# Configure > Part of the NocoDB documentation (Self-hosting > Installation > Compute Lite). Index of all pages: https://nocodb.com/llms.txt. Any docs page is available as Markdown by adding `.md` to its URL. URL: https://nocodb.com/docs/self-hosting/installation/compute-lite/configure Last updated: 2026-11-09 Settings for Compute Lite and NocoDB: environment variables, TLS, private registries, air-gapped installs and host mode. ### NocoDB settings Set these on NocoDB. The first three are required. | Variable | Example | Description | | -------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | ----------------------------------------------------------------------------------------------------------- | | `NC_COMPUTE_LITE_URL` | `http://compute-lite:8430` | The Compute Lite API, as NocoDB reaches it. | | `NC_COMPUTE_LITE_KEY` | Output of `openssl rand -hex 24` | The API key. At least 32 characters. Must match the key on Compute Lite. | | `NC_COMPUTE_LITE_DOMAIN` | `sandbox.example.com:8431` | The wildcard name without `*.`, with the proxy port. `*.` must resolve to Compute Lite from NocoDB. | | `NC_COMPUTE_LITE_TLS` | `true` | Optional. Set it when a TLS proxy is in front of port `8431`. | | `NC_COMPUTE_LITE_IMAGE_CHAT`
`NC_COMPUTE_LITE_IMAGE_SCRIPT`
`NC_COMPUTE_LITE_IMAGE_APP_BUILDER`
`NC_COMPUTE_LITE_IMAGE_APP_RUNTIME` | `registry.example.com/nc-chat-template:` | Optional. Replace the image of one sandbox type, for example with a mirror in a private registry. | ### Compute Lite settings Set these on the Compute Lite container. | Variable | Default | Description | | ---------------------------------------- | --------------- | -------------------------------------------------------------------------------------------------- | | `NC_COMPUTE_LITE_KEY` | Required | The API key. At least 32 characters. | | `NC_COMPUTE_LITE_PORT` | `8430` | The API port. | | `NC_COMPUTE_LITE_PROXY_PORT` | `8431` | The port proxy. | | `NC_COMPUTE_LITE_MAX_SANDBOXES` | `50` | Sandboxes that run at once. Lower it on a small host, for example `10` on 16 GB. | | `NC_COMPUTE_LITE_PAUSED_RETENTION_HOURS` | `168` | Hours before a paused chat sandbox is deleted. | | `NC_COMPUTE_LITE_DOCKER` | Automatic | `embedded` or `host`. Automatic picks `host` when a Docker socket is mounted. | | `NC_COMPUTE_LITE_ADDRESS_POOL` | `10.213.0.0/16` | Address range of the sandbox networks. | | `NC_COMPUTE_LITE_BRIDGE_IP` | `10.214.0.1/24` | Bridge of the inner Docker engine. | | `NC_COMPUTE_LITE_ALLOW_PRIVATE` | None | Private ranges that sandboxes can reach, comma-separated. For example, an internal package mirror. | | `NC_COMPUTE_LITE_LOCAL_TAGS` | `false` | See [air-gapped](#private-registry-or-air-gapped). | If your network overlaps `10.213.0.0/16` or `10.214.0.0/24`, change the two ranges **before the first start**. ### Serve the proxy over TLS 1. Put a reverse proxy, such as Caddy, nginx or Traefik, in front of port `8431`. 2. Use a wildcard certificate. Forward HTTP and WebSocket traffic, and keep the `Host` header. 3. On NocoDB, remove the port from `NC_COMPUTE_LITE_DOMAIN` and set `NC_COMPUTE_LITE_TLS=true`. ### Private registry or air-gapped **Private registry.** Mirror the four images and set the `NC_COMPUTE_LITE_IMAGE_*` variables on NocoDB. **Air-gapped.** 1. On a host with internet access, pull the four images and save each one to a file: ```bash docker pull nocodb/nc-chat-template:@sha256: docker save nocodb/nc-chat-template:@sha256: -o nc-chat-template.tar ``` 2. Copy the files to the Compute Lite host. Load each one into the Docker engine of Compute Lite: ```bash docker compose exec -T compute-lite docker load < nc-chat-template.tar ``` 3. On Compute Lite, set `NC_COMPUTE_LITE_LOCAL_TAGS=true`. A loaded image loses the digest that NocoDB pins. This setting lets Compute Lite run it by tag. ### Host mode Host mode uses the Docker engine of the host instead of its own. Use it only on a host that runs nothing else. ```bash docker run -d --name nc-compute-lite --restart unless-stopped --network host \ -v /var/run/docker.sock:/var/run/docker.sock \ -e NC_COMPUTE_LITE_KEY= \ nocodb/nc-compute-lite:2c607a1381a9 ``` | | Embedded mode (recommended) | Host mode | | ------------------------------- | ------------------------------------------------------------------------------------------- | ------------------------------------------------------ | | Docker engine | Its own engine, inside its container | The engine of the host, through its socket | | Needs | `--privileged` | The Docker socket mounted, and `--network host` | | Other containers | Sandboxes cannot see them. | Compute Lite changes only the containers that it made. | | Private networks | Blocked for sandboxes | Open to sandboxes, until you add firewall rules | | After a restart of Compute Lite | Sandboxes stop. Chat sandboxes keep their files and resume. Other sandboxes are made again. | Sandboxes keep running. | Host mode does not block private networks. To block them: 1. Start Compute Lite once, so it makes its networks. 2. As root, run: ```bash for net in nc-compute-lite nc-compute-lite-internal; do subnet=$(docker network inspect -f '{{(index .IPAM.Config 0).Subnet}}' $net) # Traffic that Docker forwards to other networks: your LAN, other containers, metadata for dst in 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 100.64.0.0/10 169.254.0.0/16; do iptables -I DOCKER-USER -s "$subnet" -d "$dst" -j DROP done iptables -I DOCKER-USER -s "$subnet" -m conntrack --ctstate ESTABLISHED,RELATED -j RETURN # Traffic to the host itself through the bridge gateway: a database or sshd on the host iptables -I INPUT -s "$subnet" -m conntrack ! --ctstate ESTABLISHED,RELATED -j DROP done ``` 3. Make the rules persistent. Run them again if the networks are re-created. --- ## Related pages - [Compute Lite](https://nocodb.com/docs/self-hosting/installation/compute-lite.md): Compute Lite runs the NocoDB sandboxes for scripts, AI code execution and the App Builder on your own servers, as one Docker container. - [Installation](https://nocodb.com/docs/self-hosting/installation/compute-lite/install.md): Install Compute Lite with Docker Compose, on Kubernetes or on a separate host, and connect it to your self-hosted NocoDB. - [Upgrade and troubleshoot](https://nocodb.com/docs/self-hosting/installation/compute-lite/troubleshoot.md): Upgrade Compute Lite, read its logs, and fix common problems with NocoDB sandboxes on your own servers.