Wrong WEBHOOK_URL, proxy headers, DNS, or TLS |
Inspect the generated URL and proxy configuration |
| Credentials fail after restore | Encryption key missing or changed | Restore the original key with the database |
| Data disappears after recreation | Missing or incorrect persistent volume | docker volume ls and docker inspect |
| PostgreSQL connection refused | Database not ready, wrong host, credentials, or network | docker compose ps, PostgreSQL logs, and pg_isready |
| HTTPS redirect loop | Proxy protocol or forwarded-header mismatch | Review N8N_PROTOCOL and proxy TLS mode |
| Schedules run at the wrong time | Timezone mismatch | Check GENERIC_TIMEZONE and TZ |
| Disk fills unexpectedly | Binary data or execution history growth | Check volume and host usage with df -h |
| Workers do not process jobs | Redis, queue variables, or version mismatch | Inspect main, worker, and Redis logs |
| OAuth callback fails | Incorrect public hostname or HTTPS configuration | Confirm the provider callback URL and WEBHOOK_URL |
Licensing and the Cloud-versus-self-hosted decision
Without a license key, self-hosted n8n runs the free Community edition. Business and Enterprise self-hosted features require the applicable license. n8n’s pricing page lists Cloud and self-hosted options and states that self-hosted Business and Enterprise keys contact n8n’s license server daily. Licensing for hosting workflows or credentials on behalf of clients can depend on the use case; consult n8n’s license-use guidance rather than assuming a personal deployment covers commercial service delivery.
- Choose Cloud when managed upgrades, hosted operations, and convenience matter more than infrastructure control.
- Choose self-hosting when private-network access, data residency, version control, custom deployment patterns, or custom nodes matter and your team can operate security and recovery.
- Use Docker Desktop for local development on a workstation; use Docker Engine and Compose on an always-on Linux server for production.
Final deployment checklist
- Persistent
/home/node/.n8nstorage is mounted and tested. - The database choice matches workload: SQLite for simple single-instance use, PostgreSQL for durable production operations.
- The encryption key is random, private, stable, and backed up separately.
- DNS, TLS, proxy headers, WebSockets,
WEBHOOK_URL, andN8N_PROXY_HOPShave been verified. - Port 5678 is not the public production endpoint.
- Host, Docker, n8n, PostgreSQL, and proxy updates are planned and tested.
- Database and filesystem backups are off-server, and a restore drill has succeeded.
- Disk, memory, restarts, failed executions, certificates, and backups are monitored.
- Redis and workers are added only after measured workload justifies their operational cost.
For most readers, the right progression is a persistent single container for evaluation, Docker Compose with PostgreSQL and HTTPS for a serious single instance, and queue mode only when execution volume and concurrency prove that the extra services are worthwhile.
Frequently Asked Questions
Can I run n8n with SQLite in Docker?
Yes. SQLite is n8n’s default and is suitable for testing, personal automation, and low-volume single-process use. Persist /home/node/.n8n; move to PostgreSQL when production durability, growth, or queue mode makes the added operational complexity worthwhile.
Why does n8n need its volume when PostgreSQL is enabled?
The /home/node/.n8n directory contains more than the SQLite database, including the encryption key, logs, and other instance assets. PostgreSQL storage alone is not a complete n8n backup.
Is exposing port 5678 enough for production webhooks?
No. Use DNS, a reverse proxy, valid TLS, forwarded headers, and a correct WEBHOOK_URL. Keep port 5678 private behind the proxy.
What happens if I lose the n8n encryption key?
A restored database may still contain encrypted credentials that n8n cannot decrypt. Back up the original key separately and restore it unchanged with the database.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
