Configure

NocoDB settings

Set these on NocoDB. The first three are required.

Variable	Example	Description
`NC_COMPUTE_LITE_URL`	`http://compute-lite:8430`	The Compute Lite API, as NocoDB reaches it.
`NC_COMPUTE_LITE_KEY`	Output of `openssl rand -hex 24`	The API key. At least 32 characters. Must match the key on Compute Lite.
`NC_COMPUTE_LITE_DOMAIN`	`sandbox.example.com:8431`	The wildcard name without `.`, with the proxy port. `.<domain>` must resolve to Compute Lite from NocoDB.
`NC_COMPUTE_LITE_TLS`	`true`	Optional. Set it when a TLS proxy is in front of port `8431`.
`NC_COMPUTE_LITE_IMAGE_CHAT` `NC_COMPUTE_LITE_IMAGE_SCRIPT` `NC_COMPUTE_LITE_IMAGE_APP_BUILDER` `NC_COMPUTE_LITE_IMAGE_APP_RUNTIME`	`registry.example.com/nc-chat-template:<tag>`	Optional. Replace the image of one sandbox type, for example with a mirror in a private registry.

Compute Lite settings

Set these on the Compute Lite container.

Variable	Default	Description
`NC_COMPUTE_LITE_KEY`	Required	The API key. At least 32 characters.
`NC_COMPUTE_LITE_PORT`	`8430`	The API port.
`NC_COMPUTE_LITE_PROXY_PORT`	`8431`	The port proxy.
`NC_COMPUTE_LITE_MAX_SANDBOXES`	`50`	Sandboxes that run at once. Lower it on a small host, for example `10` on 16 GB.
`NC_COMPUTE_LITE_PAUSED_RETENTION_HOURS`	`168`	Hours before a paused chat sandbox is deleted.
`NC_COMPUTE_LITE_DOCKER`	Automatic	`embedded` or `host`. Automatic picks `host` when a Docker socket is mounted.
`NC_COMPUTE_LITE_ADDRESS_POOL`	`10.213.0.0/16`	Address range of the sandbox networks.
`NC_COMPUTE_LITE_BRIDGE_IP`	`10.214.0.1/24`	Bridge of the inner Docker engine.
`NC_COMPUTE_LITE_ALLOW_PRIVATE`	None	Private ranges that sandboxes can reach, comma-separated. For example, an internal package mirror.
`NC_COMPUTE_LITE_LOCAL_TAGS`	`false`	See air-gapped.

If your network overlaps 10.213.0.0/16 or 10.214.0.0/24, change the two ranges before the first start.

Serve the proxy over TLS

Put a reverse proxy, such as Caddy, nginx or Traefik, in front of port 8431.
Use a wildcard certificate. Forward HTTP and WebSocket traffic, and keep the Host header.
On NocoDB, remove the port from NC_COMPUTE_LITE_DOMAIN and set NC_COMPUTE_LITE_TLS=true.

Private registry or air-gapped

Private registry. Mirror the four images and set the NC_COMPUTE_LITE_IMAGE_* variables on NocoDB.

Air-gapped.

On a host with internet access, pull the four images and save each one to a file:

docker pull nocodb/nc-chat-template:<tag>@sha256:<digest>
docker save nocodb/nc-chat-template:<tag>@sha256:<digest> -o nc-chat-template.tar

Copy the files to the Compute Lite host. Load each one into the Docker engine of Compute Lite:
```
docker compose exec -T compute-lite docker load < nc-chat-template.tar
```
On Compute Lite, set NC_COMPUTE_LITE_LOCAL_TAGS=true.

A loaded image loses the digest that NocoDB pins. This setting lets Compute Lite run it by tag.

Host mode

Host mode uses the Docker engine of the host instead of its own. Use it only on a host that runs nothing else.

docker run -d --name nc-compute-lite --restart unless-stopped --network host \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -e NC_COMPUTE_LITE_KEY=<your key> \
  nocodb/nc-compute-lite:2c607a1381a9

	Embedded mode (recommended)	Host mode
Docker engine	Its own engine, inside its container	The engine of the host, through its socket
Needs	`--privileged`	The Docker socket mounted, and `--network host`
Other containers	Sandboxes cannot see them.	Compute Lite changes only the containers that it made.
Private networks	Blocked for sandboxes	Open to sandboxes, until you add firewall rules
After a restart of Compute Lite	Sandboxes stop. Chat sandboxes keep their files and resume. Other sandboxes are made again.	Sandboxes keep running.

Host mode does not block private networks. To block them:

Start Compute Lite once, so it makes its networks.

As root, run:

for net in nc-compute-lite nc-compute-lite-internal; do
  subnet=$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $net)
  # Traffic that Docker forwards to other networks: your LAN, other containers, metadata
  for dst in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do
    iptables -I DOCKER-USER -s "$subnet" -d "$dst" -j DROP
  done
  iptables -I DOCKER-USER -s "$subnet" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN
  # Traffic to the host itself through the bridge gateway: a database or sshd on the host
  iptables -I INPUT -s "$subnet" -m conntrack ! --ctstate ESTABLISHED,RELATED -j DROP
done

Make the rules persistent. Run them again if the networks are re-created.